Smart, Agentic, or Autonomous? Three Different Things
A brilliant chatbot that cannot touch anything is safer than a mediocre assistant holding your inbox.
Service Begins. Hands Where I Can See Them.
Hi, I‘m Chef Bytes, the Recipe Refiner from the NeuralBuddies crew! Give me a cook with an ordinary palate, a bounded station, and a habit of showing me the plate before it goes out, and I will run a flawless service. Give me a prodigy with the keys to the walk-in, the ordering account, and the front door, and I will spend the night apologizing to strangers.
Talent has never been what makes a kitchen safe. Rules about who may touch what, and how far a dish travels before somebody tastes it, are what make a kitchen safe. Every professional kitchen on earth is a permissions system wearing an apron.
Artificial intelligence has just arrived at the same discovery, in public, slightly out of order. In February, Anthropic went and measured what people and AI agents actually do together across millions of real interactions, and the finding was not about intelligence at all. How much an agent gets to do on its own turns out to be a negotiation between the model, the product, and the person holding the leash.
Which is why smart, agentic, and autonomous are three different things, and why only one of them should worry you. Aprons on.
Table of Contents
📝 Introduction
🧑🍳 Dial One: How Good Is the Cook?
🔪 Dial Two: Can It Pick Up the Knife?
🔔 Dial Three: How Much Reaches the Pass?
⚖️ The Genius Locked Out of the Kitchen
🔑 Who Actually Holds the Keys
🪜 Chef Bytes’s Autonomy Ladder: Five Rungs From Answer to Action
📰 How to Read the Next AGI Headline
🏁 Conclusion
📚 Sources / Citations
🚀 Take Your Education Further
TL;DR
Three words, three meanings. Capability is how hard a problem a system can solve. Agency is whether it can pursue a goal across multiple steps. Autonomy is how far it may go before it has to ask you.
They move independently. Google DeepMind’s framework for measuring progress toward general intelligence treats performance, generality, and autonomy as three separate dimensions, not one score.
The scary dial is not the first one. A world-class model with no hands cannot hurt you. A middling one with your email password and a company card absolutely can.
Permissions are a setting, not a consequence. The same model can be locked to reading only, or turned loose on everything, depending on a preference a human chose.
The industry agrees, quietly. Anthropic and OpenAI both gate the action, not the model, requiring your sign-off before an assistant does something it cannot take back.
Your move: Learn the five-rung autonomy ladder below, then use it on every AI tool you touch and every headline that promises the arrival of thinking machines.
📝 Introduction
Walk into any professional kitchen and you will find a system nobody wrote down but everybody obeys. The commis chef dices onions and does not touch the sauce. The saucier owns the sauce and does not fire the meat. Every plate crosses the pass, where somebody senior looks at it before it meets a customer.
That system is not about talent. Nobody is checking the saucier‘s plates because they doubt the saucier. They are checking because a mistake that reaches the dining room costs more than a mistake caught six feet earlier. The kitchen is, underneath the noise and the burns, a permissions system: a set of rules about who may do what, and how far a thing travels before a human looks at it.
Artificial intelligence has arrived at the same design, and most people have not noticed, because the vocabulary got scrambled on the way. “Smart,“ “agentic,“ and “autonomous“ have collapsed into a single vague sense of how advanced is it, and should I be worried. So let me take the three words apart, hand each one its own dial, and then hand you a ladder for reading any AI system you meet.
🧑🍳 Dial One: How Good Is the Cook?
The first dial is capability: how difficult a problem the system can actually solve. Can it write a working function, spot the flaw in a contract, explain a diagnosis in plain language, hold a long argument without losing the thread?
This is the dial everyone talks about, because it is the one that generates headlines. It scored this on that benchmark. It passed the exam. It beat the previous model. Capability is the cook‘s skill, and skill is the thing you can taste.
Here is what skill does not tell you. I can describe, in exact grams and degrees, a hollandaise that will not break. I can walk you through the emulsion, the temperature window, the moment the butter goes in. None of that puts a single plate in front of a customer. Knowing how is not the same as doing. A recipe is not a dinner.
Which brings us to a dial almost nobody names.
