A copilot and an agent may use the same model and conversational interface. The difference appears after the answer. A copilot gathers context, explains or prepares a recommendation while the user starts the action. An agent receives permission to execute a predefined step in a business system. That changes risk, audit trail, testing and accountability.
Examples include preparing a customer response using ERP data, explaining a margin variance, summarising a contract with sources and suggesting work-order priorities. A copilot should clearly distinguish fact, inference and missing data. The user must be able to open the source before deciding.
A low-impact, easily reversible action can receive more autonomy earlier, such as creating an internal task. A high-impact, hard-to-reverse action should require human confirmation even when the model is often accurate. Accuracy alone is not enough: the error type, detectability and time available to stop harm also matter.
Oversight is not effective when a person receives too many requests, lacks time to review or cannot see the data behind a recommendation. NIST AI RMF emphasises defined roles and responsibilities in human-AI configurations. In practice, confirmation must reach the correct role with an understandable reason, source and the ability to reject or escalate.
Source: NIST AI RMF Core: roles, responsibilities and human-AI oversight — The framework recommends defining roles, scope and oversight processes across the lifecycle.
Autonomy is not a property of the model. It is permission for a specific action in a specific process, within known boundaries and accountability.