Progressive Autonomy as Preference Learning
A Formalization of Trust Calibration for Agentic Tool Use
May 18, 2026
Abstract
We formalize trust calibration for agentic tool use (deciding when an automated agent’s proposed action may execute autonomously versus require human approval) as a preference-learning problem. A policy gateway maintains a Gaussian-process posterior over a latent human risk-tolerance function, observed through a probit likelihood on binary approve/deny feedback, and escalates to the human exactly where the approval outcome is most uncertain. We show this is structurally an instance of Preferential Bayesian Optimization, inheriting its inference machinery (approximate Gaussian-process classification) and its sample-efficiency argument (uncertainty-targeted querying), while differing in objective: classifying an action space into allow/block/ask regions rather than optimizing a design.
1 Background and Related Work↩︎
Deciding how much autonomy to delegate to an automated system is a classical human-in-the-loop control problem; the technical core here, recovering a human’s latent acceptability function from sparse binary feedback, is preference learning. [1] introduced Gaussian-process preference learning, placing a Gaussian-process (GP) prior over a latent utility and linking observed human choices to it through a probit likelihood. We adopt exactly this construction, specialized to unary approve/deny feedback. The same latent-utility-with-probit model underlies preference-driven sequential decision making: [2] formalized Preferential Bayesian Optimization (PBO), embedding GP preference learning in the query loop of Bayesian optimization [3], [4]. Our policy gateway is structurally an instance of this framework, differing only in objective (classifying an action space rather than optimizing a design), as Table 1 makes precise.
The inferential machinery is classical GP classification: a GP prior, a non-Gaussian probit likelihood, and an analytically intractable posterior approximated by the Laplace method or Expectation Propagation [5], developed comprehensively by [6]. Treating the human query budget as a scarce resource makes the ask region an acquisition rule in the sense of active learning [7] and Bayesian optimization [4]: interruptions are spent where the expected information about the allow/block boundary is greatest. Finally, drifting risk tolerance is a non-stationarity problem; we model it with a time-decaying kernel component in the spirit of non-stationary covariance functions [8] and, for abrupt shifts, Bayesian online changepoint detection [9].
This progressive view of autonomy has deep roots in the trust-in-automation literature: [10] characterized appropriate reliance as the alignment of trust with actual system trustworthiness, and [11] extended this to longitudinal trust calibration in human–robot teams, precisely the dynamic our time-decaying kernel (§6) is meant to capture. The concern has resurfaced sharply for large-language-model agents, where graduated autonomy has emerged as an explicit deployment axis alongside raw capability [12]. Recent work catalogs the risks of increasingly agentic systems [13], argues for visibility and oversight mechanisms over deployed agents [14], and proposes governance practices in which a human retains approval authority over consequential actions [15]. These accounts are largely qualitative and taxonomic: they argue why graduated autonomy matters and what should be governed, but leave the escalation policy itself as a fixed, hand-specified tier. Our contribution is the missing mechanism: a learning rule that lets the auto-approve/escalate boundary adapt from human feedback rather than being set by hand.
2 Setup↩︎
At each decision point \(t = 1, 2, \ldots\), the policy gateway observes a proposed agent action \(a_t \in \mathcal{A}\) and an execution context \(c_t \in \mathcal{C}\), where: \[\begin{align} a_t &= (\texttt{tool\_name},\; \texttt{args},\; \texttt{target\_resource}), \\ c_t &= (\texttt{repo\_state},\; \texttt{task\_desc},\; \texttt{session\_history}). \end{align}\] A human supervisor provides binary feedback \(y_t \in \{0, 1\}\) (deny/approve). We write \(x_t \mathrel{\vcenter{:}}= (a_t, c_t) \in \mathcal{X} = \mathcal{A} \times \mathcal{C}\) for the joint input.
3 Latent Risk Tolerance↩︎
Definition 1 (Risk tolerance function). There exists a latent function \(f\colon \mathcal{X} \to \mathbb{R}\) encoding the human’s risk tolerance, such that approval probability follows a probit observation model: \[\Pr(y = 1 \mid x) = \Phi\!\bigl(f(x)\bigr),\] where \(\Phi\) is the standard normal CDF.