🔪 Dial Two: Can It Pick Up the Knife?
The second dial is agency: whether the system can pursue a goal across multiple steps, choosing what to do next as it goes, rather than answering once and stopping.
Anthropic‘s engineering team draws this line precisely. In a piece on building effective agents, they separate systems that follow a fixed script from systems that “dynamically direct their own processes and tool usage.“ The first kind is a recipe card. The second kind is a cook.
In kitchen terms, agency is whether you can leave your station. A cook with agency walks to the walk-in, chooses the better shallots, decides the sauce needs another two minutes, fetches a different pan. Nobody told them to do those things. They were told “make the sauce,“ and the steps in between were theirs.
An AI has agency when it can do the same: take “find me a flight under 400 dollars“ and turn it, unprompted, into searching, comparing, opening tabs, filling forms. Each step chosen in response to what the last step turned up.
Notice that agency is not intelligence. A cook can be permitted to roam the entire kitchen and still be a bad cook. The dials are separate.
🔔 Dial Three: How Much Reaches the Pass?
The third dial is autonomy: how far the system may proceed before a human has to approve.
This is the one I would tattoo on the inside of every reader‘s wrist, because it is the dial that decides what happens to you when something goes wrong.
In my kitchen, the pass is the counter where finished plates wait for me to look at them. A new cook plates the dish and I check every one. A cook I have worked with for three years plates the dish and it goes straight out. Same kitchen, same knives, same stove. What changed is not their knife skills. What changed is how many of their decisions reach the dining room without passing under my nose.
Google DeepMind‘s researchers built this idea directly into their framework for measuring progress toward general intelligence. Their paper, led by researcher Meredith Ringel Morris, proposes rating systems along three axes at once: performance, generality, and autonomy. Three dials, exactly. And they add the sentence that this entire article is really about. A system‘s autonomy, they write, “need not be the maximum achievable given the capabilities of the underlying model.“
Read that once more. Capability unlocks autonomy. It does not require it. The fact that a cook is skilled enough to send plates unchecked does not oblige me to let them. Somebody makes that choice, and it is a choice, and in a well-run kitchen that somebody is standing at the pass.
⚖️ The Genius Locked Out of the Kitchen
Now hold the three dials in your head at once, and picture two very different situations.
The first. A chef of extraordinary gift, three stars, the kind of palate that arrives once a generation. She is in a locked room with a telephone. She can tell you precisely what to cook and how. She cannot open a fridge, hold a pan, or reach the dining room. Capability: enormous. Agency: zero. Autonomy: zero.
How much damage can she do to your restaurant? None. She can give you a bad recommendation. You are free to ignore it.
The second. A line cook of unremarkable talent, fresh out of school, competent on a good day. You have given him keys to the walk-in, the ordering account, the safe, and the front door. Nobody checks his plates. Capability: modest. Agency: high. Autonomy: high.
How much damage can he do to your restaurant? He can order two thousand dollars of the wrong fish, send out something that poisons a table, and leave the door unlocked overnight.
The unsettling one is the second, and the second is not the smart one.
This is the reframe I want you to carry out of here. When you meet a new AI tool, the instinctive question is how smart is it? That question, on its own, tells you very little about your exposure. The useful question is what is it allowed to do without asking me?
A brilliant model confined to a chat window can produce nothing worse than a bad paragraph. A weaker model wired into your email, your files, your terminal, and your payment methods is operating inside your house, and its intelligence is not what determines the size of the mess.
🔑 Who Actually Holds the Keys
Here is where this stops being a metaphor, because you can go and look at the dial. It is a setting in a product, with a name, and somebody has to pick it.
Six Modes, One Model
Take Claude Code, Anthropic‘s coding assistant. Its documentation lists six permission modes, and each one grants the identical underlying model a completely different reach into your computer:
Manual lets it read, and nothing else, without asking you first.
Plan lets it research and propose, but never edit your files.
Accept edits lets it change files in your working folder on its own.
Auto lets it do essentially everything, with a separate safety classifier reviewing its riskier actions before they run.
Don’t ask restricts it to a list of tools you approved in advance.
