An agent's level of autonomy is a design decision, not a property of the model. Business Profile Agent uses three gears: Standby (drafts only on request), Drafting (the agent drafts, a person approves) and Autopilot (the agent publishes above a confidence threshold the client sets, with explicit consent). Published guidance from OpenAI, Anthropic and Google agrees that sensitive or irreversible actions should require human confirmation until reliability is proven, and that every action must be observable and reversible.
Gartner's June 2025 forecast is the one everybody quotes: "over 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value or inadequate risk controls." The same note predicts that "at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from 0% in 2024". Both are probably right, and together they describe the job: the decisions will move, and the projects that move them without controls will be the ones that get cancelled.
A Google Business Profile is a good place to think about this concretely, because the actions are small, public and numerous. A reply to a review is published under the customer's name for anyone to read. A changed opening hour tells Gemini what to say. A bulk edit touches two hundred profiles in a minute. None of it is dangerous the way a payment is. All of it is visible.
The three gears
| Gear | Who drafts | Who publishes | Use it when |
|---|---|---|---|
| 1 · Standby | The agent, only when asked | A person, every time | Onboarding, a new brand voice, a sensitive market. Nothing happens on its own. |
| 2 · Drafting | The agent, for every new review, question and detected change | A person, one approval per item | The default. Drafts arrive within minutes; a regional manager approves a batch each morning. |
| 3 · Autopilot | The agent | The agent, above the confidence threshold; a person, below it | Actions the client has approved for automation, after Drafting has shown the drafts go out unedited. Requires a recorded opt-in per client. |
Two things are true in every gear. The Policy Guard can stop any action — a review naming an employee, a legal threat, a health or safety claim — and hand it to a person, whatever the gear says. And every action is reversible: a snapshot of the published state is taken before each patch, and a reply can be edited or removed with the same click that published it.
What the published guidance says
The people who build the models have written down where they think the human belongs, and they agree more than the marketing suggests. OpenAI's guide to building agents: "Actions that are sensitive, irreversible, or have high stakes should trigger human oversight until confidence in the agent's reliability grows." Anthropic: agents "can pause for human feedback at checkpoints or when encountering blockers", and users should be able to "grant persistent permissions for routine tasks they trust" the agent with. Google's secure-agent principles are three sentences: agents "must have well-defined human controllers", their "powers must have limitations", and their "actions and planning must be observable".
The regulator's version
The EU AI Act's Article 14 applies to high-risk systems, which a review-reply tool is not. Its wording is still the best design bar we have found: the overseer must be able "to decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output" and "to intervene in the operation … or interrupt the system through a 'stop' button or a similar procedure". We built the stop button first and the gears second.
The confidence threshold, and why a second model checks it
In gear 3 the agent attaches a confidence score to every output — how sure it is that the draft states only facts from the record, in the right language, in the brand's tone, with nothing the no-go list forbids. The client sets the threshold; the default is 80%. Above it the agent publishes and logs. Below it the draft waits for a person, with the reason it scored low.
The score is not the drafting model grading its own homework. A 2024 study found that LLM evaluators "score their own outputs higher than others' while human annotators consider them of equal quality", and an earlier one that models "struggle to self-correct their responses without external feedback". So the proof-reading agent runs on a different model from the drafting agent and checks four things: language, terminology, promises, and whether every fact in the draft exists in the profile. A wrong-language reply — the classic failure on a two-line review — is caught here, not by the customer.
Standby · Drafting · Autopilot, per client, per action type.
Below it, Autopilot holds the draft for approval.
Policy Guard can halt any action in any gear.
Moving up a gear without regretting it
Start in Drafting
OpenAI's advice — "start small, validate with real users, and grow capabilities over time" — is also the cheapest. Every draft goes through a person; every edit a person makes is recorded as feedback.
Read the approval rate
The logbook shows, per agent and per location, how many drafts went out unchanged. Four- and five-star review replies typically pass first; hours corrections next; replies to complaints last.
Enable Autopilot per action type
Not "the Review Agent is autonomous" but "positive-review replies above 80% publish on their own; everything else drafts". The consent is recorded; the gear shows on every log line.
Let the threshold do the work
Raise it when a flag comes in, lower it when a month passes clean. The gear does not need to change again; the threshold does.
What the gain actually is
The best evidence on assisted text work in customer service is a 2023 study of 5,179 support agents: a generative-AI assistant raised issues resolved per hour by 14% on average and by 34% for the newest, least experienced staff, while the most experienced barely changed. The authors' explanation is that the tool "disseminates the best practices of more able workers". That is what a gear does for a chain of locations. The flagship branch was always answering its reviews well. Autopilot is how the branch that opened in March answers the same way — with the same person able to stop it.
Questions we get on this
What is a human-in-the-loop AI agent?
An agent that requires a person to approve its outputs before they take effect. The EU's 2019 ethics guidelines define human-in-the-loop as the capability for human intervention in every decision cycle, human-on-the-loop as monitoring during operation, and human-in-command as overall control over when and how the system is used. In Business Profile Agent, gear 2 (Drafting) is human-in-the-loop; gear 3 (Autopilot) is human-on-the-loop with a confidence threshold.
Should an AI agent publish review replies automatically?
Only after the drafts have proven themselves. OpenAI's guidance is that sensitive or irreversible actions should trigger human oversight until confidence in the agent's reliability grows. A practical sequence is to run in Drafting mode, measure how many drafts are approved without edits, and then enable automatic publishing for one action type at a time, such as replies to four- and five-star reviews above a confidence threshold.
What is a confidence threshold in an AI agent?
A score, set by the operator, above which the agent may act on its own and below which it must ask a person. In Business Profile Agent the default is 80%. The score is produced by a proof-reading agent on a different model than the drafting agent, because research shows models rate their own outputs more favourably than humans do.
Which actions should never be automated?
Anything the Policy Guard is configured to stop: replies to reviews that name an employee, reviews containing legal threats or health and safety claims, and any edit to a business name, address or primary category. These are handed to a person in every gear. Google's own guidance adds that critical or irreversible actions should require explicit human confirmation.
How do I move from approval mode to autopilot safely?
Run in Drafting for at least a month, read the approval rate per agent and location in the logbook, enable Autopilot per action type starting with the one that has the highest unedited-approval rate, record the client's consent, and adjust the confidence threshold rather than the gear when quality changes. Keep the stop button and the snapshot-based rollback in every gear.
Sources
- Gartner — Over 40% of agentic AI projects will be canceled by end of 2027 (Jun 2025)
- OpenAI — A practical guide to building agents (2025)
- Anthropic — Building effective agents (Dec 2024)
- Anthropic — Our framework for developing safe and trustworthy agents (Aug 2025)
- Google — An introduction to Google's approach for secure AI agents (May 2025)
- EU AI Act — Article 14, Human oversight
- EU High-Level Expert Group — Ethics guidelines for trustworthy AI (2019)
- Panickssery, Bowman & Feng — LLM evaluators recognize and favor their own generations (2024)
- Huang et al. — Large language models cannot self-correct reasoning yet (ICLR 2024)
- Brynjolfsson, Li & Raymond — Generative AI at Work (NBER, 2023)