Five Axes, Not One Ladder

Why a single risk score fails

A system can be extremely capable on one dimension and trivial on another, and the security consequences differ completely.

A single ladder position hides that. A single risk score hides it worse.

The five axes

Describe any agent along five independent dimensions:

Autonomy — how much does it decide for itself, without checking in?

Tool access — what can it reach, and how bad are the side effects?

Persistence — how long does its state live?

Delegated authority — what rights does it hold on behalf of a human?

Economic capability — can it move value?

Score each separately, low to high. Now consider two systems that both score "high" overall, in different places.

System A has full autonomy and long-lived memory, but its only tool is read-only documentation search. It can think for hours and reach nothing that matters.

System B has almost no autonomy — a human approves each step — but every tool it can call writes to production infrastructure.

Which is more dangerous? Neither answer is automatically right. System A's risk is data exposure and memory poisoning. System B's risk is a human approving something they did not fully read, forty times a day, until they stop reading.

A single risk score would have hidden both.

Scoring real systems

An IDE coding assistant that suggests completions. Autonomy low — it proposes, you accept. Tool access low. Persistence low. Delegated authority none. Economic none.

The same product with an "agent mode" that edits files, runs the test suite, and commits: Autonomy high. Tool access high — arbitrary code execution on your machine. Delegated authority: your git credentials. Same product name. Entirely different system.

A customer support assistant. Autonomy medium. Tool access medium — reads customer records, may issue refunds. Persistence high. Delegated authority: acts with the company's authority toward customers. Economic: yes, if refunds are in scope — and refunds are almost always in scope.

Support agents get treated as low-risk because the interface is a chat box. But a refund tool is an economic capability, and the counterparty is an untrusted member of the public.

A trading agent. Every axis high. At least this one is honest about it.

Our travel agent, scored

> Book my travel for the conference. Budget: $2,000.

| Axis | Score | Reason | | --- | --- | --- | | Autonomy | High | Chooses which flight, nobody approves | | Tool access | High | Email read, web read, booking write, payment write | | Persistence | Medium | Remembers seat preferences and frequent flyer numbers | | Delegated authority | High | Your email access and payment credentials | | Economic capability | Yes | Up to $2,000 — in theory |

That phrase — in theory — is doing a lot of work. Stage 3 is about making it true in practice.

Why the axes multiply

Take prompt injection. Somebody puts instructions in a web page and the agent follows them.

• Tool access low: attacker hijacked a system that can only produce text. Annoying, not serious.
• Tool access high, autonomy low: a human sees the proposed action first and might catch it.
• Autonomy high, delegated authority low: the agent enthusiastically attempts whatever the attacker asked and is refused by the API for lack of permission.
• All three high: the attacker now has your credentials, executing at machine speed, with nobody watching.
• Persistence high too: they may have left something behind for next time.

Each axis you raise multiplies the consequences of every other axis.

This is why "we'll add security later" fails so consistently with agents. Capability and risk arrive in the same commit.

Key takeaways

• Five independent axes: autonomy, tool access, persistence, delegated authority, economic capability.
• Score each axis separately. A single risk score hides what you need to see.
• Marketing names hide axis changes. "Agent mode" can move three axes at once.
• The axes multiply. Raising one increases the consequences of all the others.