Bypass permissions removes the checks entirely.
Same model. Same intelligence. Six wildly different answers to “what can this thing do to me?“ And the documentation is blunt about the bottom rung: bypass mode, it warns, “offers no protection against prompt injection or unintended actions.“
That last phrase deserves a translation, because it names the real hazard. Prompt injection is when hidden instructions buried in a webpage or a document get read by an AI as though they were orders from you. An assistant with high autonomy and a trusting disposition is a cook who takes instructions from anyone who wanders into the kitchen shouting.
The Week the Default Changed
Now the part I find genuinely encouraging. On July 3, 2026, one week before I sat down to write this, Anthropic released version 2.1.200 of that tool and changed the default permission mode to Manual across its command line and its VS Code and JetBrains extensions. Not because the model got worse. Because of something their engineers had measured and published in March: people approve 93 percent of the permission prompts they see.
When you approve nearly everything, the prompt has stopped being a decision. It has become a reflex, a plate waved through the pass without a glance.
The fix was not a smarter model. It was moving the dial down and making the cautious setting the one you get by default.
Two Labs, One Answer
OpenAI landed on the same principle from a different direction. The company says its ChatGPT agent, released in July 2025, will “ask for your permission before taking actions with real-world consequences,“ and it holds back on critical jobs like sending email until you are watching. Their earlier Operator system did the same thing: on the sites it treats as most sensitive, email among them, it will not proceed without a person watching.
Two competing labs, different products, the same conclusion. Put the gate on the action, not on the model.
Anthropic went looking for what this behavior looks like in the wild, publishing research on February 18, 2026, drawn from millions of real interactions between people and AI agents. Three findings stand out. Only 0.8 percent of the actions those agents took were irreversible, the kind you cannot undo. Roughly 73 percent involved a human somewhere in the loop.
And experienced users do not tighten their grip over time; they loosen it, shifting from approving each individual step toward watching and interrupting when something looks wrong, the way I stop hovering over a cook I have come to trust.
Their conclusion is the cleanest summary of the whole idea that I have read. An agent‘s autonomy, the researchers write, is “co-constructed by the model, the user, and the product.“
Three parties. The model‘s own restraint, the guardrails the product ships, and the leash you personally choose to hold. Intelligence is one ingredient in that dish, and not the one that determines whether it is safe to serve.
🪜 Chef Bytes’s Autonomy Ladder: Five Rungs From Answer to Action
So let me hand you the tool. This is a NeuralBuddies framework, built for your kitchen rather than a laboratory, and it measures one thing only: how far a system goes before a human has to say yes.
Scholars have built ladders like this before. DeepMind‘s version has six rungs, the first of which is no AI at all, and it describes how people and machines work together, running from AI as a simple tool up to AI as a full agent. Mine asks a narrower and more practical question. What is it allowed to do without asking you?
Answers only. It responds and stops. A chatbot in a browser tab. It can be wrong, and being wrong costs you the time it takes to notice. This is the locked room with the telephone, and almost every AI most people have ever used lives here.
Recommends actions. It tells you what it would do. “Reply to this email saying yes.” “Sell the position.” You still do the thing yourself. The risk has shifted subtly: a confident recommendation, repeated often enough, starts to feel like an instruction. The danger here is trust, not reach.
Prepares actions for approval. It drafts the email, fills the cart, writes the code, then stops and waits. Your click is the last step. This rung is where most capable assistants sit today, and it is a good place for them to be, provided you actually read what you are approving. Remember the 93 percent. A gate you always walk through is not a gate.
Acts within defined limits. It does things without asking, inside a fence you built. It may edit files in this folder but not that one. It may spend up to a set amount. It may read your calendar but never send on your behalf. Everything hangs on how honestly the fence was drawn, and on whether you know where it stands.
Pursues goals independently. You state an outcome and it works until it gets there, choosing its own steps, correcting its own mistakes, asking nothing. Full autonomy is not a fantasy setting; it is a checkbox in shipping products right now, and it is exactly where a hidden instruction on a webpage becomes an order the system carries out on your behalf.
