Quick question. How much authority does your organization's AI have right now? Not the AI you approved. The AI you're actually running.
Most leaders I talk to can tell me which AI tools they signed off on. Fewer can tell me what those tools are allowed to do today. Almost none can tell me when that changed.
That last part is the problem. Organizations rarely choose how much authority their AI gets. They drift into it, one sensible decision at a time, and nobody notices until something breaks.
Let's discuss!
Who’s Driving? (The Series)
This is the first article in our series on AI. In this series, we focus on AI adoption because nearly every organization is rolling out AI right now, and most have no formal way to track how much authority it has. We lay out a straightforward framework to help you decide how much authority your AI gets, spot the risks, and guard against them before something goes sideways.
First, What's an Autonomy Level?
By autonomy, I mean how much the AI can decide and do without a person approving it first.
The Cloud Security Alliance (CSA), a not-for-profit that has published security best practices since 2008, released a framework in 2026 that sorts AI into six autonomy levels. Here's my plain-English version:
| Level | Name | What the AI does | What you do |
|---|---|---|---|
| 0 | None | Gives information or advice | Make every decision and take every action |
| 1 | Assisted | Proposes an action and carries it out | Approve each action before it runs |
| 2 | Supervised | Carries out an approved plan, step by step | Approve the plan up front |
| 3 | Conditional | Acts on its own inside boundaries you set | Set the boundaries and handle what gets escalated |
| 4 | High | Works across a broad scope | Monitor and handle exceptions |
| 5 | Full | Sets its own goals and pursues them | Provide strategic oversight only |
A quick summary of the six autonomy levels in the Cloud Security Alliance's Agentic AI Autonomy Levels and Control Framework, v2.0 (March 2026).
Notice the role you (the human in the loop) take at each level. At Level 1, you see every action. At Level 3, you don't see most of them. You only hear from the AI when it bumps into a boundary you drew. While at Level 5, you barely exist. In short, AI autonomy grows as you advance in level. This article focuses most on the jump from 2 to 3. CSA’s own recommendation is that most enterprise use cases should default to Level 1 or Level 2, and that governance should be in place before anything goes to Level 3 or higher. I denote this segmentation with the red line.
NOTE: CSA labels this framework "Unofficial AI-assisted Research." It comes from CSA's AI Safety Initiative, not its formal standards process; still, it clearly explains AI authority.
Bottom line: The higher the level, the more the AI does without you, so your controls need to be stronger.
Five Ways You Drift Up a Level
Picture this. Imagine you own a 250-person property management firm. You hire a new college grad (your golf buddy’s son, Harry) to answer the front desk phones. A few months in, he gets a key to the supply closet (makes sense). Then Harry gets the alarm code because he arrives early since he lives a few miles away. Then the office manager gives Harry access to a company card to buy some office supplies. Six months go by, and Harry starts approving vendor invoices while the office manager is on leave.
When you hired Harry as your receptionist, was your plan to give him (your golf buddy’s son) spending authority? Hell no. Over time, it just kind of happened. That is what I am calling drift, and it’s how most AI tools end up with more authority than anyone ever approved.
Here are examples of AI drifting up autonomy levels to keep an eye out for:
A vendor turns on an AI feature in a product you already own. Your CRM, your email platform, your document system, your HR software. One update, and a tool you approved years ago can now draft, summarize, and sometimes act. You didn't buy AI. Surprise! You got it anyway. FUN!
Someone turns on a connector. A connector lets an AI tool reach into another system, like your calendar, file storage, or ticketing system. It's usually a toggle. Whoever flips it just expanded what the AI can touch, and they probably didn't think of it as a security decision.
A “pilot” works, so it grows. One team tests an AI tool on one task. It goes well. Three more teams start using it for other tasks, and nobody runs a second review because "We already approved it, right?"
A tool adds capabilities on its own. Some AI tools install plugins or connect to new services as part of normal use. CSA calls this out directly: Plugins and new tool connections add capabilities without going through formal authorization.
