Most AI agent workflows have two states.
On and off.
That is not enough.
When a write tool fails, a source becomes untrusted, or a reviewer disappears, the agent should not keep full authority. But shutting down the entire workflow may throw away safe work it could still do.
The better control is graceful degradation. Reduce what the agent can do while preserving the work that is still safe.
The missing space between full autonomy and shutdown
Reliable services have degraded modes. They shed work, return simpler results, or block expensive paths before overload becomes a cascading failure.
Agent workflows need the same idea for authority.
An agent that cannot safely update a record may still inspect approved sources. An agent that cannot send a message may still prepare a draft. An agent waiting for a reviewer may preserve the request and evidence in a bounded queue.
The key is that the runtime changes the permissions. The prompt can explain the state, but prompt text is not the control.
Research has treated autonomy as adjustable for years
Researchers have worked on adjustable autonomy for years. LLM agents give the problem a new operating surface.
A foundational automation model separates information acquisition, analysis, decision selection, and action implementation. That split gives agent teams a practical option. Remove the ability to act while preserving approved research or analysis.
Research on adjustable autonomy found that rigid, one-shot transfers between agents and people can create coordination failures. A useful handoff strategy considers decision quality, delay, and the cost imposed on the rest of the team.
Adaptive-autonomy research has also proposed lowering system authority when model reliability falls or the operating environment no longer matches what the model was built to handle. The authors separate a high-priority request for human permission from a low-priority alert where the system continues its current task.
The studies come mostly from robotics and supervisory control. Applying them to LLM workflows is a systems-design inference, not proof that one state model fits every agent.
The lesson still travels well. Autonomy can change by task, context, and failure mode.
Graceful-extensibility research adds the resilience angle. The goal near an operating boundary is not to pretend normal conditions still exist. It is to preserve useful capacity without crossing into brittle failure.
Five modes worth defining
Start with five enforced states.
Assist-only
The agent can analyze approved inputs and prepare a reviewable draft. It cannot execute a side effect.
Use this when a prompt, model, or workflow changed and the output needs a fresh review sample.
Keep reading with free field-guide resources.
VibeSec Advisory publishes practical research, Skills, workflow examples, MCP notes, prompt injection tests, and AI red-team lessons for builders working with agentic AI.
Read-only
The agent can inspect approved systems and sources. Write, send, deploy, delete, and durable-memory tools are unavailable.
Use this when write permissions, target resolution, or destination health is uncertain.
Shadow
The agent proposes the action and records what the policy engine would have allowed. The real destination never sees it.
Use this for a new action class or after an incident. Shadow traces show whether the workflow is ready to regain limited authority.
Queue
The workflow preserves the request, source evidence, deadline, and proposed next step. It does not keep retrying.
Use this when a dependency or reviewer is unavailable. Put a hard limit on the queue. An unlimited fallback queue just moves the outage downstream.
Stop
The workflow preserves evidence and alerts the named owner. Tool calls, retries, delegation, and state changes end.
Use this for suspected compromise, destructive ambiguity, failed side-effect verification, or a source-trust boundary failure.
Let agents reduce authority, never restore it
An agent should be allowed to say, "I no longer have enough evidence to write. Move me to read-only."
That is a useful downgrade signal.
The same agent should not be allowed to decide that the incident is over and restore its own write tools.
Authority should return through an external policy decision or a named human approval. The exit test needs evidence: clean shadow traces, revalidated targets, restored dependency health, a passed authorization test, or a reviewed incident record.
Human-factors research on adaptive AI teammates adds an important warning. As automation becomes more autonomous, people can lose the context needed to detect and handle its failures. Human fallback is not automatically safe.
Sometimes queue is safer than interrupt. Sometimes assist-only is safer than handing control to an overloaded reviewer.
Write the state record before the incident
Every degraded mode needs seven fields:
- Entry trigger and observed evidence.
- Allowed tools, methods, targets, and data classes.
- Blocked actions and side effects.
- Queue limit, deadline, and retry rule.
- Human owner and notification rule.
- Evidence retained for review.
- Exit test and upgrade approver.
Store that record in the workflow control plane. Enforce it through tool wrappers, scoped credentials, policy code, or sandbox rules.
Do not ask the model to remember that it is in safe mode.
Test the path nobody uses
Google's SRE guidance makes a blunt point about graceful degradation. Rarely used fallback paths often fail when they are finally needed. Teams need to exercise them under controlled conditions.
The same rule applies here.
Run one normal case and one known-bad case through every mode. Confirm that the bad case loses authority. Confirm that safe work still continues. Confirm that the agent cannot talk itself back into write access.
This belongs beside the rollback drill and the workflow failure review. Rollback proves the team can recover after a bad action. Graceful degradation limits what the agent can do while the workflow is unstable.
The practical recommendation
Pick one tool-connected agent.
Write its assist-only, read-only, shadow, queue, and stop states. Remove one dependency in a sandbox. Feed it one untrusted source. Make one reviewer unavailable.
Then watch the transitions.
If the only safe response is a total shutdown, the workflow is brittle. If the agent can preserve useful work while real authority stays constrained, the workflow is starting to become resilient.
Sources
- Scerri, Pynadath, and Tambe, Towards Adjustable Autonomy for the Real World
- Parasuraman, Sheridan, and Wickens, A model for types and levels of human interaction with automation
- Abraham et al., Adaptive Autonomy in Human-on-the-Loop Vision-Based Robotics Systems
- Fuchs, Passarella, and Conti, Compensating for Sensing Failures via Delegation in Human-AI Hybrid Systems
- Hauptman et al., Human factors considerations for the context-aware design of adaptive autonomous teammates
- Panagopoulos et al., A Hierarchical Variable Autonomy Mixed-Initiative Framework for Human-Robot Teaming
- Google SRE, Addressing Cascading Failures
- Woods, The theory of graceful extensibility
- NIST, AI Risk Management Framework
- NIST, Generative AI Profile