What Is Bounded Autonomy?

Every useful AI agent needs some freedom. If every step is scripted in advance, it is a workflow, and it breaks on the first case nobody scripted. If it can do anything it decides to, nobody can safely let it near a real system. Bounded autonomy is the arrangement in between, and it has a precise meaning.

An agent has autonomy within bounds when it may request anything but only permitted requests become effects. The agent keeps real discretion: it picks the next step, chooses which tool to ask for, and finds an approach nobody wrote down. What it cannot do is turn a request into a change the system has not allowed.

The four bounds

Most agent systems need four limits, each answering one question:

• Which actions: the tools and operations the agent may request at all. Reading files may be allowed while deleting them is refused.
• Where: the scope those actions may touch. These folders, this customer's records, this test environment.
• How much: a budget. A number of changes, steps, retries, or money spent before the run stops.
• When a person decides: the cases that pause for a human answer instead of proceeding, such as anything irreversible or anything outside the usual pattern. Where that person sits, and whether they can really judge, is human-in-the-loop design.

Each request meets the same checks on its way to becoming an effect:

A bound or a request

A limit written into the prompt is a request to the model; a limit enforced outside the model is a bound. "Never delete files" in the system prompt depends on the model following it, in every run, under every input, including instructions an attacker slipped into a document. A permission check in the software that runs the tools does not depend on the model at all. If removing a sentence from the prompt would remove the limit, the limit was never a bound.

That is why bounded autonomy is an engineering arrangement more than a model property. The same model can be bounded tightly in one system and not at all in another.

What it looks like in a real tool

DAX's README lists a scope guard, a path guard, a mutation budget and a loop breaker among its safety controls, and its policy crate resolves proposed actions to allow, ask or deny without a model call. Those map onto the four bounds: scope and paths are where, the mutation budget is how much, the loop breaker stops a run that keeps trying, and ask is the point where a person decides. DAX is built by this site's author; its page is DAX on the Stack.

The full path from a model's request to a change in the world, and which layer owns each failure, is from agent intent to governed execution. Who chooses the next step in the first place is AI agents vs AI workflows.

What this changes

When someone says an agent is safe, ask where its bounds live. If the answer is the prompt, the agent has instructions and no bounds. If the answer is code that checks every request before it runs, with a record of each decision, it has bounded autonomy.