Kasparov's conclusion: "Weak human + machine + better process was superior to a strong computer alone and, more remarkably, superior to a strong human + machine + inferior process."
He wrote that after two amateurs with three chess engines beat grandmasters in 2005. I kept coming back to it while watching how companies roll out AI agents today.
Half of his thesis is dead. Engines stopped needing a human partner years ago. But the other half held: the process decides the outcome. A Harvard/BCG experiment with 758 consultants found the same thing with AI tools. Same tool, same people, 40% better inside the model's range, 19 points worse just outside it.
So the question for agents isn't "human or no human" anymore. It's: who decides how much human involvement each use case needs, and how do you prove it's safe?
I couldn't find a good answer, so I built one. Over the past weeks I worked out a framework with five autonomy levels, sixteen required controls mapped to OWASP Agentic and ISO/IEC 42001, a scoring worksheet that caps the level, and promotion rules so autonomy is earned with evidence and revoked on signals. Plus a machine-readable certificate per use case.
It's a draft, public under CC BY 4.0: https://github.com/cjohannsen81/agent-autonomy-levels
If you run agents in production, I'd like to hear where it breaks. The thresholds need real deployments to calibrate.
