Two dimensions: impact and reversibility
Actions that are low impact and easy to reverse, such as drafting a summary, are good candidates for autonomy. Actions that are high impact or irreversible, such as moving money, should require approval.
Plotting candidate actions on these two axes gives a simple permission model that can be explained to risk teams.
Enforce rules in code
Instructions given to a model in natural language are guidance, not guarantees. Hard limits, such as maximum amounts, allowed systems and required approvals, should be enforced by the surrounding software.
Trace everything
A complete trace of observations, decisions and tool calls is necessary for debugging, for audit and for building the trust that justifies more autonomy later.