# Closing the AI agent trust gap with graduated autonomy

[AWS](https://yomu.fyi/company/aws) · Dev Arora · Aug 26, 2026

**Type:** Problem & solution

## Summary

Operating AI agents under binary full-access or read-only permissions creates an operational trust gap due to unpredictable model behavior across updates. The graduated autonomy architectural pattern closes this gap by dynamically granting or revoking tool permissions through sustained reliability scoring. A scoring engine computes a composite score across five weighted dimensions over a rolling 50-action window, mapping agents across four tiers from probation to full autonomy. In-process pre-execution filters check for prompt injection and sensitive targets, while Amazon Bedrock AgentCore Gateway and Cedar policies strictly enforce deny-by-default access at the infrastructure level. Post-execution state capture in Amazon DynamoDB supports reversibility, and AWS CodePipeline delivery gates block releases failing adversarial evaluation benchmarks.

## Context

AI agents often receive binary access choices—either full access or read-only—because their behavior can turn unpredictable after model updates or prompt changes. Raw API logs lack safety context, decision provenance, and pre-action state capture, preventing operators from safely granting higher-level tool permissions to agents.

## Approach / What changed

The graduated autonomy pattern establishes six architectural layers to adjust agent permissions based on continuous reliability scoring across five dimensions. Agents start at probation tier T1 and promote slowly across a 50-action rolling window while demoting immediately upon safety violations. Bedrock AgentCore Gateway evaluates Cedar policies outside the agent process, DynamoDB stores trust state and audit trails, and AWS CodePipeline blocks releases if any adversarial test triggers an unauthorized tool call.

## Takeaways

- Agent trust is scored from 0 to 100 across accuracy, safety, consistency, compliance, and efficiency over a 50-action rolling window, with safety serving as an independent floor that cannot be masked by other metrics.
- Tier transitions use hysteresis to prevent oscillation: promotion requires staying above the tier floor plus 5 points for the entire rolling window, whereas demotions happen immediately upon safety drops or injection detections.
- Enforcement operates outside the agent process using Amazon Bedrock AgentCore Gateway and Cedar policies with forbid-wins semantics, while CodePipeline gates block deployments if a candidate fails any adversarial fixture.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [AWS](https://yomu.fyi/topic/aws), [CI/CD](https://yomu.fyi/topic/ci-cd), [LLMs](https://yomu.fyi/topic/llm), [Reliability](https://yomu.fyi/topic/reliability)

[Read original post](https://aws.amazon.com/blogs/architecture/closing-the-ai-agent-trust-gap-with-graduated-autonomy)