Autonomous AI agents: how much autonomy should marketing work get?

The word autonomous covers very different behavior when it's applied to AI agents. An agent that researches competitors for an hour without help, then waits for approval before it posts anything, can be called autonomous. So can an agent that posts, replies to customers, and changes ad budgets without asking anyone. For a team deciding which marketing work to hand over, the difference between those two agents matters far more than the label they share.

An autonomous AI agent is software that pursues a goal by deciding and carrying out its own steps, using tools, without a person directing or approving each one. Autonomy is a matter of degree, which is why both agents qualify, and it can be set task by task, often step by step within a task.

For marketing work, the right degree depends less on how capable the agent is than on what a mistake would cost. Research, analysis, and drafts can run with a lot of independence, because a person reviews them before anything happens. Steps that publish, send, spend money, or speak for your brand should keep a person approving. This guide explains five levels of autonomy, what the evidence says about fully autonomous agents, and a four-question test for placing each marketing task at the right level.

What makes an AI agent autonomous?

An AI agent is autonomous to the extent that it acts without a person directing or approving each step. In everyday English, an autonomous machine or system is one that can operate without direct human control, as the Cambridge Dictionary puts it. European law treats autonomy as a matter of degree. The EU AI Act's definition of an AI system covers systems designed to operate with varying levels of autonomy, which its recitals explain as some independence from human involvement.

For an agent, independence shows up at specific points: who chooses the next step, whether the agent carries on after an unexpected result, which tools and accounts it may use, and whether an action takes effect before anyone signs off. An agent that plans a competitor analysis, decides which pages to read, and writes the report without checking in has acted autonomously for that job, even if it then waits for you before sharing the report with anyone. The guide to how AI agents work explains the mechanics behind those steps.

How much autonomy an agent has is a design decision, separate from how capable it is. Kevin Feng, David McDonald, and Amy Zhang make this argument in a 2025 paper for the Knight First Amendment Institute, and Google DeepMind researchers made a related point in their Levels of AGI paper, noting that the right level of autonomy need not be the highest one a model could support. Two products built on the same model can behave very differently because one asks before acting and the other doesn't. When a vendor calls its agent autonomous, it is describing a setting it chose, and the first thing to find out is whether you can change it.

Autonomy also varies within a single job. In a 2000 paper on human interaction with automation, Raja Parasuraman, Thomas Sheridan, and Christopher Wickens divided automated work into four functions (gathering information, analyzing it, choosing an action, and carrying the action out) and proposed that each can be automated to a different degree. A marketing job divides the same way. An agent might gather and analyze a quarter's customer reviews on its own, recommend which complaints deserve a public answer, and leave the replies for a person to approve.

Autonomous, agentic, and automated: how the terms differ

Automated means a person set a system's steps in advance, agentic means the system chooses its own steps as it works toward a goal, and autonomous means it acts without a person directing or approving each step. The table sets the three next to an AI assistant and a fully autonomous agent.

Agentic and autonomous overlap, and some researchers treat them as near-synonyms. Margaret Mitchell and colleagues, for example, describe agents as more or less autonomous, or agentic, along a single sliding scale. For a buyer, the distinction is still worth keeping. A highly agentic agent can have little autonomy if it plans a whole campaign analysis and then asks before every action. A system can also be autonomous without being agentic: a scheduled report that pulls the same numbers every Monday needs nobody, but it never decides anything. Keeping the terms apart separates two questions: whether an agent can handle a job, and whether it should handle that job without you.

View the agentic and autonomous diagram at full size (opens in a new tab).

Five levels of agent autonomy for marketing work

The five levels of agent autonomy describe an agent's independence by the role you play while it works: operator, collaborator, consultant, approver, or observer. The roles come from Feng, McDonald, and Zhang's framework, which defines each level by how a person can interact with and control the agent rather than by what the agent can technically do. The table adapts their levels to marketing, with an example task at each.

At the first two levels, you are still doing the work. Feng and colleagues describe Level 1, where the person stays in charge and the agent supports on request, as well suited to high-stakes work that needs expertise, where an inaccurate result is costly or accountability matters. In marketing, that covers a positioning decision, a pricing page, or a statement during a crisis. At Level 2, you and the agent each plan and carry out parts of the job, and you can take over at any time.

