Ask an MSP owner why the automation they pay for is switched off and the answer is rarely about capability. It is about the first time it is wrong at 3 am on a domain controller. A toggle marked “autonomous” is a promise nobody wants to be the one who trusted.
Guardian Plus takes a different position: the assistant asks before it acts, and how much it asks is a setting you choose per conversation, not a personality trait of the product.
Approve every step. It stops and asks before anything that carries risk. This is the default, and it is where most people stay. You see the objective, each task, its risk level and the exact command before it runs.
Approve the plan once. Read the whole plan, approve it once, then let it work through the list. You still see every command; you just do not click for each one.
Unattended. For work you scheduled and already trust: the nightly cleanup, the certificate renewal, the thing that has run two hundred times. The floor still applies.
Destructive commands stop for a human even on unattended mode. There is a line the automatic mode cannot cross, and you can wave it through for one job by saying so, but never by accident. That single rule is what turns automation from something you own into something you switch on.
A plan is not a script you either accept or reject. Skip a task, reorder the list, redirect the objective or stop it, without starting over. When a task fails, corrective steps are proposed under it for your approval rather than the run silently dying.
It cannot see what you cannot. Every tool it calls re-derives the permissions of whoever asked. It runs under your permissions, not a service account.
It cannot write on its own. Actions that change things are hidden from the assistant entirely and need a person to confirm. Your most sensitive documents are never fed to a model at all.
Install the agent on a single server, ask it something, and read the plan before you approve it. Fourteen days, every module, no card.