I do not grant an agent autonomy because the model looks intelligent.
I grant it because the mistake is reviewable and reversible.
The same model can safely reformat a document and dangerously modify production access. Those actions should never inherit the same autonomy level merely because the benchmark score is identical.
I start with three questions: can someone verify the result, can we undo it completely, and what else can execute before the error is noticed? That produces a practical ladder — from assistance, to approval-gated execution, to narrow delegation — not a binary switch called "agentic."
The hard part is that reversibility lies. An action that looks locally undoable can still have triggered a downstream system, an external message, a cached decision, or a commitment someone else already acted on.
Intelligence describes the worker. Reversibility determines the permission.