Set where an agent may act on production

Your team runs an agent that opens PRs for infrastructure and database changes. Now the team is debating whether it should also run database migrations and terraform apply on production without a person approving each one. The goal is to save time on routine changes.

Where do you set the autonomy boundary, and what principle decides which actions an agent may take unattended?