autonomy

In depth

The three axes

Autonomy is read along three axes that are worth keeping apart. The first is the extent of the permitted actions, because reading, writing, sending and paying are not delegated at the same price. The second is the trigger: acting on request, acting when an event occurs, or acting on its own initiative. The third is reversibility, and it is the most decisive, since an action that can be undone bears a latitude that a final action does not allow. A well set system is often very free on the first axis and very constrained on the third.

Risk by risk

The slider is therefore set risk by risk, and not system by system. The useful question is never “do we trust this system” but “what happens if this particular action turns out to be wrong, and how much does the repair cost”. An action that is reversible, inexpensive and detectable can be widely delegated, even if it has to be corrected afterwards. An action that is irreversible, costly or invisible calls for human agreement before execution, whatever the quality observed up to that point. Putting that reasoning into practice is what is called human in the loop.

The traps

The first trap is autonomy by default: a system obtains a permission because it was simpler to give it than to restrict it, without anyone having decided so. The second is autonomy that drifts, when the approvals become tiresome, are removed one by one and the scope widens without any decision being recorded. The third is the confusion with performance, because a more accurate system does not thereby become more entitled to decide alone: accuracy is a measure, delegation is a choice. Setting the slider seriously therefore assumes three things: an explicit list of the permitted actions, traces that make the exercise verifiable, and a periodic review.