Earned Slowly, Revoked Instantly: The Asymmetry Inside Agent Autonomy Scores

An agent needs to clear a tier floor by five points to be promoted. It needs one unauthorized tool call to be demoted. That is the AWS graduated autonomy model, published in August 2026, and the five points are the part worth studying.

AWS, Thoughtworks and Datadog each published an agent autonomy architecture that month. The three documents come from different teams solving different problems: trust scoring, data readiness, and dispatch contracts. They land on the same primitive. Permission is not handed over once. It is scored continuously against recent behaviour, and it moves.

What AWS actually published

AWS scores an agent from 0 to 100 across a rolling window of its last 50 actions. Five dimensions carry the weight: Accuracy at 25%, Safety at 20%, Consistency at 20%, Compliance at 20%, Efficiency at 15%. Safety also acts as an independent floor, so a high Accuracy score cannot average away a safety failure. That detail is the one most weighted-score designs get wrong, and it is written into the rubric.

The score maps to four tiers:

Tier	Score	What the agent may do
T1 Probation	0 to 40	”Read and list only. Two tools visible.”
T2 Supervised	41 to 70	”Add write operations. Human approves high-risk.”
T3 Trusted	71 to 90	”Execute and modify. Anomalies flagged for review.”
T4 Autonomous	91 to 100	”Full access. Post-hoc audit only.”

AWS frames the problem it is solving as the distance between what an agent could do and what an operator trusts it to do: “The distance between what an agent could do and what an operator trusts it to do is the agent’s trust gap.”

The five points are the whole design

Promotion requires clearing the tier floor by five points. Demotion is immediate. A single unauthorized tool call fails the adversarial gate and the agent drops.

That hysteresis exists for a mechanical reason. A score computed over a rolling window oscillates near any threshold. An agent sitting just under 71 would cross the line and fall back on noise alone, and without a buffer each crossing would grant or revoke write access. The five-point buffer converts a jittery boundary into a stable one, at the cost of making promotion slower than the raw score suggests.

Demotion carries no such buffer, and it should not. The two errors are not symmetric in consequence. Promoting an agent too slowly costs latency and some human review time. Promoting an agent too readily hands write access to a process that just demonstrated it would misuse it. The asymmetry in the mechanism is a direct encoding of the asymmetry in the cost.

This is where the model differs from most permission designs, including the one we described in The Containment Stack. That piece is about where the wall sits: runtime, microVM, network egress, gateway. This one is about what moves the wall. The containment layers are static by design, and they should be. The autonomy tier is the variable that decides which of those layers the agent is currently allowed to operate inside.

The input problem Thoughtworks raises

A behavioural score is only as good as the record it scores. Thoughtworks approaches the same architecture from the data side, staging agents through Shadow Mode, then Supervised, then Autonomous with guardrails, then Full autonomy, with promotion granted on evidence rather than on schedule.

Their medallion tiers for agent-facing data run Bronze (raw ingestion), Silver (validated and deduplicated), Gold (certified), and Adaptive Gold (agent-curated), with a rule that matters more than the tier names: “agents should only access Gold tier or above.”

Sadalage and Chandrasekaran give the reason plainly: “when the data feels wrong, a human double-checks; an agent confidently acts on it.” A human operator absorbs data defects silently, so a pipeline can carry quality problems nobody has quantified. Put an agent on the same feed and the defect becomes an action. Under a graduated autonomy model, it also becomes a demotion, and the agent loses standing for a failure it did not cause.

The record Datadog says you need first

None of the scoring works without a machine-readable trace of what the agent did. Datadog specifies the dispatch chain as “Signal, curated context, task identity, allowed capabilities, execution target, recorded output.” Each link is something a scorer can read.

Their definition of a machine-consumable contract sets the bar for a tool an agent is allowed to call: a clear description, typed inputs and outputs, stable and versioned schemas, machine-readable limits and error categories, and declared side effects, preconditions, and approval requirements. Declared side effects are what let a scorer classify a call as high-risk before it runs rather than after.

Datadog also insists that terminal workflow states be defined explicitly: succeeded, failed, cancelled, expired, approval denied, escalated. Retry budgets are bounded by attempt count, elapsed time, or token cost. An agent whose runs end in an undefined state produces unscoreable actions, and an unscoreable action is a hole in the rolling window.

One measured number in that post is worth carrying: field selection and aggregation in their MCP Server tools cut run cost by roughly 40%. Narrower tool surfaces are cheaper to run as well as easier to govern.

Three documents, one shape

	AWS	Thoughtworks	Datadog
Unit of trust	Numeric score, 0 to 100	Stage, promoted on evidence	Capability declared per dispatch
Evidence window	Rolling 50 actions	Observed behaviour per stage	Recorded output per task
Numeric rubric in the cited post	Yes, weights and tier bands	Not given	Not given
Gate on the input	Not specified	Gold tier data or above	Curated context in the chain
Failure handling	Immediate demotion	Guardrails before full autonomy	Explicit terminal states, bounded retries

Of these three, AWS is the only one that published a numeric rubric. Thoughtworks and Datadog describe the promotion logic without committing to thresholds. A rubric you can print is a rubric a customer can argue with, and that is a property worth having when the question is why an agent was allowed to write to production.

What none of them establishes

All three are vendor publications describing architectures they recommend. None reports production outcome data from running these models at scale. The AWS weights are a published design, not a measured result: nothing in the post shows that 25% Accuracy and 20% Safety produce better outcomes than any other split, and the 50-action window is asserted rather than tuned in public.

The convergence is worth noting for its shape, not its size. Three teams describing the same primitive in the same month says the design has become the obvious answer among people building this. It does not say the industry has adopted it.

Do this now

Instrument the record before you build the ladder. Pick your highest-volume agent workflow and make every run emit a terminal state from a closed list, with the tool called, the declared side effects, and the outcome. Run it long enough to cover your normal workload variation, with no scoring attached and no tiers. Then compute what the score would have been.

The usual finding at that point is that an unauthorized tool call is indistinguishable from an authorized one, because the tool contracts never declared which was which. That finding is cheaper to have before you have promised anyone a tier ladder.

For the surrounding controls, task-scoped permissions narrow what a tier grants inside a single task, The Containment Stack sets the walls the tier operates within, and blast radius per failure mode tells you which demotions need to be instant. The convergence on constraining the environment is the older half of this story, and the approval prompt is the control these models are trying to replace.

---

This analysis synthesizes Closing the AI agent trust gap with graduated autonomy (AWS, August 2026), Making your data ready for agentic AI (Thoughtworks, August 2026), and Golden paths for AI agents (Datadog, August 2026).

Victorino Group builds the behavioural record and scoring rubric that let enterprise agents earn autonomy under audit. Let’s talk.