DEV Community: William Jin

Graduated autonomy: the design pattern that made our AI agent safe to run in production

William Jin — Thu, 20 Aug 2026 10:04:23 +0000

When people say "AI agent," they usually mean one of two things. Either a chatbot that suggests what you should do, or a script with an API key that just does it. The first is safe and useless. The second is useful right up until the morning it quietly does something expensive.

I work on an agent that operates live ad accounts — real budgets, real money moving every hour. That constraint forces the question early: how do you hand execution to a model without handing over the keys entirely?

The pattern we landed on is graduated autonomy, and I think it generalizes well beyond ads.

The all-or-nothing trap

Most agent frameworks give you a binary. human_in_the_loop=True or False. Approve every tool call, or approve none.

Both settings are wrong most of the time:

Approve everything turns into rubber-stamping within a week. Nobody reads the 40th confirmation dialog. You've built the illusion of oversight, not oversight.
Approve nothing works fine until the model does something reasonable-looking and catastrophic, and now you're reconstructing what happened from provider logs.

The real problem is that the binary treats every action as equally risky. Pausing a keyword that spent $12 with zero conversions is not the same decision as restructuring a campaign. Trust is not a boolean, so the switch shouldn't be either.

Four levels instead of two

Level 0  OBSERVE     Agent watches, reports findings. Executes nothing.
Level 1  RECOMMEND   Agent proposes a concrete change. Human applies it manually.
Level 2  APPROVE     Agent stages the change. Human clicks approve. Agent executes.
Level 3  AUTOPILOT   Agent executes directly within a declared action envelope.

The important part is not the four levels — it's that the level is per scope, not per system. A new account starts at 0. After two weeks of the operator reading the agent's findings and agreeing with them, it moves to 1. Once staged changes have been approved without edits enough times, it earns 2. And a specific class of action — say, pausing zero-conversion keywords under a spend threshold — can be promoted to 3 while everything else stays at 2.

That last bit matters more than anything. You are not promoting "the agent." You are promoting this action type, in this account, under these bounds. It's closer to granting a permission than to trusting a coworker.

@dataclass(frozen=True)
class ActionEnvelope:
    action_type: str          # "pause_keyword"
    scope: str                # "account:1234"
    max_level: int            # 3
    bounds: dict              # {"max_daily_spend_delta": 50.0}

def resolve_level(action, envelopes) -> int:
    match = next(
        (e for e in envelopes
         if e.action_type == action.type and e.scope == action.scope),
        None,
    )
    if match is None:
        return 0                      # unknown action -> observe only
    if not within(action, match.bounds):
        return min(match.max_level, 2)  # out of bounds -> demote to approval
    return match.max_level

Note the failure mode: an unrecognized action doesn't get blocked with an error, and it doesn't get executed. It gets demoted. The agent still does its work, the human just sees it first. Unknown means "ask," not "crash."

Autonomy is worthless without an audit trail

Here's the part teams skip, and it's the part that actually makes the rest usable.

Every executed action has to carry the reasoning that produced it — not a post-hoc explanation generated by asking the model "why did you do that," which is confabulation, but the actual inputs the decision was made from.

{
  "action": "pause_keyword",
  "target": "kw:88213",
  "level_used": 3,
  "envelope": "pause_keyword@account:1234",
  "observed": {
    "spend_7d": 43.10,
    "conversions_7d": 0,
    "impressions_7d": 2210,
    "account_cpa_target": 35.0
  },
  "rule_fired": "zero_conv_over_cpa_target",
  "reverted_by": null,
  "ts": "2026-08-20T09:14:22Z"
}

Two properties are non-negotiable:

Replayable. Given observed, you can re-run the decision and get the same output. If you can't, you don't have a log — you have a diary.
Reversible. Every autonomous action names its inverse. reverted_by starts null and gets filled if a human disagrees.

The reversion rate is the single most useful metric we track. It's the promotion signal and the demotion signal in one number. If humans revert less than a few percent of a given action type, that action type is ready to move up a level. If reversions spike after a platform change, the action type demotes itself automatically. Trust becomes measured rather than asserted.

What this buys you

The thing I did not expect: graduated autonomy makes the agent more useful at low levels, not just safer.

At Level 1, the agent is forced to produce a change specific enough for a human to apply by hand. That constraint kills vague output. "Consider optimizing your underperforming campaigns" is not applicable. "Pause keyword X, it spent $43 over seven days against a $35 CPA target with zero conversions" is. The discipline required for Level 3 turns out to improve Level 1.

And when something does go wrong, the question is answerable. Not "the AI did something," but: this action, at this level, from this envelope, on this data, at this timestamp — and here's the human who approved it, or here's why no human was in the path.

That's the difference between an agent you can run on production systems and a demo.

We build this into Soku, an agent that runs ad campaigns across Google, Meta, TikTok and ChatGPT Ads. The domain is ads, but nothing above is ads-specific — if your agent touches infrastructure, billing, customer data, or anything else where a bad afternoon is expensive, the same four levels apply.

Curious what others are doing here. If you've shipped an agent with execution rights, how did you scope its permissions?

I Wrote 50+ GPT Image 2 Prompts for Ad Creative — Here's What Actually Works

William Jin — Tue, 28 Apr 2026 18:11:00 +0000

When OpenAI shipped GPT Image 2 last week, my X feed turned into the same five demos: astronauts on Mars, isometric office scenes, a cat in a beanie. Cool. But I run a marketing tool company, and the question I actually had was: can this thing replace a $3,000 product photoshoot?

Short answer: yes, with the right prompt. Long answer: most prompts you see online are tuned for "wow factor," not for shipping. Headlines need negative space. Product heroes need consistent lighting. Lifestyle shots need to look unstaged in a way the default model resists.

