The Vergara Agentic Autonomy Scale (V0–V6): A Risk-Gated, Operational Standard for Agents Acting on Business Systems

Vendors describe AI agents as "autonomous" without a shared unit of measurement. Existing frameworks classify autonomy but stop short of making it operational: a dial the data controller can move, enforced in code, with guarantees attached to each position. This paper proposes the Vergara Agentic Autonomy Scale (VAAS), a seven-level scale (V0–V6). Six levels are obtained by composing two orthogonal axes — initiative (who starts the loop) and execution authority (what the agent may commit without a human); the seventh moves a third axis, the authority domain, where an agent acts across organisations under explicit composition rules. The core is a risk-gated execution model in which the level is never sufficient on its own: the decision to execute, propose, or block is a function of the level and the risk class of the individual action, subject to an invariant ceiling that no level overrides. 

We state seven properties (P1–P7) that an operational autonomy scale must satisfy to be more than a marketing label, and we define an Autonomy Statement: a ten-field disclosure that turns the claim "we are V3" into something a customer or auditor can check. 

The scale is not a proposal on paper: it is derived from, and validated against, two multi-tenant SaaS products in production (Hubents, event management; Koble, agency operations), which classify 24 and 12 write actions respectively, share identical thresholds (autonomous execution from V3; 7-day undo window), and enforce level gates in code rather than in prompts. 

Three findings are reported: (i) the two implementations agree in their runtime gates but disagreed in the ladder each published to its customers, so one product's V1 advertised authority its own gates withheld — a live failure of controller legibility while enforcement itself held, which is the case that proves those two properties must be stated separately, and which yields a general ordering principle (minimum marginal authority); (ii) they agreed on the risk class of all seven actions common to both domains, suggesting risk class is a property of the action type rather than of the vertical; and (iii) adoption data from 160 production organisations show that granting a level is not the same as exercising it: 157 sit at the fail-safe default, one tenant has been raised to V4 yet has run zero missions, and the autonomy actually exercised anywhere is V3's — 14 low-risk actions committed unaided over two weeks, none of them reversed — while 61 % of all proposals were dismissed. We are explicit about what this does and does not support: the scale is validated as a design and disclosure instrument, and the outcome data are two weeks old on a single tenant.