Remark 1. This is structurally identical to the observation model in Preferential Bayesian Optimization [2] and, more fundamentally, in Gaussian-process preference learning [1]. In standard PBO, the human expresses a preference between two candidates \((x_i, x_j)\) via \(\Pr(x_i \succ x_j) = \Phi\bigl(f(x_i) - f(x_j)\bigr)\). Here, the comparison is against an implicit internal threshold: the human approves when \(f(x)\) exceeds their acceptable-risk boundary. The unary case is a degenerate pairwise comparison against a fixed reference point.
4 Gaussian Process Prior and Posterior↩︎
Place a GP prior over \(f\) [6]: \[f \sim \mathcal{GP}\!\bigl(\mu_0,\; k(x, x')\bigr).\]
The kernel \(k\) decomposes over the input structure. A natural choice is a product kernel: \[k(x, x') = k_{\text{tool}}(a, a') \cdot k_{\text{ctx}}(c, c') \cdot k_{\text{time}}(t, t'),\] where:
\(k_{\text{tool}}\) encodes similarity between actions (e.g., shared tool name, overlapping argument patterns, same reversibility class),
\(k_{\text{ctx}}\) captures context similarity (same repository, file type, task category),
\(k_{\text{time}}\) handles non-stationarity (see §6).
After observing \(\mathcal{D}_N = \{(x_t, y_t)\}_{t=1}^{N}\), the posterior is: \[\label{eq:posterior} p(f \mid \mathcal{D}_N) \;\propto\; \mathcal{GP}(\mu_0, k) \;\cdot \prod_{t=1}^{N} \Phi\!\bigl(f(x_t)\bigr)^{y_t} \bigl(1 - \Phi\!\bigl(f(x_t)\bigr)\bigr)^{1 - y_t}.\tag{1}\]
This is analytically intractable due to the non-Gaussian likelihood. Approximate inference proceeds via the Laplace approximation [6] or Expectation Propagation [5], the same machinery used in PBO.
Remark 2 (Practical realization). For the unary model, the Laplace approximation of [6] (Algorithm 3.1
there) reduces inference to a short Newton iteration to the posterior mode, after which the predictive approval probability admits the closed form \(\mathbb{E}\bigl[\Phi(f(x_*))\bigr] \approx \Phi\!\bigl(\mu_* / \sqrt{1 +
\sigma_*^2}\bigr)\), with \(\mu_*\) and \(\sigma_*^2\) the latent posterior mean and variance at \(x_*\). At the scale of decision points in a single
project (\(N\) on the order of \(10^2\) to \(10^3\)), this exact computation is inexpensive and needs no sparse approximation, which keeps the implementation
a transparent instance of the cited machinery rather than a wrapper around a general optimization stack. A maintained off-the-shelf alternative is the PairwiseGP model of BoTorch [16], a deployable PBO implementation; being pairwise, it recovers the unary setting only through the degenerate comparison against a fixed reference of Remark 1, at the cost of a heavier dependency. This choice affects only the posterior: the gateway rule, the non-stationary drift component, and any baselines are unchanged.
5 The Policy Gateway Decision Rule↩︎
Given the posterior predictive distribution at a new point \(x_*\): \[\hat{p}(x_*) \mathrel{\vcenter{:}}= \mathbb{E}_{f \mid \mathcal{D}_N}\!\bigl[\Phi(f(x_*))\bigr],\] the gateway applies a three-tier decision: \[\label{eq:decision} \text{decision}(x_*) = \begin{cases} \mathrm{\small allow} & \text{if } \hat{p}(x_*) > \tau_{\text{high}}, \\[3pt] \mathrm{\small block} & \text{if } \hat{p}(x_*) < \tau_{\text{low}}, \\[3pt] \mathrm{\small ask} & \text{otherwise}. \end{cases}\tag{2}\]
The \(\mathrm{\small ask}\) region \([\tau_{\text{low}}, \tau_{\text{high}}]\) plays the role of an acquisition function [4], [7]: the system queries the human precisely where the model is most uncertain about the approval outcome, maximizing the expected value of information per human interruption.