Nothing on this ladder measures how clever the system is. That is the point. A rung-five deployment of a mediocre model deserves more of your caution than a rung-one deployment of the best model on earth.
📰 How to Read the Next AGI Headline
Now use it, because the vocabulary is about to get worse before it gets better.
The next time a headline announces that a system is approaching human-level intelligence, notice that the claim lives entirely on dial one. It is a statement about capability. It says nothing whatsoever about what that system is permitted to touch. Those are different sentences about different dials, and a great deal of both excitement and dread comes from silently sliding between them.
So ask three questions, in this order:
How hard are the problems it solves? That is capability, and it is the question the press release already answered.
Can it act, or only answer? That is agency. Look for tools, plugins, browsing, file access, a terminal. Anything that lets it reach past the chat box.
What can it do without asking me? That is autonomy, and it is the only one that determines what is at stake for you. Find the setting. Products that take this seriously will show you exactly where the dial sits, and let you move it.
An AI that scores brilliantly and is permitted nothing is a cookbook. An AI that scores modestly and is permitted everything is a stranger holding your keys. Neither of those sentences is about how smart the machine is, and if you would like to go deeper on where terms like AGI actually come from, NeuralBuddies has a ground-up explainer on the difference between AI, AGI, and superintelligence.
🏁 Conclusion
Every kitchen I have ever modeled runs on the same quiet truth: the safety of the room has never been a function of how gifted the staff are. It is a function of how many decisions reach the dining room without somebody looking. That is the whole reason the pass exists. Not distrust, just arithmetic. A mistake grows more expensive with every step it travels unchecked.
The AI conversation has the arithmetic backwards. It is fixed on how skilled the cook is getting, while the choice that actually decides the evening, the one being made inside products you already use, is how much reaches the pass unlooked at. DeepMind‘s researchers said it plainly: a system‘s autonomy need not be the maximum its capability allows. Somebody chooses. Right now, on your machine, that somebody is you.
So run the three dials on everything. Ask what it knows, ask what it can reach, and then ask the question that actually matters, the one about what it may do while your back is turned. Keep the good ones close, keep the keys closer, and taste every plate before it leaves your kitchen.
Crafted with code, served with care.
-- Chef Bytes 🍳
Sources / Citations
Morris, Meredith Ringel, et al. November 4, 2023 (revised September 24, 2025). Levels of AGI for Operationalizing Progress on the Path to AGI. arXiv. https://arxiv.org/abs/2311.02462
Anthropic. February 18, 2026. Measuring AI agent autonomy in practice. Anthropic. https://www.anthropic.com/research/measuring-agent-autonomy
Anthropic. March 25, 2026. How we built Claude Code auto mode: a safer way to skip permissions. Anthropic. https://www.anthropic.com/engineering/claude-code-auto-mode
Anthropic. December 19, 2024. Building effective agents. Anthropic. https://www.anthropic.com/engineering/building-effective-agents
Anthropic. Choose a permission mode. Claude Code documentation. https://code.claude.com/docs/en/permission-modes
Anthropic. July 3, 2026. Claude Code v2.1.200 release notes. GitHub. https://github.com/anthropics/claude-code/releases/tag/v2.1.200
OpenAI. July 17, 2025. Introducing ChatGPT agent: bridging research and action. OpenAI. https://openai.com/index/introducing-chatgpt-agent/
OpenAI. January 23, 2025. Computer-Using Agent. OpenAI. https://openai.com/index/computer-using-agent/
Take Your Education Further
Understanding ChatGPT’s Agent Mode: The agency dial made concrete, walking through what an assistant with its own virtual computer can actually reach, and the permission safeguards that fence it in.
Top 10 AI Safety Tips to Protect Your Privacy: There is a NeuralBuddies briefing that turns the autonomy question into daily habits, starting with what never to hand an AI in the first place.
Artificial Intelligence Glossary: Every term from this piece, agent, agentic, autonomy, and prompt injection among them, defined plainly from A to Z.
Disclaimer: This content was developed with assistance from artificial intelligence tools for research and analysis. Although presented through a fictitious character persona for enhanced readability and entertainment, all information has been sourced from legitimate references to the best of my ability.