# Autonomous vs Assisted AI Agents: Who Approves the Purchase

> The difference between autonomous and assisted AI agents, what a human in the loop is and what changes for your store when nobody confirms the cart.

URL: https://clione.ai/glossary/autonomous-vs-assisted-agents/
Lang: en

Here "autonomous" has nothing to do with self-driving cars, and "assisted" does not mean "chatbot". Both are [AI agents](/glossary/ai-agent/): they receive an assignment and decide steps and tools. The difference is in a single point, **who approves the action that has consequences**: paying, canceling an order, sending a message. The usual name for it is _human-in-the-loop_, a person in the loop. It matters to a store because it changes who looks at your data at the last moment: if the agent is assisted, the buyer sees the cart again before paying; if it is autonomous, **nobody looks at your [product page](/glossary/product-page/) before the purchase**, and what decides is what the agent read and the conditions the person signed.

## How it works

Autonomy is not a switch, it is a degree. Anthropic describes agents as systems that, once the task is clear, **plan and work on their own and may return to the person** for information or a decision, and that may pause to ask for feedback at checkpoints or when they get stuck. They also usually carry a stopping condition, such as a maximum number of iterations. The price of that autonomy, according to Anthropic, is higher cost and **errors that compound** from one step to the next.[^anthropic-agents]

Where to put the person is not a matter of taste either. OpenAI's guide to building agents gives two reasons to hand control over: the agent exceeds a limit on failures or retries, and it is about to do something high-risk, meaning **sensitive, irreversible or with a lot at stake**. Its examples come from the store: canceling customer orders, authorizing large refunds or making payments, which should go through a person until trust in the agent grows.[^openai-agents-guide] The same guide proposes rating the risk of each tool by whether it only reads or also writes, whether it can be undone, what permissions it requires and what financial impact it has.[^openai-agents-guide] And the [MCP (Model Context Protocol)](/glossary/mcp/) specification turns it into a technical recommendation: there should always be a person able to deny a tool call, with confirmation prompts in the interface.[^mcp-tools]

### The two ways to pay in AP2

[AP2 (Agent Payments Protocol)](/glossary/ap2/) is where the distinction has a name of its own. It separates two flows:[^ap2-flows]

|                           | Human present                                                                                   | Human not present                                                                                                           |
| ------------------------- | ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Who approves              | The person directly approves the closed checkout and payment [mandates](/glossary/ap2-mandate/) | The person approves open mandates beforehand, with conditions                                                               |
| What the agent does       | Prepares the purchase and waits                                                                 | Acts alone and presents the open mandates alongside the closed ones it signs itself                                         |
| If something does not fit | The person sees it before approving                                                             | The merchant or the credentials provider returns an `unresolved_constraint` error and **brings the person back** to approve |

The last row is the key: in AP2, autonomous mode is not "without control", it is control up front, and a flow with no person can turn into one with a person when the purchase falls outside what was signed.[^ap2-flows]

### What buying agents do today

The [agentic commerce](/glossary/agentic-commerce/) products that already buy for someone stay, for now, on the assisted side. Google's [agentic checkout](/glossary/agentic-checkout/), in the United States since November 2025, tracks a product's price against the size, color and budget you give it, and offers to buy it on the store's website with Google Pay; Google promises it **will always ask permission first** and will only buy after you confirm the purchase and the shipping details.[^google-agentic-checkout] Anthropic, when it introduced its browsing agent for Chrome in August 2025, said it asks for confirmation before high-risk actions such as posting, purchasing or sharing personal data, and that even in its experimental "autonomous mode" it keeps safeguards for the most sensitive actions.[^claude-chrome]

The reason for so much caution comes with a number. In Anthropic's tests, with 123 cases representing 29 attack scenarios, the browser without its defenses fell for **23.6% of prompt injection attacks**, text hidden in a web page to give orders to the agent. With the defenses added to autonomous mode, the rate dropped to 11.2%.[^claude-chrome] An agent that acts alone reads third-party pages, and any of them can try to steer it.

## In a store

A **fictitious example**: a person tells an agent "buy the usual 25-pound bag of dog food every month, as long as it costs less than $60". Here is the same assignment in the two modes, and what each reads from the store:

| Moment         | Assisted agent                                            | Autonomous agent                                                                                       |
| -------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| Choose product | Proposes the food and the store; the person looks at them | Searches for the same product in the store's catalog, with nobody looking                              |
| Check price    | The person sees the total with shipping                   | The agent compares the total against the signed $60 limit                                              |
| Pay            | The person confirms the cart and the payment              | The agent pays within the conditions; if the total goes over $60, the purchase goes back to the person |
| What decides   | What the person sees on the page                          | What the agent reads in the store's data                                                               |

In the right-hand column, **a price the agent misreads or a shipping cost that only shows up in the last step** is corrected by nobody looking: either the agent buys with wrong data, or the purchase bounces back to the person. That is why autonomous mode calls for a [machine-readable catalog](/glossary/machine-readable-catalog/), with price, stock and shipping in data, and not only on the page a shopper sees.


That "autonomous" means "without limits" and "assisted" means "a worse agent". In AP2, the autonomous agent buys alone only within the open mandates the person approved, and whatever falls outside them goes back to their hands.[^ap2-flows] And assisted mode is not a stripped-down version: OpenAI recommends it for irreversible actions until the agent earns trust.[^openai-agents-guide] **The useful question is not whether the agent is autonomous, but for which actions it is.**


## How to check it

1. **List the actions of every agent you use in your store** (customer service, returns, catalog) and mark the ones that write, move money or cannot be undone.[^openai-agents-guide]
2. **Check that those actions ask a person for confirmation** before they run, with a visible prompt.[^mcp-tools]
3. **Look for the stopping condition**: a maximum number of steps or retries, and what happens when it is reached.[^anthropic-agents]
4. **Walk through your purchase process looking at what gets confirmed**: product, total and shipping details have to be in text before the last step, which is what the person confirms in an assisted checkout.[^google-agentic-checkout]
5. **If your payment provider talks about AP2**, ask how it handles a purchase with no person that falls outside the conditions and whether it hands it back to the buyer.[^ap2-flows]

## Related concept: AI agent

An [AI agent](/glossary/ai-agent/) is the system that decides its own steps and uses tools to complete a task; autonomous or assisted describes **how much of that path it takes without asking permission**. Every agent sits somewhere on that scale, and the same agent can be autonomous for searching and comparing and assisted for paying. Something that is not an agent, like a chatbot that only answers, is neither autonomous nor assisted. Autonomy is exercised through tools, and [tool calling](/glossary/tool-calling/) explains how the model asks for them.

To go further, the [agentic commerce reading path](/learn/agentic-commerce/) orders the payment protocols, with [delegated payments](/glossary/delegated-payments/) and [agentic checkout](/glossary/agentic-checkout/).