Remark 3. The target operating point (85–90% auto-approve, 10–15% human escalation) emerges naturally as the posterior concentrates. Early in a project, most actions fall in the \(\mathrm{\small ask}\) region. As the model learns, the \(\mathrm{\small ask}\) band narrows, and the auto-approve rate rises without any manual threshold tuning.
6 Non-Stationarity↩︎
Human risk tolerance drifts: early in a project the supervisor is cautious; as trust accumulates for familiar patterns, they become permissive. Model this via a time-decayed kernel component: \[k_{\text{time}}(t, t') = \exp\!\Bigl(-\frac{|t - t'|}{\lambda}\Bigr),\] where \(\lambda > 0\) is a lengthscale controlling the forgetting rate. This gives recent approve/deny signals more weight, a principled analog of the intuition that “agents earn trust over time.”
For computational efficiency, an equivalent effect can be achieved through a sliding window of the most recent \(W\) observations, or via online changepoint detection when the supervisor’s behavior shifts abruptly (e.g., moving to a new codebase).
7 Correlated Generalization↩︎
A key advantage over a naïve contextual bandit (which treats each \((a, c)\) independently) is correlated generalization through the kernel. Concretely:
Approving
write_fileto/workspace/src/transfers evidence towrite_fileto/workspace/test/, since \(k_{\text{tool}}\) and \(k_{\text{ctx}}\) assign high similarity.Denying
execute_sqlwith aDROPargument propagates caution toexecute_sqlwithTRUNCATE, without the human having to deny each variant individually.A new tool with no interaction history inherits the prior \(\mu_0\), which maps to \(\mathrm{\small ask}\), the fail-safe default.
8 Connection to PBO↩︎
The mapping between the trust calibration problem and Preferential Bayesian Optimization [2] is summarized in Table 1.
| Component | PBO (Optimization) | Trust Calibration (Policy) |
|---|---|---|
| Input space \(\mathcal{X}\) | Design parameters | (action, context) pairs |
| Latent function \(f\) | Objective to maximize | Risk tolerance to learn |
| Human feedback | Pairwise preference \(x_i \succ x_j\) | Unary approve/deny |
| Observation model | \(\Phi(f(x_i) - f(x_j))\) | \(\Phi(f(x))\) |
| Acquisition | Next query to evaluate | Next action to escalate |
| Goal | Find \(x^* = \arg\max f\) | Learn the \(\textsc{allow}\)/\(\textsc{block}\) boundary |
The “preferential” aspect is literal: the human is expressing preferences over what the agent should be allowed to do. The same mathematical machinery (GP priors, probit likelihoods, approximate posterior inference) transfers directly. The difference is the objective: PBO seeks to optimize, while trust calibration seeks to classify the action space into allow/block/ask regions with minimal human queries.
9 Datasets and Evaluation↩︎
Empirically grounding the gateway requires data pairing proposed agent actions with human approve/deny judgments. The closest public resource is R-Judge [17], which supplies multi-turn agent interaction records annotated by humans with binary safe/unsafe labels across a range of risk scenarios; it is a natural source for a cold-start prior \(\mu_0\) and for calibrating \(k_{\text{tool}}\) and \(k_{\text{ctx}}\). Broader agent-safety benchmarks such as Agent-SafetyBench [18] and ToolEmu [19] widen the action and context coverage, but their risk labels are produced by automated judges rather than per-action human approval, so they are better suited to stress-testing the learned boundary than to fitting \(f\) itself.
A structural gap remains: no public dataset captures the longitudinal, per-supervisor signal that the non-stationarity model (§6) assumes. Existing corpora provide single-shot, aggregated annotations and do not track an individual supervisor’s risk tolerance drifting over the course of a project. Validating the time-decaying kernel therefore requires either a controlled user study or a simulation with deliberately drifting synthetic annotators, with R-Judge serving as the static initializer. We treat this as an inherent limitation of currently available data rather than a deficiency of the model.
