What is the difference between an autonomous and an assisted agent?

Here "autonomous" has nothing to do with self-driving cars, and "assisted" does not mean "chatbot". Both are AI agents: they receive an assignment and decide steps and tools. The difference is in a single point, who approves the action that has consequences: paying, canceling an order, sending a message. The usual name for it is human-in-the-loop, a person in the loop. It matters to a store because it changes who looks at your data at the last moment: if the agent is assisted, the buyer sees the cart again before paying; if it is autonomous, nobody looks at your product page before the purchase, and what decides is what the agent read and the conditions the person signed.

How it works

Autonomy is not a switch, it is a degree. Anthropic describes agents as systems that, once the task is clear, plan and work on their own and may return to the person for information or a decision, and that may pause to ask for feedback at checkpoints or when they get stuck. They also usually carry a stopping condition, such as a maximum number of iterations. The price of that autonomy, according to Anthropic, is higher cost and errors that compound from one step to the next.⁠^{[1]Anthropic, engineering blog (December 19, 2024). Building effective agents}

Where to put the person is not a matter of taste either. OpenAI's guide to building agents gives two reasons to hand control over: the agent exceeds a limit on failures or retries, and it is about to do something high-risk, meaning sensitive, irreversible or with a lot at stake. Its examples come from the store: canceling customer orders, authorizing large refunds or making payments, which should go through a person until trust in the agent grows.⁠^{[2]OpenAI. A practical guide to building agents} The same guide proposes rating the risk of each tool by whether it only reads or also writes, whether it can be undone, what permissions it requires and what financial impact it has.⁠^{[2]OpenAI. A practical guide to building agents} And the MCP (Model Context Protocol) specification turns it into a technical recommendation: there should always be a person able to deny a tool call, with confirmation prompts in the interface.⁠^{[3]Model Context Protocol. Tools (Model Context Protocol, 2026-07-28 specification)}

The two ways to pay in AP2

AP2 (Agent Payments Protocol) is where the distinction has a name of its own. It separates two flows:⁠^{[4]AP2, official protocol site. Flows}

The last row is the key: in AP2, autonomous mode is not "without control", it is control up front, and a flow with no person can turn into one with a person when the purchase falls outside what was signed.⁠^{[4]AP2, official protocol site. Flows}

What buying agents do today

The agentic commerce products that already buy for someone stay, for now, on the assisted side. Google's agentic checkout, in the United States since November 2025, tracks a product's price against the size, color and budget you give it, and offers to buy it on the store's website with Google Pay; Google promises it will always ask permission first and will only buy after you confirm the purchase and the shipping details.⁠^{[5]Google, The Keyword (November 13, 2025). Let AI do the hard parts of your holiday shopping} Anthropic, when it introduced its browsing agent for Chrome in August 2025, said it asks for confirmation before high-risk actions such as posting, purchasing or sharing personal data, and that even in its experimental "autonomous mode" it keeps safeguards for the most sensitive actions.⁠^{[6]Anthropic, Claude blog (August 25, 2025). Piloting Claude in Chrome}

The reason for so much caution comes with a number. In Anthropic's tests, with 123 cases representing 29 attack scenarios, the browser without its defenses fell for 23.6% of prompt injection attacks, text hidden in a web page to give orders to the agent. With the defenses added to autonomous mode, the rate dropped to 11.2%.⁠^{[6]Anthropic, Claude blog (August 25, 2025). Piloting Claude in Chrome} An agent that acts alone reads third-party pages, and any of them can try to steer it.

In a store

A fictitious example: a person tells an agent "buy the usual 25-pound bag of dog food every month, as long as it costs less than $60". Here is the same assignment in the two modes, and what each reads from the store:

In the right-hand column, a price the agent misreads or a shipping cost that only shows up in the last step is corrected by nobody looking: either the agent buys with wrong data, or the purchase bounces back to the person. That is why autonomous mode calls for a machine-readable catalog, with price, stock and shipping in data, and not only on the page a shopper sees.

How to check it

1. List the actions of every agent you use in your store (customer service, returns, catalog) and mark the ones that write, move money or cannot be undone.⁠^{[2]OpenAI. A practical guide to building agents}
2. Check that those actions ask a person for confirmation before they run, with a visible prompt.⁠^{[3]Model Context Protocol. Tools (Model Context Protocol, 2026-07-28 specification)}
3. Look for the stopping condition: a maximum number of steps or retries, and what happens when it is reached.⁠^{[1]Anthropic, engineering blog (December 19, 2024). Building effective agents}
4. Walk through your purchase process looking at what gets confirmed: product, total and shipping details have to be in text before the last step, which is what the person confirms in an assisted checkout.⁠^{[5]Google, The Keyword (November 13, 2025). Let AI do the hard parts of your holiday shopping}
5. If your payment provider talks about AP2, ask how it handles a purchase with no person that falls outside the conditions and whether it hands it back to the buyer.⁠^{[4]AP2, official protocol site. Flows}

Related concept: AI agent

An AI agent is the system that decides its own steps and uses tools to complete a task; autonomous or assisted describes how much of that path it takes without asking permission. Every agent sits somewhere on that scale, and the same agent can be autonomous for searching and comparing and assisted for paying. Something that is not an agent, like a chatbot that only answers, is neither autonomous nor assisted. Autonomy is exercised through tools, and tool calling explains how the model asks for them.

To go further, the agentic commerce reading path orders the payment protocols, with delegated payments and agentic checkout.