At Level 3, the agent takes the lead. It plans the work and carries it out over a longer stretch, and your role shifts to feedback, preferences, and broad direction. This suits work you can brief clearly but want to steer, such as a competitor analysis, a content brief, or a campaign plan.

At Level 4, the agent works alone and you approve. In the framework, the person is needed only when the agent hits a blocker it can't resolve: a failure it can't recover from, login details it doesn't have, or a consequential action that needs sign-off. The authors suggest this level suits tasks with many lower-stakes decisions, where a wrong call does little harm. Scheduled research, monitoring, and draft production fit here, with approval in front of anything public, paid, or permanent.

Level 5 is the fully autonomous agent. You can read its activity log, but you can't give it input or change its course, and your only control is an emergency off switch. The authors conclude that the risks of Level 5 agents may outweigh the benefits in most cases, partly because simple errors can compound over many steps with no one to catch them. In marketing, Level 5 fits only internal chores whose worst outcome is a wasted run, such as tagging data no customer will see.

Higher levels are not better levels. As the authors put it, "more autonomy does not simply mean a better agent." One job often spans several levels. The research behind a newsletter can run with little supervision while the send waits for a person. Other frameworks use different scales. Mitchell and colleagues, for example, grade agents by how much of a program's flow the AI model controls. The role-based version suits a marketing team best because it describes what you will be doing while the agent works.

View the five levels of agent autonomy at full size (opens in a new tab).

Human in the loop, on the loop, and out of the loop

The loop phrases describe where a person sits relative to a system's actions. A human in the loop must act or approve before the system acts. A human on the loop supervises while the system acts on its own and can step in to override or stop it. A human out of the loop isn't involved. A 2012 Human Rights Watch report on weapons systems used these three categories to describe how much human involvement each type of system has.

The European Commission's High-Level Expert Group on AI applied the vocabulary to AI in its 2019 ethics guidelines. It defines human in the loop as the ability to intervene in every decision cycle, which it notes is in many cases neither possible nor desirable; human on the loop as intervening in the system's design and monitoring its operation; and human in command as overseeing the system's overall activity and deciding when and how to use it, including deciding not to use it. The group also argued that the less oversight a person can exercise over an AI system, the more testing and the stricter governance it needs.

The loop terms map onto the five levels. At Levels 1 and 2 you are in the loop for every step, and at Level 3 for the decisions the agent brings to you. At Level 4 you are in the loop for consequential actions and on the loop for the rest. At Level 5 you are on the loop at most, watching a log with an off switch in reach. At every level, your team stays in command: it decides which jobs an agent gets, at what level, and when to stop one.

View the loop terms diagram at full size (opens in a new tab).

Can an AI agent run your marketing fully autonomously?

Not today, and not for the steps that carry real risk. Nothing technical stops a developer from connecting an agent to live accounts and removing every approval, so fully autonomous agents can be built. The evidence so far argues against letting one publish, send, or spend with no person able to step in.

A public experiment shows what happens when an agent runs a small business. In Anthropic's Project Vend, an AI agent ran a small shop in the company's office for about a month in 2025, choosing stock, setting prices, and dealing with customers over the company's chat tool. It found suppliers for unusual requests and adapted to what customers asked for. It also priced some items below cost, was talked into handing out discount codes and free items, and for a time told customers to pay into an account that didn't exist. Anthropic concluded that, as things stood, it would not hire the agent to run the shop.

In a second phase, reported in December 2025, the agent got better tools and procedures it had to follow, such as double-checking prices and delivery times before quoting them, and weeks with negative profit margins largely disappeared. People still carried the risk. The agent had to check with a person before every purchase, and staff had to step in when it and a second agent acting as its manager were ready to agree to an onion futures contract, a kind of deal banned by a 1958 US law, and when it tried to hire a colleague as a security officer below California's minimum wage. Anthropic's summary was that a wide gap remains between a capable agent and a completely robust one.

Agents are getting better at long tasks quickly, but reliability lags behind. METR, a research nonprofit, measures the length of tasks AI agents can complete, timed by how long the same tasks take skilled people, using mostly software tasks. In its study, first published in March 2025, the length of task agents could complete half the time had doubled roughly every seven months since 2019. The length they could complete eight times out of ten was four to six times shorter, and agents struggled more in messier settings without clear feedback. Much marketing work is messy in that sense, because whether a headline or a positioning choice worked may not be clear for weeks.

