Autonomy

The assistant ships in COPILOT and is promoted one rung at a time. The decision is not a settings decision, so it has its own page — and the first thing to get right is which record holds the rung, because two of them do and only one of them normally decides.

The rung belongs to the agent

Two values are called autonomy:

• The active agent's own autonomy, a column on the agent row managed from Agents. It is never empty: every creation path writes COPILOT, whatever was posted, and the column is NOT NULL.
• aiSupportAutonomy, the Super-Admin setting on Settings, shown beside the master switch.

The engine reads the agent first and falls back to the setting only when there is no active agent at all:

const autonomy = agent?.autonomy || settings.aiSupportAutonomy;

The same expression decides whether a generation may post (answersAutonomously) and whether the customer's widget shows the AI disclosure (resolveParticipation), so the two can never disagree with each other. What they can disagree with is the Settings screen: on any install that has an agent — and Agents tells you to create one — the setting is never read. It is the fallback for an install running with no agent, which is a configuration that also costs you the persona and the disclosure line, and is not one to be in.

The three rungs

Tickets come before live chat on purpose. A ticket has latency built into the customer's expectations — nobody is watching a spinner — so a wrong answer is recoverable by a follow-up. A live chat answer lands in front of somebody who is already in the conversation.

Start in copilot, and actually read them

COPILOT is not a formality. It is the only period in which you find out what your knowledge base is missing before a customer does, and the edit distance it records is what the promotion gate is built from.

The promotion gate

The console will not simply take your word that it is ready. Raising an agent out of COPILOT — or from AUTO_TICKET to AUTO_ALL — is refused until four things are true of that agent's own copilot record:

A refusal names every check that failed and by how much, so it is a report rather than a wall. The Overview draws the first three as progress tiles, which is deliberate: a gate you only discover by being refused reads as a bug. Read them as an indication rather than as the gate: they appear while the setting reads COPILOT, and they count every draft on the install, not only this agent's.

Read the edit distance as a proxy for one question: if nobody had been there, would the customer have got a good answer?

• Drafts sent almost unchanged — the assistant is answering your customers' real questions from your real articles. Promote.
• Drafts heavily rewritten — usually a knowledge problem, not a model problem. Check Gaps: the topics being rewritten are almost always topics you have not documented.
• Drafts replaced entirely — something is wrong upstream. Read the reasoning rail on a few of them; if retrieval is finding the wrong thing, fix the articles before touching autonomy.

The gate is on the agent, and only on the agent. It is enforced by the agent update route. The Settings path — the master-switch panel, which writes aiSupportAutonomy — performs no evidence check of any kind, because the value it writes is not the one the engine obeys. Lowering an agent's rung is never gated: demotion is a safety action and is accepted unconditionally.

Going back down

Send {"autonomy": "COPILOT"} and nothing else: the route only touches keys that are present in the body, so the persona, the model and everything else are left exactly as they are.

Demotion costs you nothing that was already earned. Conversations already answered keep their answers, conversations in flight go to the queue for a person, and the copilot record the gate is built from is not reset — promote again later and the same drafts still count.

Reasons to drop a rung without hesitating:

• You changed provider or model and have not read drafts on the new one
• You shipped a big platform change and the docs have not caught up
• Your budget ceilings are being reached, which means volume has outgrown your configuration and you want eyes on it
• A single bad answer got out and you want to know why before it happens twice

What does not change with autonomy

The safety behaviour is identical on every rung. At AUTO_ALL the assistant still refuses below the confidence floor, still refuses to state your policy from somebody else's documentation, still escalates, and still stops dead at the budget ceiling.

Two paths are draft-only on every install, whatever the rung says:

• Generate a draft on the Live Inbox always returns a draft to the composer and posts nothing. An agent asking for help writing a reply is not asking for the reply to be sent.
• A direct answer from one of your own articles is posted only where the rung allows posting. In COPILOT it becomes a draft like any other — an install whose whole configuration says a person reads every reply does not get a different rule because retrieval happened to find an exact match.

Autonomy decides who presses send. It does not decide what the assistant is willing to say.