There is a failure mode that subscription tooling is unusually exposed to: advertising an autonomy switch that no code actually honours. The switch flips, the badge turns green, and the user believes an agent is watching their renewals. Nothing is. The first time they find out is a charge they expected to be cancelled.
Subscriber Bot closes that hole with an interlock rather than a promise. Setting an agent to Autonomous — whether at creation or by changing an existing agent's posture — is checked against a workspace feature gate that fails closed: an unresolved, unknown, or errored flag evaluation means the request is refused, not allowed. The refusal is a distinct, typed error, not a generic permission failure, and it explains itself: autonomous mode is unavailable because the policy-evaluation engine that would enforce Autonomous actions has not shipped, so use Suggest-only until this workspace is explicitly enrolled.
That distinction matters more than it looks. A "feature disabled" error implies an administrator could simply flip a rollout toggle. This error says something stronger and more honest: today no workspace can safely enable it, because the thing that would make the setting mean anything does not exist yet. The gate is deliberately not default-allow, which is the opposite of how the platform's other rollout flags behave — every other Subscriber Bot flag treats an undefined key as enabled, and this one alone treats it as denied.
Meanwhile the guardrails that do not depend on that engine are already load-bearing. Every action an agent could ever take is an ordinary API mutation, checked at the gateway against role permissions before the service ever sees it — agents get no private path and no elevated credential. Every write is scoped to your workspace with a guarded update that asserts exactly one row changed, so an identifier guessed from another tenant mutates nothing. Every operation is recorded to the audit trail with the acting identity, the workspace, the action and the resource, and with credential-shaped values redacted before anything is written.
The work still ahead is the enforcement engine itself: a decision queue, destructive-action classification, a spend interlock, and a confirmation step for anything irreversible. Until all four exist, Autonomous stays refused. Subscriber Bot would rather ship an honest "not yet" than a green badge that means nothing.
Do it yourself
Prove the interlock for yourself — try to create an Autonomous agent, read the refusal, fall back to Suggest-only, and author the policy that will bind the agent once enforcement ships.
Open AI Agents, click New agent, name it, and pick a kind such as Renewal or Cost.
You should see: The form is ready, with Starting posture offering Suggest-only, Disabled, and Autonomous.
Ready to make this your story?