10 Simulation Study↩︎
We accordingly exercise the formulation in a controlled simulation whose ground-truth oracle instantiates Definition 1 and the drift of §6: the standard evaluation protocol for Preferential Bayesian Optimization,
where the latent preference function is synthetic by construction so that recovery, calibration, and query efficiency can be measured against a known target. The action space is \(18\) agent tools with interpretable
decision-time risk attributes (reversibility, base sensitivity, blast radius, destructive-argument flag), \(8\) target-resource sensitivity tiers, and \(7\) task contexts. The oracle latent
is a static action acceptability term plus a saturating accumulated-trust term (§6) with an abrupt changepoint at \(t = 750\), plus a three-way safety veto (irreversible and
sensitive and low-trust); approvals are drawn as \(y \sim \mathrm{Bernoulli}(\Phi(f^*))\). The gateway is the self-contained Laplace GP-probit of [6] with the product kernel of §4. The kernel observes the action and context risk attributes but never the time-varying veto or the drift, which it must recover from feedback through \(k_{\text{time}}\). We process a stream of \(N = 1500\) decision points over \(6\) seeds, prequentially (every decision is scored before any label at that step
exists), with phases learn \([0, 560)\), validation \([560, 1050)\) where \((\tau_{\text{low}}, \tau_{\text{high}})\) is tuned once under a tightened
false-allow cap, and a frozen-policy test \([1050, 1500)\) in which the model keeps adapting online. Reproducible code, the full report, and all figures are provided under experiment/.
10.0.0.1 Inference and correlated generalization hold.
Table 2 reports the validation phase (a fair measurement of what was learned, with the changepoint inside it) and the post-changepoint test phase, against a no-correlation baseline that learns each tool independently. The
GP gateway auto-decides \(68\%\) of actions at \(97.3\%\) accuracy with a \(2.4\%\) false-allow rate on validation, and \(99.7\%\) accuracy post-changepoint; the independent baseline auto-decides almost everything but at \(69\)–\(71\%\) accuracy, confirming that the kernel, not the
three-tier rule, carries the quality. Correlated generalization is decisive: on a held-out write_file to a test directory that was never queried, the GP recovers the correct decision \(98.7\% \pm 2.9\)
of the time purely by kernel extrapolation from similar tools and targets, against \(66.7\% \pm 47.1\) for the independent learner (chance \(50\%\)); Figure 1
(right) visualizes the gap. The ask band narrows and the auto-approve rate rises as the posterior concentrates, then both react sharply at the changepoint and recover (Figure 1, left), and a
fixed probe action’s posterior tracks the drift and the abrupt reset (Figure 2). Calibration is directionally correct but underconfident at the kernel-far tail (validation ECE \(0.19\) against
the true \(\Phi(f^*)\)), which we report rather than tune away.
| Validation (headline) | Test (post-changepoint) | |||
|---|---|---|---|---|
| 2-3(lr)4-5 Metric | GP gateway | Independent | GP gateway | Independent |
| Auto-decision accuracy | \(0.973 \pm .016\) | \(0.688 \pm .164\) | \(0.997 \pm .003\) | \(0.705 \pm .248\) |
| False-allow rate (safety) | \(0.024 \pm .018\) | \(0.027 \pm .017\) | \(0.003 \pm .003\) | \(0.007 \pm .008\) |
| Auto-decided fraction | \(0.684 \pm .020\) | \(1.000 \pm .000\) | \(0.644 \pm .094\) | \(0.933 \pm .099\) |
| ask / escalation | \(0.316 \pm .020\) | \(0.000 \pm .000\) | \(0.356 \pm .094\) | \(0.067 \pm .099\) |
| prob-RMSE vs \(\Phi(f^*)\) | \(0.263 \pm .004\) | \(0.344 \pm .076\) | \(0.236 \pm .025\) | \(0.353 \pm .102\) |
| ECE vs true prob | \(0.192 \pm .008\) | \(0.273 \pm .078\) | \(0.205 \pm .022\) | \(0.316 \pm .104\) |
Figure 1: Left: the rolling policy mix. The allow share rises as the posterior concentrates (the ask band narrows), then collapses at the \(t=750\) trust changepoint and recovers, exactly the Section 5 and Section 6 dynamics. Right: correlated generalization (Section 7) to an action-context combination that was never queried..
