Autonomy Levels and Safe Mode

The four levels

Off hides the feature. No assessment, no execution. The agent is a conversational participant only.

Assess shows whether Kavanah COULD do a task, with its reasoning, but never acts. This is a genuinely useful setting for a sceptical team, because it produces evidence — you can watch what it would have done for a fortnight with no risk at all.

Safe lets the agent complete tasks autonomously using internal, non-destructive actions only. It creates and updates tasks, writes comments, prepares drafts. It will never send email, post externally, or delete anything.

Full lets it use any tool the task needs — but each risky action follows your action policies, which by default means it is parked for explicit per-action approval before it executes.

The important thing to notice is that Full is not 'no oversight'. Full plus the default policy means the agent can attempt anything and you approve the consequential parts.

What safe mode actually does

This is worth being precise about, because it changes how the agent behaves rather than just what it is allowed to do.

At safe, risky tools are REMOVED from the agent's toolset entirely. It is not offered the ability to send email and instructed not to use it — it does not have it.

That matters for two reasons. It is a much stronger guarantee than an instruction, because there is no phrasing that talks a model into using a tool it does not possess. And it means the agent's own account of its capabilities is accurate at that level: when it says it cannot send that email, it is describing its toolset rather than declining.

The same stripping applies to features nobody has opted into. A workspace that has not enabled the remote browser has an agent with no browser tools, which is why the experience is byte-identical to one where the feature does not exist.

The two-sided ceiling

There are two settings, not one.

An admin sets the WORKSPACE ceiling — the highest level anyone in the workspace may reach.

Each person sets their own opt-in level for themselves.

Your effective level is the LOWER of the two. So a workspace ceiling of Safe means nobody runs at Full regardless of their personal setting; and a personal setting of Assess means you run at Assess even in a workspace whose ceiling is Full.

This is the right shape because the two decisions are genuinely different. The ceiling is a risk decision about the organization. The opt-in is a comfort decision about one person's work. Neither should be able to override the other in the wrong direction.

A widening path

Four steps, each with an exit criterion, rather than a leap of faith.

Start the workspace ceiling at Safe. Live there for at least a fortnight. Read what it did — the ledger, the task activity — rather than asking people how it felt.

When you can look at two weeks of safe-mode actions and find nothing you would have wanted to stop, raise the ceiling to Full and leave the action policies at their default, which parks the risky categories for approval. You have now widened what it can attempt without widening what happens without you.

Work the approval queue for a few weeks. That queue is data: the actions you approve without hesitation, every time, in the same category, are candidates for a looser policy.

Only then, and only per category, move a policy from approve to a budgeted allowance or an outright allow. Never do this in bulk. The next lesson is entirely about that decision.

Where to set it

Both settings live under Settings → AI Agent. The workspace ceiling is admin-only; the personal opt-in is yours.

One piece of advice for admins: tell your team when you change the ceiling. A ceiling change silently alters what everyone's agent will do, and someone discovering that by surprise is a bad first experience of a feature you want adopted.