Researchers who study the ethics of AI go further. In a 2025 position paper, Margaret Mitchell, Avijit Ghosh, Alexandra Sasha Luccioni, and Giada Pistilli argue that fully autonomous agents should not be developed. Risks to people rise as people cede more control to an agent, they write, and a fully autonomous agent may act faster than anyone can intervene. They conclude that semi-autonomous systems, which keep some human control, offer a better balance of benefit and risk. Their definition of full autonomy differs from Level 5 (an agent that writes and runs its own code beyond the limits people set), but the conclusion points the same way.

The useful question is narrower than whether an agent can run your marketing alone. It is which steps an agent can run alone, and for most teams that list is long: research, monitoring, analysis, and drafting. What stays with people is a shorter list of steps that publish, send, spend, or commit the brand, plus the judgment calls about strategy and taste.

View the evidence on full autonomy at full size (opens in a new tab).

The four-question autonomy test for marketing tasks

To decide how much autonomy a marketing task should get, ask four questions about each step in it. The answers set a ceiling on autonomy. They don't tell you whether the agent is good enough for the work, which only testing can show; they tell you how much a mistake would cost if it isn't.

1. Can it be fully undone? A draft in a folder can be deleted without anyone noticing. A sent email can't be recalled, a published post may be read and shared before you remove it, and money that has been spent stays spent.
2. Will people outside the team see it? Posts, replies, emails, ads, and web pages reach people who had no part in the decision.
3. Does it spend or commit money? Budgets, bids, purchases, discounts, refunds, and contracts all count. Project Vend's discount codes were a money decision as much as a customer-service one.
4. Does it speak for the brand? Claims, promises, prices, apologies, and opinions published in your name commit the company, even when every fact in them is right.

Apply the answers strictest first. If a step can't be fully undone, a person approves the exact action every time, with no standing permission. That rule follows a December 2023 white paper by OpenAI researchers, which argues that some decisions are too important to delegate if there is even a small chance of getting them wrong, such as an irreversible large payment, and that requiring a person to authorize them is a standard way to limit the worst failures.

If a step can be undone but reaches the public, spends money, or speaks for the brand, a person approves it before it takes effect, so Level 4 is the ceiling. A narrow standing approval can cover a repeated, well-defined version of the step. If a step can be undone and the other three answers are no, the agent can carry it out on its own, at Level 4 or 5, and you review the output before you act on it.

The test covers actions, where autonomy carries the most risk. Judgment calls need one more distinction. Choosing a launch's positioning, setting a price, or deciding how to answer a public complaint can be prepared by an agent at a high level of autonomy: the research, the options, and the evidence for each. The choice itself is better made by a person, at Level 1 or 2, than approved by one, because approving a recommendation you haven't thought through is easy to do and hard to notice.

View the four-question autonomy test at full size (opens in a new tab).

How to give an AI agent more autonomy safely

Raise an agent's autonomy one task and one level at a time, once the results at the current level hold up, and keep the controls that let you take it back.

Start a new task below its ceiling, often at Level 3, and run it with yourself present before you schedule it. Note which questions the agent asks, which sources it uses, and what you correct. Move it up a level when several runs in a row need little correction and you can describe what a bad result would look like. The guide to automating marketing with AI agents covers the setup for recurring runs, including what should happen when a source is unavailable or a run can't finish.

Give each task only the access it needs. Security practice calls this least privilege, which NIST defines as limiting the access of users, and of processes acting for them, to the minimum their assigned tasks require. An agent preparing a competitor digest needs to read public pages; it doesn't need to post to your social accounts. Access sets how far a mistake can travel, so narrow access makes higher autonomy safer.

Keep standing approvals narrow. Approving every action is the safest arrangement, but on recurring work it soon becomes a queue. Limit a standing approval to one task, one account, and one kind of action, and let it lapse when the task changes materially.

Guard against rubber-stamping. Approval protects you only if the approver looks. Feng and colleagues list disengaged approvers as an open problem at Level 4, and the OpenAI white paper notes that people asked to approve many decisions quickly can consider each one less carefully. In 2000, Parasuraman and his coauthors described a related pattern, in which people stop monitoring automation that is reliable most of the time but not always, and then miss its occasional failures. Ask for approval only at consequential steps, and make each request show exactly what will happen.

