Closing the AI agent trust gap with graduated autonomy

Summary

Operating AI agents under binary full-access or read-only permissions creates an operational trust gap due to unpredictable model behavior across updates. The graduated autonomy architectural pattern closes this gap by dynamically granting or revoking tool permissions through sustained reliability scoring. A scoring engine computes a composite score across five weighted dimensions over a rolling 50-action window, mapping agents across four tiers from probation to full autonomy. In-process pre-execution filters check for prompt injection and sensitive targets, while Amazon Bedrock AgentCore Gateway and Cedar policies strictly enforce deny-by-default access at the infrastructure level. Post-execution state capture in Amazon DynamoDB supports reversibility, and AWS CodePipeline delivery gates block releases failing adversarial evaluation benchmarks.

Takeaways

1. 1

   Agent trust is scored from 0 to 100 across accuracy, safety, consistency, compliance, and efficiency over a 50-action rolling window, with safety serving as an independent floor that cannot be masked by other metrics.

2. 2

   Tier transitions use hysteresis to prevent oscillation: promotion requires staying above the tier floor plus 5 points for the entire rolling window, whereas demotions happen immediately upon safety drops or injection detections.

3. 3

   Enforcement operates outside the agent process using Amazon Bedrock AgentCore Gateway and Cedar policies with forbid-wins semantics, while CodePipeline gates block deployments if a candidate fails any adversarial fixture.