Agent Access Levels
AAL measures system access depth and data sensitivity. It is the 'what can the agent reach' axis.
What are the 5 Agent Access Levels?
The 5 Agent Access Levels (AAL) are: AAL 1 Advisor (shielded chatbot access), AAL 2 Bot (UI-level automation), AAL 3 Collaborator (direct file and code access), AAL 4 Operator (multi-agent orchestration with workflow primitives), and AAL 5 System Orchestrator (self-healing adaptive infrastructure). AAL 3 is the inflection point - where the agent stops suggesting and starts directly touching your files, code, and data. When AAL exceeds your APL, you have a critical structural risk called a mismatch.
How does the AAL framework work?
Agent Access Level is not about capability - it is about reach. A chatbot assistant (AAL 1) cannot touch your files. Claude Code (AAL 3) can read and write them. A multi-agent orchestration system (AAL 4) can coordinate workflows that touch everything. The question is not what the agent can do - it is what it can get to.
User → UI → Tool → Hidden Logic
- Text generation and advice
- Code suggestions (copy/paste)
- Explanations and analysis
- Your files or codebase
- Your system or terminal
- Any external actions
ChatGPT, Claude.ai, Gemini Chat, Grok, DeepSeek Chat, Minimax Chat, z.ai, Perplexity
User → Agent → UI / Tool
- Browser and UI automation
- Form filling and clicking
- SaaS app interactions
- Your local files
- Your codebase directly
- System-level commands
Zapier, Make, n8n, browser agents, Computer Use
User → Agent → Code / Files / Artifacts
- Read and write files
- Commit to git
- Run terminal commands
- Modify your codebase
- Multi-agent orchestration
- Workflow primitives
Claude Code, Cursor Agent, Aider, Gemini CLI, Codex CLI, DeepSeek via Cline, Minimax via OpenRouter
User(s) → Agents → Primitives → Systems
- Multi-agent coordination
- Workflow and schema primitives
- Automated end-to-end pipelines
- Self-modification
- Adaptive infrastructure
LangGraph, CrewAI, AutoGen, AWS Bedrock, Azure OpenAI, Vertex AI, NVIDIA NIM
User ↔ Agent ↔ System
- Self-modifying systems
- Adaptive infrastructure
- Autonomous reconfiguration
- Largely aspirational today
- Requires mature governance
Custom systems (aspirational)
AAL comparison table
| Level | Name | Access mode | What the agent can reach | Example tools | Risk factor |
|---|---|---|---|---|---|
| AAL 1 · Advisor | Advisor | Shielded | Text generation only | ChatGPT, Claude.ai, Gemini | Minimal |
| AAL 2 · Bot | Bot | UI | Browser and app interfaces | Zapier, Make, Computer Use | Low - reversible |
| AAL 3 · Collaborator | Collaborator | Data | Files, code, terminal, git | Claude Code, Aider, Cursor Agent | Medium - inflection point |
| AAL 4 · Operator | Operator | Primitive | Workflows, schemas, pipelines | LangGraph, CrewAI, AutoGen | High - multi-agent |
| AAL 5 · System Orchestrator | System Orchestrator | Cultural | Self-modifying infrastructure | Custom systems (aspirational) | Critical - autonomous |
Why is the same model at different AAL levels?
The same underlying AI model can appear at multiple AAL levels depending on how you access it. DeepSeek Chat is AAL 1 - it cannot reach anything outside the conversation. DeepSeek via Cline is AAL 3 - the same model, now with direct access to your files and terminal. Minimax Chat is AAL 1; Minimax via OpenRouter powering a CLI agent is AAL 3. The access level is determined by what the tool can actually reach, not the model name.
The same applies to tools with multiple modes: Cursor is AAL 2 in suggestions mode and AAL 3 in Agent mode. Computer Use is AAL 2 when sandboxed in a cloud VM and AAL 3 when given desktop access with a live file system.
What happens at the AAL 2 to AAL 3 boundary?
The biggest shift in the AAL framework is between AAL 2 and AAL 3. At AAL 2, the agent operates through interfaces - it clicks and navigates, but everything is reversible and visible. At AAL 3, the agent touches your actual artifacts. It reads your files, writes your code, commits to your repository. This is where silent, hard-to-audit changes become possible - and where the AI Setup Snapshot becomes most valuable.