---
title: "Governing agent autonomy with Auto-review"
description: "Auto-review governs local agent autonomy as a continuum, allowing routine work to proceed while reviewing actions whose consequences depend on context, user intent, and security stakes. A small classifier agent runs before tool calls in the same RPC stream as the parent agent, and can inspect workspace contents with ReadFile, Grep, Glob, and ListDir when a command alone is insufficient. Its blocks return explanations rather than automatically prompting users, enabling the parent agent to narrow or replace a risky action. Evaluation used 6,122 deduplicated labeled rows from internal developer sessions plus synthetic high-consequence cases, and tested tool use, overrides, parse failures, and behavioral flapping. Early results show the classifier blocks around 4% of reviewed actions, while about 7% of Auto-review chats experience at least one interruption."
---

# Governing agent autonomy with Auto-review

[Cursor](https://yomu.fyi/company/cursor) · David Gomes & Travis McPeak · Jun 11, 2026

**Type:** Announcement

## Summary

Auto-review governs local agent autonomy as a continuum, allowing routine work to proceed while reviewing actions whose consequences depend on context, user intent, and security stakes. A small classifier agent runs before tool calls in the same RPC stream as the parent agent, and can inspect workspace contents with ReadFile, Grep, Glob, and ListDir when a command alone is insufficient. Its blocks return explanations rather than automatically prompting users, enabling the parent agent to narrow or replace a risky action. Evaluation used 6,122 deduplicated labeled rows from internal developer sessions plus synthetic high-consequence cases, and tested tool use, overrides, parse failures, and behavioral flapping. Early results show the classifier blocks around 4% of reviewed actions, while about 7% of Auto-review chats experience at least one interruption.

## Context

Greater agent autonomy can create security risks when local agents access files, credentials, environment variables, MCP tools, or production systems. Frequent permission prompts can also reduce safety because users may stop reading them carefully.

## Approach / What changed

Auto-review uses a contextual classifier agent before tool calls. The classifier evaluates consequence, intent, and security stakes; it can inspect the workspace, runs in the parent agent's RPC stream, and returns explanations on blocks so the parent agent can choose a safer path without immediately interrupting the user.

## Takeaways

- The classifier is designed to be a small, sufficiently reasoning-capable model; lower-reasoning models were not always faster because struggling with policy or tool calls could consume more time and tokens.
- Evaluation combined 6,122 deduplicated labeled rows from roughly 12 hours of internal developer sessions with synthetic cases involving secrets, production data, untrusted instructions, and large side effects.
- The classifier currently blocks around 4% of reviewed actions, while about 7% of total chats in Auto-review mode produce at least one user interruption; many blocked actions are resolved by the parent agent.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [AI Security](https://yomu.fyi/topic/ai-security)

- Source: [Cursor](https://cursor.com/blog/agent-autonomy-auto-review)
- Source URL: https://cursor.com/blog/agent-autonomy-auto-review
- Ingested by Yomu: 2026-09-02T11:42:26.605Z

[Read original post](https://cursor.com/blog/agent-autonomy-auto-review)