So I spent a few hours writing 56 prompts specifically for ad creative — product hero shots, OOH mockups, social ads with in-image taglines, type posters, flat lays, packaging, brand collabs, editorial. They're all live as a free gallery here:
👉 Soku AI's Free GPT Image 2 Prompts

Below are the seven I'd hand a junior designer on day one — copy-paste ready.

1. The "floating product" hero shot

Every DTC brand needs this. The trick is to over-specify the lighting and surface because GPT Image 2 will default to mushy studio mood otherwise.

Studio product photograph of a frosted glass skincare serum bottle with a black dropper, suspended mid-air against a soft peach gradient background. A single droplet of golden serum is frozen falling beneath the dropper. Hard rim light from the upper right, gentle reflected fill, subtle shadow on a bone-white acrylic surface below. Hyper-real macro detail on the brushed aluminum collar, condensation
beads, packaging-shot quality. 4:3, centered composition, copy-safe negative space on the left third.

Why it works: explicit light direction (upper right rim), explicit surface (bone-white acrylic), explicit copy zone (left third). The model stops guessing.

2. The lifestyle ad with a tagline already burned in

GPT Image 2 is genuinely better than predecessors at typography. You can ask for the headline directly and it'll usually nail kerning on the first try.

A lifestyle ad creative for a premium water bottle brand. A woman hiking on a scenic mountain trail, holding the [water bottle] with a natural grip. Wide shot, golden hour light, lush green background. Tagline: 'BUILT FOR THE LONG WAY.' Bold white sans-serif text, lower third. Photorealistic. No watermarks, no extra text.

Why it works: the bracket placeholder lets you swap products. The "no watermarks, no extra text" is load-bearing — without it the model invents fake brand marks.

3. The OOH billboard mockup

Pitch decks live and die by these. Don't ask for a "billboard" — ask for the specific physical context.

Photorealistic mockup of a massive curved LED billboard in Times Square at dusk, displaying an ad for a luxury skincare brand: an oversized close-up of a dewy face, a single product bottle, and short bold typography. Wet pavement reflections, ambient signage glow, blurred yellow taxis passing in the foreground. Cinematic 16:9, billboard occupying the upper-right of frame, slight wide-angle distortion.

Why it works: "wet pavement reflections" + "ambient signage glow" + "yellow taxis in motion blur" are what sell the realism. Without them you get a flat billboard floating in a clean street.

4. The type-led poster

Useful for B2B, event branding, conference comms. The trick is committing to a type system and a single accent color.

Editorial type poster: an oversized vertical-set classic serif headline reading "QUIETLY POWERFUL" filling the full frame, set in deep navy on a textured cream paper background. A small product mark and a single date in fine type at the bottom corner. Subtle paper grain, slight letterpress emboss feel. 3:4.

Why it works: telling the model what kind of serif (classic), what finish (letterpress emboss), and what texture (cream paper grain) gives it three hooks to latch onto instead of generating generic "elegant text."

5. The before/after for paid social

If you're running performance creative on Meta, this is the workhorse.

Social ad composition split vertically down the middle: left side warm-toned with the word "BEFORE" subtly burned in, right side bright cool-toned with "AFTER", showing the same model — left with dull skin, right with luminous glowing skin. Product bottle floats centered on the seam. Bold sans-serif headline space at the top. 1:1 square.

Why it works: explicit color temperature shift (warm → cool) gives the model a visual rule for "transformation" that survives even at low quality.

6. The flat lay for ecommerce + Pinterest

These are surprisingly hard to get right because the model wants to clutter.

Top-down overhead flat lay on a soft sage-green linen surface: a complete five-step skincare routine — cleanser, toner, serum, moisturizer, SPF — neatly aligned with subtle space between each item. Sprigs of dried botanicals, a folded muslin cloth, a bone-handled spoon for accent. Soft diffuse daylight, gentle shadows, editorial spacing. 1:1.

Why it works: "subtle space between each item" + "editorial spacing" tells the model to leave room. Without those phrases it crams everything together.

7. The brand collab

Limited drops are the most-shared ad format on social. The model loves this because it's basically two product hero shots glued together.

Energetic collab visual: a co-branded chip bag and a limited-edition controller floating in zero-G against a saturated electric-purple background, controlled splash of confetti and crumbs frozen mid-air. Hard rim light, neon accent, gen-z high-energy. 1:1.

Why it works: "controlled splash" + "frozen mid-air" gives motion that feels intentional rather than accidental.

What I learned writing 56 of these

A few patterns that survived from product hero to OOH:

Specify the surface, not just the background. "Bone-white acrylic" beats "white" every time. The model uses the surface to anchor its lighting.
Negative space is a directive, not a vibe. "Copy-safe negative space on the left third" is read as a hard constraint. "Clean composition" isn't.
Always close with a denial list. "No watermarks, no extra text, no logos" prevents the model from inventing a fake brand for you.
Aspect ratio belongs at the end. Putting it first sometimes gets ignored; putting it last as a closing instruction lands better.
Use bracket placeholders for the product noun. It gives you a templated prompt you can swap across SKUs without rewriting the whole thing.

The full 56

The above seven are a sampler. The full gallery has 56 prompts across nine
categories — packaging mockups, brand collabs, editorial portraits, UGC-style
shots, and more — all free, all copy-paste, organized for ad scenarios:

👉 Soku AI's Free GPT Image 2 Prompts

Each card has a one-click "Try in Soku AI" button if you want to skip the prompt-engineering altogether and have an agent run a campaign for you. (Soku is free during beta.)

Happy hacking!