Staff use personal accounts. If the approved tool is slow to arrive, people don't stop using AI. They use their own free accounts. Now your data sits in a tool you can't see, under terms you never agreed to.
Bottom line: Drift doesn’t take a bad decision. It just takes nobody asking, “Wait, what can this thing do now?” Followed by, “Did we approve that?”
Why Drift Is Dangerous
In March 2026, CSA looked at ten of the most serious AI agent security incidents from January through March. In those incidents, organizations were running AI at Levels 3 through 5 while using controls that would have been insufficient even for Level 2.
Read that again. Not a little behind. At least two levels behind. That's not a gap. That's a canyon.
Why does that matter so much? Because controls are built for a level. At Level 1, a person approves every action, so a bad action has to get past a human first. At Level 3, no person is in the loop for most actions (except escalations). The boundaries you configured are the control. If you're still counting on "someone will catch it," you're counting on a person who isn't there anymore.
For example, let’s go back to your hypothetical 250-person property management firm. Let’s say that last spring, you approved an AI assistant to draft tenant emails. Your staff reviews every draft before sending. That's Level 1.
Over the summer, the vendor adds a feature that lets the AI assistant send routine replies on its own. Someone in operations connects it to the shared inbox and the maintenance ticketing system to save time. By fall, the AI assistant reads incoming email, opens tickets, and sends replies without anyone seeing them first. That's Level 3.
But your company’s controls are still at "staff reviews every draft." They didn’t shift accordingly.
Now picture an attacker sending a maintenance request to that inbox with hidden instructions buried in the text. (That's called prompt injection, and it gets its own article in this series.) The AI reads it. The AI acts on it. And the only safeguard your company ever planned for is a reviewer who stopped reviewing in July. Good luck explaining that one to the board.
Bottom line: The risk isn't necessarily your AI autonomy level. It's being at one level with controls built for another.
What to Do About It
You don't need to stop using AI. You need to know where you are and notice when you move up in autonomy levels. Here are four steps you can take:
Pro-Tip
Don’t wait for renewal. Ask each vendor now: “When you add or change an AI feature in our account, is it off by default, and how will we find out?” If you have the leverage, get the answer in the contract. If you don’t, find out where they announce changes, like an admin message center or release notes, and make one person responsible for reading it.
Write down the level for every AI tool you run. Not the level you approved. The level it operates at today. If you can't name it, congrats, that's your first finding.
Make an autonomy level change a decision, not a side effect. Any new connector, new vendor feature, or expanded pilot gets one quick question: Does this move us up an autonomy level? If yes, it needs the approval that level calls for. Psst… Who should sign off at each level is coming in another article in this series.
Put the boundaries in settings, not just in a policy. CSA's own principle is that autonomy boundaries must be technically enforced, not left to a policy document. A policy tells people what the tool shouldn't do. A setting stops the tool from doing it.
Build the alert before you need it. Decide who gets notified when an AI tool picks up a new connection or capability. Not a line in a policy. An actual alert to an actual person.
Bottom line: Take time to ensure that you have the procedures in place to know when you (or your tools) move up in autonomy levels.
In Conclusion
Every AI tool you run has an autonomy level, whether you picked one or not. That level climbs every time a vendor ships a feature, someone flips on a connector, or a pilot quietly grows. And when CSA looked at the worst AI agent incidents of early 2026, the organizations involved were running AI at least two levels above what their controls could handle. The key is to ensure you have procedures in place to know when you (or your tools) move up in autonomy levels. Easy! Well, it might be easier said than done. Which prompted me to launch this series!
Next in the Who's Driving? series: Who should sign off at each level, and why IT shouldn't be the only name on the form.
If your organization is rolling out AI and you're not sure what level your tools are running at today, that's exactly the conversation I have with leadership teams. Contact us; we can help!
Now go check on Harry. I hear he's approving invoices. LOL.
To infinity and beyond… share this article with everyone once you get to infinity or beyond. LOL
