Nobody handed the agent more intelligence. They handed it a password.
The story everyone tells about autonomous agents is a story about capability — the models got smarter, so now they can do things. That is not what happened. The same model that answers a question can book the flight, and the difference between those two afternoons is not measured in intelligence. It is measured in what somebody decided to give it access to.
Guess first — commit before you look
A chatbot that drafts your emails becomes an agent that sends them. What actually changed?
Same model, same prompt, same company. One of these is the real difference, and picking the wrong one is how governance conversations end up in the wrong room.
Drive it
Five rungs, and the model is the same on all of them
Climb it one rung at a time. What changes going up is never the intelligence — it is what you had to hand over to get the next thing, and what a mistake now reaches. Select any rung to see the trade you are making.
Notice what is not on this ladder: model quality, benchmark scores, parameter counts, which vendor you picked. Those change how well the thing performs the task. The ladder is about what happens when it performs the task badly — and that is governed entirely by decisions your own organisation makes. Agents & Tool Use covers the mechanism underneath all five rungs.
Rung five, in the wild
The agent that arrived in a group chat
Rung five sounds like a thing large companies will get to carefully, in a few years, after the frameworks settle. It isn't. In November 2025 a developer called Peter Steinberger released a project named Warelay, which was renamed briefly to Moltbot and then to OpenClaw. It is free, open source, and it runs on your own machine.
What it does is deceptively plain: it connects a language model — Claude, GPT, DeepSeek, whichever you point it at — to real software, and it takes its instructions through ordinary chat platforms. You message it the way you would message a colleague, and it goes and does the thing on your actual accounts, on your actual machine.
There are three things worth taking from this, and none of them is about OpenClaw specifically.
Rung five needed no permission
No procurement, no vendor, no budget line, no security review. One person built it and tens of thousands of people were running it before most organisations had finished writing an AI policy.
The hard part was never the model
The intelligence was rented from someone else's API. What was actually built was the plumbing — the permissions, the connections, the loop. That is the part that turned out to be scarce, and it is now free.
It runs on the employee's laptop
This is the one that matters for governance. An agent on someone's own machine, holding their own credentials, is not something your controls can see. Some of your staff are already on rung four.
The instinct in most boardrooms is to ask whether to allow this. That is the wrong first question, because it has already been answered by whoever installed it last Tuesday. The useful question is narrower and much more answerable: which of your systems would an agent running on a member of staff's laptop be able to reach with that person's own credentials — and would you know? The AI Attack Surface is the follow-on for that conversation, and Claude Code: Zero to Hero is what rung four looks like when you do it deliberately.
Where this bites
Questions that get sharper once you have the ladder
The value of naming the rungs is that vague conversations about "AI risk" become specific conversations about specific handovers — each of which has an owner, a date, and a reversal path.
"Which rung does this product actually sit on?"
Vendors describe rung two and ship rung four. Ask what it can do without a human in the loop, and what credentials it holds while doing it. The answer belongs in the contract, not the demo.
"Whose access is it borrowing?"
An agent has no permissions of its own. It runs as somebody, and it inherits everything that person can reach — including the things they can reach but never do.
"What can it do that we can't undo?"
Reading is reversible. Drafting is reversible. Sending, paying, filing and deleting are not. Sort the tasks by reversibility and the governance writes itself — see Feature Flags for the same instinct applied to releases.
"How would we reconstruct what it did?"
At rung four and five the agent acts while nobody is watching, which makes the log the only account of what happened. If it wasn't logged with enough detail to reconstruct a decision, it effectively didn't happen.
The single highest-value move for most organisations is not on this ladder at all: give people a sanctioned way to be on rung three, so they stop quietly building rung four for themselves on unmanaged machines. Prohibition moves the activity somewhere you cannot see it — the same argument, at more length, in The De-risking Ladder.
Go deeper
Autonomy is a series of small handovers, each of which felt reasonable.
Nobody decides to run an unattended agent on production systems. They decide to let it read the calendar, and then to let it draft the reply, and then to stop reviewing the drafts because they were always fine, and then to let it run overnight because the morning was the bottleneck. Every one of those was a sensible decision made by a sensible person. The ladder exists so that the fourth one gets discussed as what it is, rather than as a continuation of the third.
Talk to us about running this session