Paper Splits Agent Capability From Permission To Act

AI agents can do more than organizations should let them, argues a paper posted to arXiv (2607.23438). That gap matters for anyone deciding how much a deployed agent gets to act on its own. Capability and permission, the paper argues, are different questions with different answers.

The paper's core move is separating two things people usually treat as one. Autonomous Capability Level, or ACL, is what an agent is technically able to do. Allowed Autonomy Level, or AAL, is what it's actually authorized to do once risk, oversight, and accountability get factored in.

AAL runs on a five-step ladder: reactive execution, decision support, supervised action, goal-directed autonomy, and delegated operational authority. An agent can score high on ACL and still sit low on that ladder.

The paper demonstrates this with a deployed enterprise data-engineering agent that scored high on ACL. The authors still capped its allowed autonomy lower, citing how reversible its actions were and whether the organization was ready to supervise it. The paper doesn't say what tasks the agent handled or what specifically triggered that cap.

That's the practical split for anyone writing agent permission policy. Stop asking how capable the model is. Start asking whether a bad action can be reversed, and whether anyone's positioned to catch it first. The paper doesn't spell out a formula for that call, just the deployed example where reversibility and readiness won out over raw capability.