10.0.0.2 Human-burden reduction.
Against the status quo of always escalating (one human query per action), the gateway spends \(508 \pm 51\) queries over the scored phases versus \(940\), a \(\sim\!1.8\times\) reduction in interruptions, while auto-deciding most actions accurately and safely (Figure 2, left; the full-stream cumulative trajectory shows a larger gap because the cold-start learn phase escalates heavily by design). This is the Section 1 promise, and it is the defensible headline rather than a comparison to random querying.
Figure 2: Left: cumulative human queries, gateway versus always-escalate (Section 1). Right: a fixed probe action’s posterior approval probability tracks the drifting oracle and its abrupt reset (Section 6); the systematic gap is the Laplace-probit underconfidence noted in the text..
10.0.0.3 An honest negative result on the acquisition rule.
The rule “query inside the ask band,” taken literally as a sample-efficiency claim, is not supported here: at a matched query budget its prequential boundary-decision accuracy is \(76.5\% \pm 2.2\) against \(78.4\% \pm 4.2\) for random querying. An ablation that switches the changepoint off and on (Table 3) shows the gap is non-positive in both regimes, including with a fully stationary target, so the deficit is not caused by non-stationarity. It is the familiar behaviour of pure uncertainty sampling under class imbalance: a region the posterior has grown confident about leaves the ask band and is never re-probed, so its estimate is never refreshed and a silently reset tolerance there goes undetected. The time-decayed kernel down-weights stale evidence but does not itself generate new probes. (The per-condition magnitude is small and seed-noisy; the robust finding is the consistently non-positive sign.) A recency-aware or information-theoretic acquisition criterion (an expected-information or BALD rule with a forgetting term) is the natural remedy and is left to future work; it does not affect the inference, generalization, or burden-reduction results above, which use the same band as a pure escalation rule.
| Oracle | ask-band active | Random query | Gap |
|---|---|---|---|
| Stationary (no changepoint) | \(80.6\%\) | \(83.9\%\) | \(-3.3\) pp |
| With §[sec:sec:nonstationary] changepoint | \(75.8\%\) | \(76.2\%\) | \(-0.4\) pp |
11 Concluding Remarks↩︎
We have argued that deciding when an agent may act autonomously is not a threshold to hand-tune but a latent human risk-tolerance function to learn, and that doing so is structurally an instance of Preferential Bayesian Optimization specialized to unary approve/deny feedback. The contribution is the mechanism the governance literature leaves implicit: a GP-probit policy gateway whose allow/escalate/block boundary adapts from feedback, generalizes across correlated actions through a structured kernel, and tracks a drifting supervisor through a time-decayed component.
The simulation study supports the parts of this story that concern inference: the gateway recovers a non-stationary boundary it never observes directly, transfers evidence to unqueried action-context combinations far better than an independent learner, tracks an abrupt changepoint, and cuts human interruptions substantially relative to escalating everything. It also disciplines one claim: the ask band is a sound escalation rule, but treating it as a sample-efficient acquisition rule does not hold under class imbalance, independently of non-stationarity. We report this rather than tune it away, and read it as locating the open problem precisely in the acquisition criterion rather than in the formulation. The remaining gap is empirical: no public dataset tracks a single supervisor’s per-action decisions as their tolerance drifts, so a recency-aware acquisition rule and a longitudinal human study are the natural next steps. We see the value of the formulation less in the present numbers, which are simulated by necessity, than in turning a hand-set autonomy tier into an object that can be learned, audited, and questioned.