Copilot, bounded workflow, supervised agent, or autonomous agent? Compare authority

The meaningful difference is who can cause an external effect

A copilot advises or drafts for a person. A bounded workflow follows predetermined steps with narrow tools. A supervised agent chooses among actions but pauses before material effects. An autonomous agent can plan and act inside delegated limits without per-action approval. Place them on an automation-authority ladder with rows for decision variability, tool functions, permissions, state, data scope, spend, duration, approval, observability, stop, reconciliation, and failure consequence. Product labels are unreliable: a feature called assistant may send messages, while an agent may be read-only. Compare actual capabilities and enforced boundaries. Higher authority is justified only by a named benefit that outweighs the added failure surface.

Evidence: National Institute of Standards and Technology; OWASP Gen AI Security Project

Copilot mode keeps external judgment closest to the person

The system can summarize supplied material, propose edits, draft plans, or suggest tool arguments, but a person reviews and performs the action through normal controls. It has lower side-effect risk and suits ambiguous, novel, or high-consequence work where human context is essential. Its weaknesses are workload, copy-paste errors, automation bias, and possible exposure of sensitive inputs. Require source evidence, clear uncertainty, data rules, and a reviewer who can disagree. Choose copilot when the task benefits from generation but dynamic action provides little value. A human click is not enough if the interface hides what will happen.

Evidence: National Institute of Standards and Technology; OpenAI

Bounded workflow mode exchanges flexibility for testable control

A fixed sequence can retrieve from an approved corpus, transform data, validate schema, create a draft, and route to review. Tools and state transitions are known in advance; budgets, retries, and recovery can be tested per step. This fits repeated processes with stable rules and reversible or nonconsequential actions. The risk is propagating a bad early result and adding hidden authority through integrations. Use source provenance, failure states, idempotency, and a kill switch. Select a bounded workflow before an agent when decision branches can be expressed deterministically. Simplicity often improves evidence and maintenance.

Evidence: National Cybersecurity Center of Excellence; OpenAI

Supervised agents handle variable paths under proposal approval

A supervised agent may choose searches, tools, and sequencing, then present exact consequential actions for approval. It fits variable research, triage, or environment diagnosis where a fixed chain would contain many brittle branches. It needs least-privilege tools, immutable proposals, approval expiry, call and spend caps, stuck-loop detection, trace visibility, and safe cancellation. The reviewer must see evidence and be able to reject. Choose this level only when dynamic planning materially reduces work and the organization can operate incidents. Do not bundle many recipients, files, or purchases behind one vague approval.

Evidence: National Cybersecurity Center of Excellence; OWASP Gen AI Security Project

Autonomous agents require a narrow domain and mature reconciliation

Unattended action may fit low-consequence, high-volume, well-defined operations with strong identity, deterministic policy, robust evaluation, bounded resources, reversible effects, and independent monitoring. Examples might include classifying public documents or refreshing a noncritical cache, not unreviewed payments or public claims. Every run still needs finite terminal states and revocable authority. OWASP's excessive-agency model is especially relevant as autonomy rises. Avoid autonomous deployment when tools are broad, external results are ambiguous, data is sensitive, or the team lacks on-call response. Autonomy should shrink when uncertainty or consequence grows.

Evidence: National Institute of Standards and Technology; OWASP Gen AI Security Project

Choose the lowest rung that completes the legitimate job

The next action is to score one proposed automation at all four levels and list the specific capability gained at each step. Disqualify any level without identity, limits, monitoring, stop, approval appropriate to consequence, and recovery from uncertain effects. An illustrative publisher might use copilot drafting, a bounded source-check chain, and supervised approval for scheduling while rejecting autonomous publication; no productivity result is claimed. Limits remain: organizational maturity changes, rare incidents escape tests, provider internals are opaque, and matrix scores are contextual. Affiliate-linked platforms must meet the same evidence and disclosure. Do not climb the ladder because software can; climb only when controls and benefit are proven.