# Autonomy levels L0 to L5

Six named levels of how much an agent may pay on its own, which policy fields set each, and why a tool confirmation in a chat is not a level.

Status: Live · Updated: 2026-09-13
For: agent
Source: https://enruta.ai/docs/autonomy-levels

“How much can the agent pay by itself” is answered by every product in its own words. Enruta names the levels and shows the label on every policy, so a buyer without a payments background sees what the extra step buys.

| Level | Meaning | Policy fields | Example |
|---|---|---|---|
| L0, a person every time | Every payment needs a click | `approval.threshold: "0.00"` (or an approval rule with no threshold) | A spend request the person confirms one by one |
| L1, a single limit | One cap, no other rule | `limits.per_payment` only; no payees, no approval | A monthly allowance |
| L2, a locked target | Merchant, category, frequency and time fixed in advance | `mode: specified` with a payee | “One night in Shanghai next Wednesday, under $300” |
| L3, autonomous inside the boundary, a person beyond it | A policy, a human gate, a record | `mode: bounded_stepup` (the default) with an approval rule | “Office supplies, $200 a payment, a person above $150” |
| L4, autonomous for the scene | Every task inside the preset scope, nobody in the loop | `mode: bounded` without an approval rule | “Verified suppliers, $5,000 a payment, $50,000 a month” |
| L5, no boundary |  | Not offered | Nobody runs this in production |

`autonomyLevel(policy)` in `@enruta/policy` computes the label from those fields; the console shows it at the top of every policy page (“This policy is L3: autonomous inside the boundary, a person approves beyond it”). One company can run three agents at three levels in one console: a travel agent at L2, a procurement agent at L3, an accounts-payable agent for verified suppliers at L4.

## Only L3 has a verifiable approval

An approval at L3 is an event with a signature bound to a request hash. A tool confirmation in a chat, the “Allow once” button a host shows before a tool call, is not a level at all: it has no amount, no payee, no expiry and no signature. Those four fields are the line between a mandate and a UI confirmation, and the [risk assessment](https://enruta.ai/docs/risk-assessment) does not count confirmations as input.

## Related fields

| Field | Effect on the level |
|---|---|
| `shadow: true` | Any level runs in [shadow mode](https://enruta.ai/docs/shadow-mode): decisions become `observe` and nothing is enforced |
| `require_consent` | Adds a [consent record](https://enruta.ai/docs/consent-and-kya) as a precondition at any level |
| `deviation{tolerance, action}` | How far a delivered price may move from the requested one before the agent pauses or cancels |
| `reversal{window_days, step_up_above}` | Refunds have their own gate: above the amount a person signs |
| `intent`, `identity_requirements`, `payee_identity` | What a request must say, which anchors an amount needs, and whether the merchant must be verified, at any level ([trust model](https://enruta.ai/docs/trust-model)) |