Keep a way to stop the agent and a record of what it did. The white paper treats the ability to turn an agent off as a blunt but essential safeguard, and the EU AI Act requires high-risk AI systems to let the people overseeing them override the output or halt the system with a stop button or a similar procedure. The AI Act's rules target high-risk uses, but the same two controls are worth having in any marketing agent: a way to stop a run that's going wrong, and a workspace or log that shows what the agent read, wrote, and did.

View the diagram of raising autonomy safely at full size (opens in a new tab).

How autonomy works in Ampere

Ampere is an AI marketing agent that carries supported marketing work from a plain-English brief to finished outputs, while you keep direction and approval. In terms of the five levels, a session works mostly at Level 3, and scheduled tasks and monitors work closer to Level 4.

In a session, Ampere plans the work, researches, drafts, and packages the deliverables in its session workspace, where you can open the files and pages it works with. It asks for clarification, approval, or taste direction when your answer would materially change the result, and it stops for a structured question only when a missing fact blocks the work. It can email you when it needs your input or when finished work is ready to review, and you can stop it while it's working.

A scheduled task can run a saved prompt and its attachments on a cadence, and each run's results wait on the task's page for review. It can pause itself after repeated failures or when credits run out. When Ampere proposes a scheduled task in a session, it becomes a saved task only after you accept it. Monitoring checks supported public sources hourly, daily, or weekly and files alerts, with the evidence it found, in its alerts inbox. Ampere prepares follow-up work only when a monitor has a follow-up action configured.

Where Connectors are enabled, a Connector action that needs approval waits for you. In a session, Ampere shows the full action before you approve it, you can deny it, and the action doesn't go ahead if the approval can't be tied to exactly what you reviewed. For a scheduled task, you can choose to give standing consent to actions that allow it, scoped to the task, the connected account, the tool, and the task's prompt and settings; otherwise each action waits for a one-off approval. Material changes to the task require you to confirm again, destructive actions always need fresh approval, and without valid consent a run can finish its draft work, notify the task owner, and wait until the exact action is approved. Standing consent is off unless you grant it, so a team can keep approving the exact action every time for any step that can't be fully undone.

In terms of the test above, research and drafts run on their own, and Connector actions that need approval go ahead only with your approval or standing consent. Ampere is not fully autonomous, it isn't a social scheduler or an email sender, and nothing publishes without you. Its outputs can contain mistakes, so check claims and facts before the work goes out.

What to ask a vendor that says its agent is autonomous

Ask what the agent may do without you, how you can change that, and what stops it when something goes wrong. An autonomy claim describes a design choice, so the useful answers are specific settings and behaviors.

1. Which actions can it take without my approval, and can I change that for each task?
2. When I approve something, what exactly am I approving, and does a change to the task cancel the approval?
3. Which actions always need fresh approval, whatever else is configured?
4. What happens on a scheduled run when nobody is watching and an approval is missing?
5. When it lacks a fact it needs, does it ask, guess, or stop?
6. Can I see what it read, wrote, and did, and stop it partway through?
7. What access does it need, and can I limit it to one account or one kind of action?

Then test the answers on your own work. A short trial with a representative brief shows whether the agent asks sensible questions, stays inside its permissions, and produces work you would approve. The guide to evaluating an AI marketing agent explains how to run that trial and score the results.

The same criteria answer the question of which autonomous AI agent is best. For marketing, the best one lets you set autonomy task by task, shows exactly what each approval covers, works with narrow access, can be stopped, keeps a record of its work, and produces results that hold up on your own assignments. Feng and colleagues propose autonomy certificates, documents issued by an outside body that would state the highest level at which an agent may operate. Whether or not such certificates catch on, the idea suggests a good request. Ask the vendor to state in writing the highest level at which its agent can act, and who sets it.

