# Autonomy spectrum by action — eCommerce AI agents

Companion to **How much autonomy should you give an eCommerce AI agent?**.

This is **not** the hybrid vs rules matrix (that is [`hybrid-automation-decision-matrix.md`](hybrid-automation-decision-matrix.md)). Fill this **after** you already have an agent with named tools. Autonomy is **per action**, not a global slider on the harness.

## Levels (lowest → highest)

| Level | Name | What the agent may do | What it must not do |
| ----- | ---- | --------------------- | ------------------- |
| 0 | Observe | Read tools; write a private note / trace | Customer-visible text, tickets, writes |
| 1 | Analyze | Produce an internal brief | Send, publish, mutate |
| 2 | Recommend | Structured decision to a queue | Execute the write |
| 3 | Draft | Fill the email / RMA / PO / reply | Send or capture |
| 4 | Request approval | Propose a Gateway write; block until HITL | Call the write tool itself |
| 5 | Execute | Call an **allowed** write after Cedar ALLOW | Bypass cap, status, or role |
| 6 | Fully automated | No human in the path | Money, inventory ATP, account mutation, payment |

**Opinionated default:** promote one level at a time, per action, after evals. Do not set the harness to Execute because WISMO notify worked.

## Suggested starting levels (replace with your store)

Demo labels only — not FactualMinds engagement KPIs. Caps are worksheets, not legal advice.

| Action | Week-one level | Promote when | Never (Fully automated) |
| ------ | -------------- | ------------ | ----------------------- |
| WISMO status reply | Execute (read + cite) | Carrier fields are the only ETA source | Invented clock-time windows |
| Delay notice from carrier exception | Fully automated **notify** | Duplicate-send guard exists | Compensation in the same turn |
| Refund / createReturn | Recommend or Request approval | Cedar cap + not-delivered + HITL above cap | Delivered-not-received, over-cap, shopper JWT |
| Discount / gift card | Draft or Request approval | Promo engine is the source of truth | Invented codes, stackable unpublished offers |
| Purchase order | Draft + Request approval | Buyer role JWT + vendor match | Auto-send PO |
| Customer apology / goodwill | Draft | Compensation amount in Policy | Silent goodwill credit |
| Inventory quantity write | Analyze / Recommend | Cycle-count evidence + associate JWT | ATP mutation from chat |
| Account email / address | Request approval | Identity proof + associate JWT | Shopper self-serve PII dump into Memory |
| Password / MFA / payout account | Observe only | — | Any agent write |
| Payment capture / card data | **Out of tool set** | — | Any agent tool |

## Promotion gate (copy into the RFC)

1. Golden evals pass at the **current** level (including “must not write”).
2. Gateway Policy has been in `LOG_ONLY` for that write, then `ENFORCE`.
3. HITL queue exists for the next level (session id + tool trace).
4. Browser and Code Interpreter still **off** unless a named skill needs them.
5. Platform cost modeled — support-style AgentCore silhouette **~$791/mo at 50K sessions** is a planning number, not savings.

## Related

- HITL queue shape: [`hitl-approval-architecture.md`](hitl-approval-architecture.md)
- Security checklist: [`ecommerce-agent-security-checklist.md`](ecommerce-agent-security-checklist.md)
- Monday ship gate: [`monday-checklist.md`](monday-checklist.md)