# Rail level

**A rail level is a step from L0 to L4 on a ladder that sets how much an AI agent may do on one job, and it belongs to a job, not to an agent or a company.**

*Part of the [Learn hub](https://privycdp.org/learn) and the [customer data glossary](https://privycdp.org/learn/glossary).*

## What it means in practice

A rail level names what the agent may do and what the person's role becomes. The steps match the stages of the [AI marketing operations roadmap](https://privycdp.org/ai/ai-marketing-operations-roadmap).

| Level | Name | The agent may | The person is | Roadmap stage |
|---|---|---|---|---|
| L0 | Off | Nothing; the job is manual | Owner | Stage 1 |
| L1 | Read | Read masked data or aggregates, summarise, answer questions | Reader who checks | Stage 2 |
| L2 | Propose | Draft or recommend; nothing changes | Reviewer who accepts or rejects | Stage 2 |
| L3 | Execute after approval | Execute one named action after a named person approves the diff | Approver | Stage 3 |
| L4 | Act within bounds | Act alone on low-risk, reversible actions within written limits, with auto-revert | Auditor | Stage 4 |

The ladder stops at L4. Promotion needs written evidence and owner sign-off. Demotion is automatic on triggers: error budget breached, serious escaped error, drift alert, open incident, a model or tool change without a regression pass, no named owner.

Other ladders use the same numbers differently. On the Cloud Security Alliance scale, L1 means a person approves each action, and L5 is full autonomy, not considered appropriate for enterprise use today [1](#source-1). So rail L3 sits closer to its L1 or L2. Feng, McDonald and Zhang also name levels by the user's role [2](#source-2).

Rail levels are a vendor-neutral method, not a product setting. PrivyCDP uses AI to help review groups, workflows, unusual events and reports.

**Example (mobile network, illustrative):** the [Anomaly Watcher](https://privycdp.org/ai/rails/agents/anomaly-watcher) runs at L1, L4 pause. It explains alerts for a person to check, and it can pause one send under a written rule. Only a person resumes the send.

## Related terms

- [Agent rail](https://privycdp.org/learn/glossary/agent-rail): what carries the level.
- [Rail card](https://privycdp.org/learn/glossary/rail-card): where the level is recorded.
- [Approval gate](https://privycdp.org/learn/glossary/approval-gate): what L3 adds.
- [Blast radius](https://privycdp.org/learn/glossary/blast-radius): what L4 must bound.

## Where it matters

- [Rail levels: the levels of AI agent autonomy](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder): how to set and change them.
- [Marketing anomaly detection](https://privycdp.org/ai/rails/use-cases/campaign-anomaly-detection): two levels inside one job.


Back to the [customer data glossary](https://privycdp.org/learn/glossary) or the [Learn hub](https://privycdp.org/learn).

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### What are the levels of AI agent autonomy?

Rail levels use five, from L0 Off to L4 Act within bounds. Other published scales differ, so check which ladder a vendor means before comparing numbers.

### Why does the ladder stop at L4?

L4 already lets an agent act alone, on low-risk, reversible actions within written limits. Anything beyond that would let the agent set its own limits or take actions nobody can undo, which is what these rails exclude.

## Sources

1. Cloud Security Alliance, "Leveling Up Autonomy in Agentic AI": https://cloudsecurityalliance.org/articles/levels-of-autonomy
2. Feng, McDonald and Zhang, "Levels of Autonomy for AI Agents": https://arxiv.org/abs/2506.12469


## Further reading

- [Anomaly Watcher: An AI Agent That Explains Alerts and Pauses Sends](https://privycdp.org/ai/rails/agents/anomaly-watcher)
- [AI Agents for Marketing Operations: The Playbook on Rails](https://privycdp.org/ai/rails/functions/marketing-operations)
- [Marketing Anomaly Detection: Catch Campaign Problems With an AI Agent on Rails](https://privycdp.org/ai/rails/use-cases/campaign-anomaly-detection)
- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)