Sources and further reading

• Kevin Feng, David McDonald, and Amy Zhang, Levels of Autonomy for AI Agents, Knight First Amendment Institute, July 28, 2025. The source of the five roles.
• Margaret Mitchell, Avijit Ghosh, Alexandra Sasha Luccioni, and Giada Pistilli, Fully Autonomous AI Agents Should Not be Developed, position paper, 2025.
• Meredith Ringel Morris and colleagues at Google DeepMind, Levels of AGI for Operationalizing Progress on the Path to AGI, ICML 2024 position paper.
• Raja Parasuraman, Thomas Sheridan, and Christopher Wickens, A model for types and levels of human interaction with automation, IEEE Transactions on Systems, Man, and Cybernetics, 2000.
• High-Level Expert Group on AI, Ethics Guidelines for Trustworthy AI, European Commission, April 8, 2019.
• Human Rights Watch, Losing Humanity, November 19, 2012.
• European Commission AI Act Service Desk, Regulation (EU) 2024/1689: Article 3, Recital 12, and Article 14.
• Anthropic, Project Vend, June 27, 2025, and Project Vend: Phase two, December 18, 2025.
• Thomas Kwa and colleagues at METR, Measuring AI Ability to Complete Long Software Tasks, NeurIPS 2025, first posted March 18, 2025.
• Yonadav Shavit and colleagues at OpenAI, Practices for Governing Agentic AI Systems, December 2023.
• NIST Computer Security Resource Center glossary, least privilege.
• Cambridge Dictionary, autonomous.

Frequently Asked Questions

Is agentic AI the same as autonomous AI?

No, though the terms overlap and some researchers treat them as near-synonyms. Agentic describes how much of the work a system decides and carries out itself: choosing steps, using tools, and adjusting to results. Autonomous describes how far it acts without a person directing, approving, or supervising it. A highly agentic agent can still ask before every action, while a scheduled report can run autonomously without deciding anything.

Is there a fully autonomous AI?

In a narrow sense, yes: nothing technical stops a developer from connecting an AI agent to live accounts and removing every approval. Researchers argue against doing so. A 2025 framework concludes that the risks of agents with no means for human involvement may outweigh the benefits in most cases, and a 2025 position paper argues that fully autonomous agents should not be developed. For marketing, keep a person approving anything that publishes, sends, or spends.

What is the difference between human in the loop and human on the loop?

A human in the loop must act or approve before the system acts, so nothing happens without them. A human on the loop supervises while the system acts on its own and can step in to override or stop it. In marketing, approving each social post before it goes out is human in the loop; reviewing a monitoring feed and pausing a scheduled task when something looks wrong is human on the loop.

What are the levels of autonomy for AI agents?

A 2025 framework published by the Knight First Amendment Institute defines five levels of AI agent autonomy by the role a person plays: operator, collaborator, consultant, approver, and observer. At the lowest level the agent helps when asked; at the highest it acts on its own while you watch a log with an off switch in reach. Other frameworks grade autonomy by how much of a program the AI model controls.

What are some examples of autonomous AI agents in marketing?

Good examples are recurring jobs in which every step can be undone and nothing goes public: compiling a weekly competitor digest, tagging customer reviews by theme, summarizing a change on a competitor's pricing page, or drafting posts and briefs for review. These can run with little supervision. Publishing the post, replying to a reviewer, sending a newsletter, or changing an ad budget are steps the agent should prepare and a person should approve.

What are the risks of autonomous AI agents?

The main risks of autonomous AI agents are errors that compound over many steps before anyone looks, actions that happen faster than a person can intervene, access broader than the job needs, and approvers who stop checking. In a 2025 experiment, an AI agent running a small office shop priced items below cost and was talked into handing out discounts and free items. Approval for public, paid, or irreversible actions and narrow access limit the damage.

What is the best autonomous AI agent?

The best autonomous AI agent for marketing is the one whose autonomy you can set task by task and whose work holds up on your own assignments. Look for approvals that show exactly what will happen, access you can narrow, a way to stop a run, a record of what the agent read and did, and a clear answer about what happens when an approval is missing. Then test it with a representative brief.

How are autonomous AI agents different from AI assistants and chatbots?

An AI assistant or chatbot responds to each request and then waits for the next one, so a person directs every step. An autonomous AI agent takes a goal, decides its own steps, uses tools such as a browser or connected accounts, and keeps working without a prompt at each stage, sometimes on a schedule. That independence is why an agent needs clearer limits on what it may do without approval.