Concepts / Autonomy levels
Autonomy levels
How much the optimizer may do without asking, set per flow with a ceiling on the account. The default for flows you wrote is L1. Autopilot runs its own flows at L3, and this page is the honest account of what that does and does not mean.
| Level | The system | You |
|---|---|---|
| L0 | Drafts a change. | You edit it and publish it. |
| L1 | Finds the opportunity, proposes a hypothesis, validates that the patch is legal against your policy. | You approve the experiment and start it. |
| L2 | Sets up and starts the experiment itself, allocates traffic adaptively, rolls back on a guardrail breach. | You approve the promotion of a winner. |
| L3 | Promotes the winner too, and opens the next experiment. | You set the guardrails and read the weekly memo. |
L2 and L3 are opt-in. L3 additionally requires a per-flow grant that you can revoke at any time, and automatic rollback is mandatory at that level — it is not a checkbox you can clear.
Why autopilot is L3
Because the decision behind autopilot was that after one approval, production, experiments, promotion and new flows all proceed without asking — and L2 stops at promotion. Running autopilot at L2 would mean an approval queue, which is a different product. So autopilot takes the L3 grant explicitly, shows it on the approval screen next to automatic rollback, and records it like any other grant.
What L3 does not mean
It does not mean the optimizer may do anything to a flow. On flows autopilot wrote, it starts able to change copy and nothing else — the text on a screen, not its structure. Rearranging a flow, adding steps or changing what a screen does is not in the initial policy.
That narrowness is the point. The system is allowed to improve the words on a screen it authored before it is allowed to redesign it, and widening that policy is a decision that should arrive with evidence rather than as the default that happened to ship.
The ramp
A newly published autopilot flow goes live at 10% of eligible users, then 50%, then 100%, with a day between steps. A bad flow therefore has one day of limited reach before anything widens, and guardrails are watching throughout. Both numbers are starting points chosen by argument rather than fitted to data, and they are stated as such in the product.
Changing it
Autonomy is set per flow, under the app's optimizer settings, with a ceiling for the whole account. Lowering the ceiling takes effect immediately and does not interrupt anything already serving — see Optimizer & growth memo.