The Guardrail Reflex
When an agent does something alarming, the instinct is to add a guardrail. Another approval step. Another line in the prompt. Another human in the loop. Six months in, the agent is wrapped in so much oversight that it can barely act, and the team has quietly decided the whole thing was overhyped.
The guardrail reflex treats every agent as equally untrustworthy, forever. It never asks the question a manager asks about a new hire on week three: what has this thing actually done, and how did it go?
That question is the one worth building around. Not "how do we stop the agent," but "what has it earned the right to do."
Trust Is Earned the Same Way Everywhere
You don't hand a new support rep the authority to issue unlimited refunds on day one. You also don't make them ask permission for a five-dollar credit in month three. Authority tracks demonstrated competence. It starts small, it grows with a record, and it snaps back the moment something goes wrong.
That's not a soft management idea. It's a system you can build. The reason most teams don't is that measuring an agent's competence sounds expensive, so they fall back to the binary: lock it down or let it loose.
The unlock is that you're probably already generating the evidence. If your agent is traced, every action it takes is a record of what it did and whether it worked. The only missing pieces are a judge that reads those records and a permission layer that listens to the verdict.
That's the whole idea behind a build I shipped called Earned Autonomy: a support agent whose permissions move on measured competence instead of a config flag. It's the running example through the rest of this, but the pattern isn't specific to support, and it isn't specific to any one model.
Autonomy as a Dial, Not a Switch
Most agent setups treat permission as a switch. The tool is allowed or it isn't. A track record needs more positions than that, so the dial has four:
- Blocked. The tool refuses and the agent escalates to a human.
- Propose. The tool writes a proposal a human reviews in full before anything runs.
- Confirm. The tool writes a proposal a human approves with one click.
- Autonomous. The tool executes immediately, and the action is logged.
Each action type sits at one position. Refunds might be at Confirm. Cancellations, which are hard to walk back, might start Blocked and stay there until they've earned otherwise. The dial only turns on evidence, and it turns in both directions.
What a Track Record Looks Like in Practice
Every action type carries a live scorecard: its current position on the dial, its recent pass-rate from the evals, the number of samples behind that rate, and the trace IDs that justify it.
So refunds might be running at a 94% pass-rate over the last fourteen graded samples, sitting one clean day away from full autonomy. Plan changes might have just dropped a tier after a single bad call last night. Cancellations might still be blocked because they've never cleared the bar.
A leader can look at that ledger and answer the question that actually matters. Not "is the agent safe" in the abstract, but "which specific things has it earned the right to do, and what's the evidence." That's a conversation you can have with a risk team or an auditor. "We added more approvals" is not.
The asymmetry matters too. Promotions up the dial need a human signature. Demotions apply instantly, the moment an eval fails, no approval required. Trust should be slow to gain and fast to lose. Waiting for someone to rubber-stamp a downgrade after the agent already failed is exactly the wrong place to add a delay.
The Questions a Track Record Answers That a Guardrail Can't
A pile of guardrails can tell you what the agent is prevented from doing. It can't tell you whether the agent is any good. A track record answers the questions that actually come up when something goes wrong.
Which actions has the agent earned, and on what evidence? The ledger names the tier and the pass-rate behind it, so "why is the agent allowed to do this" has a real answer.
When did its competence last change, and why? Every move on the dial carries a timestamp and the failing or passing traces that caused it, so a regression isn't a mystery you reconstruct from logs.
What happens the next time it fails the same way? In Earned Autonomy, each failed eval gets written back as a permanent regression test, so a mistake costs a tier and then has to be passed again before that tier comes back.
None of those questions have answers in a system whose entire safety story is "a human checks everything." The human checking everything stopped reading in week two.
Oversight Is a Budget, Not a Virtue
More oversight feels safer, but attention is finite. A human asked to approve three hundred routine actions a day stops reading by the second week, and the one approval that mattered gets the same reflex click as the other two hundred ninety-nine. (The full version of that argument is in every approval prompt was making you a worse operator.)
A track record spends that budget well. It lets the routine, in-policy, reversible work run at the position the agent has earned, and it saves the human moment for the actions that are genuinely irreversible or genuinely new. Same number of decisions that actually need a person. A fraction of the noise around them.
This is the same instinct behind keeping a lightweight CLAUDE.md or AGENTS.md: write the boundary down once, in a place the system reads on every call, and stop relitigating it action by action. Encode the rule, then let the evidence move it.
Start With One Action Type
The mistake is treating this as an all-or-nothing platform decision. You don't need to grade every action your agent can take. You need to pick the one that's currently stuck.
Find the action your agent is doing today that a human is rubber-stamping without really reading. Write a judge for it: did it resolve the request, did it use the right tool with the right arguments, did it respect the policy. Run that judge against the traces you already have. Now you have a pass-rate, and a pass-rate is the start of a track record.
Set a threshold. Let the action run autonomously when it clears the bar over enough samples, and drop it the instant it fails one. That's one action type earning its way off your plate, with the evidence to defend the decision. Then do the next one.
The teams that get real value out of agents in 2026 won't be the ones with the most guardrails. They'll be the ones who figured out how to let an agent earn its way out of needing them.