Autonomy levels explained: recommend, supervise, auto-run

Three levels cover almost every platform

Recommend only: the agent investigates and suggests an action; a human does it. Supervised: the agent prepares the action and a human approves with one click. Auto-run: the agent acts and the human reviews afterwards.

Vendors name these differently. Legion has Guided mode and Autonomous mode. Mate states three levels per action class: recommend only, supervised, auto-run. Prophet takes only actions the customer has approved and previews remediation first. Dropzone keeps final verdict authority with analysts.

Set autonomy per action, not per platform

A single switch for the whole platform is too coarse. Closing a known false-positive pattern and disabling a CFO's account are not the same decision. Ask whether the platform lets you set the level per action class, per asset group, and per time of day.

CrowdStrike lets analysts choose which actions run automatically and does not act on the environment by default. SentinelOne runs automated actions only within pre-approved policies, each logged. Microsoft's approvals vary by agent, and most investigation agents were in public preview at the pages' last update on 2026-05-06.

Reversibility should decide the level

An action that can be undone in seconds, such as revoking a session token, can move to auto-run sooner than one that cannot, such as deleting a mailbox item. Mate makes reversibility part of its CPR score, computed outside the agent's reasoning loop so the agent cannot argue itself past it.

For each action, write down how it is undone, who can undo it, and how long it takes. If the vendor cannot tell you, keep that action at recommend only.

The audit trail is part of the control

Every automated action needs a record: what triggered it, what evidence the agent used, what it did, and who approved. Microsoft logs agent actions in the Purview Unified Audit Log. CrowdStrike lists execution traces, audit logs and version rollback, and claims ISO/IEC 42001:2023 certification on its page.

Test the trail during a trial. Pick five actions and ask someone outside the SOC to reconstruct each one from the log alone.

Shadow mode comes before any level

Before the first recommendation reaches an analyst, run the agent in shadow mode on real alerts and compare its verdicts with your team's. Mate's platform page shows a first verdict at 09:00 in 'your first 24 hours' in shadow mode.

Move one action class at a time: shadow, recommend, supervise, auto-run. Hold each step for at least two weeks and read every rejection at the supervised step. Simbian says 95 percent of its proposed actions are approved by customers; your own rejection reasons are worth more than that figure.

Autonomy scores in this index reward documentation

Our autonomy controls criterion scores what vendors document about these controls. Mate, Torq, CrowdStrike, Legion and Prophet score 8. Exaforce scores 6 because autonomy is not documented in detail on the pages read, not because its controls are known to be weak.

Approval speed decides whether supervision is real

Supervised mode only works if approvals happen fast. An agent that prepares a containment action at 02:00 and waits until 09:00 for a click has not contained anything. Before you choose supervised for an action, decide who approves out of hours, through which channel, and what happens if nobody answers in 15 minutes.

Some platforms push approvals into chat tools. Mate lists Slack among its connected categories; Prophet names Slack, Teams and PagerDuty in its integration grid. Test the approval path during the trial with a real on-call engineer, at night.

Write an autonomy register

Keep one document that lists every action the platform can take, its current level, who approved that level, when, and the evidence behind the decision. Review it monthly. When an action moves from supervised to auto-run, the register should show the approval rate and rejection reasons that justified it.

Auditors will ask for exactly this. It also protects the team when an automated action goes wrong: the register shows the decision was deliberate and evidenced.

Managed services change who holds the switch

Several vendors sell a managed service on top of their agents: Prophet's Watchtower, 7AI's PLAID ELITE (2026-05-26), Exaforce's managed 24/7 SOC, Intezer's human experts on demand. When the vendor's staff operate the platform, ask who sets autonomy levels and who can change them. The answer should be you, in writing, with every change logged to your audit trail rather than the vendor's.

Preview status limits how far you can go

An agent in public preview can change behaviour between releases, and its controls may not be final. Microsoft's pages, last updated 2026-05-06, showed most Security Copilot investigation agents in public preview, including the Security Analyst Agent in Defender and Sentinel from April 2026. Keep preview agents at recommend only until they reach general availability and you have re-run your shadow comparison on the released version. Ask every vendor for the release status of each agent you plan to use, and for its change log.

Platforms discussed in this guide

• Mate Security, rank 1, 6.70
• CrowdStrike Charlotte AI, rank 4, 6.10
• Legion Security, rank 5, 5.95

Terms used

• Autonomy level
• Reversibility

More guides

• How to run a 30-day agentic defense proof of value
• Gamebooks versus playbooks: what changes when procedures become structured guidance
• Reading an AI SOC accuracy claim: sample, method, date