The idea behind it
An agent that can act in business systems needs a decision, for each action, on how much it may do without a person. Deciding once for the whole agent does not work: the same service desk agent may safely recategorize a ticket on its own, but should not wipe a laptop or post to every employee without someone approving. The matrix makes that decision per action, from three questions about a wrong action. How hard is it to undo? How much does it touch? How sensitive is the data involved?
Each factor scores 1 to 3, and the sum sets one of four autonomy levels, from acting without notice to suggesting only. Irreversible actions that reach more than one person or touch confidential data are held at approval or stricter whatever their score. Each level carries its controls: who approves, what is logged, the rate limits, how narrowly the credential is scoped and how the agent is stopped. The controls belong in the systems the agent calls, not in its prompt. The profile also asks two questions that come before any scoring: whether the agent acts with its own identity or a user's delegated authority, and whether its steps could be written down as a workflow instead.
What's inside
- An agent profile: business owner, technical owner, model and version, whether it acts with its own identity or a user's delegated authority, its credentials, logs and kill switch.
- An action matrix with one row per action per system, each scored 1 to 3 on reversibility, blast radius and data sensitivity from dropdowns.
- A scoring rule that turns the 3-to-9 score into one of four levels: act without notice, act and notify, act with approval, or suggest only, with a floor for irreversible actions.
- Overrides that can only make an action stricter, with a reason, and a check that flags a looser one.
- The controls each level requires: approval step, logging, rate limits, credential scope, kill switch and review.
- A Gaps column that flags a missing approver, rate limit, credential scope or kill-switch owner.
- A worked example for a fictional company's service desk agent: 13 actions across four systems.
Format: PDF (5 pages) and Excel workbook.
A look inside
Pages 1 and 2 of 5 of the PDF. Select an image to enlarge it.
Who uses it
- CIOs and heads of AI, to agree with the business how much each agent may do alone before it gets write access.
- Business owners of agents, to sign off the actions they are accountable for.
- Security and identity teams, to scope the agent's credentials and approvals to the level each action needs.
- Platform and engineering teams, to build the approval steps, rate limits, logging and kill switch the matrix requires.
When to use it
- An agent is about to move from a pilot to production with write access to real systems.
- A team asks to give an existing agent a new tool, API or permission.
- An agent's model, prompt or platform changes and its actions need re-checking.
- An audit or a risk committee asks what an agent is allowed to do and who approved it.
- An agent incident shows an action ran with less control than it needed.
How to use it
Fill it in before an agent gets write access to any system, have the business owner sign it off, and review it after any model, prompt, tool or permission change.
- Fill in the agent profile, including the named business owner and whether the agent acts as itself or with a user's authority.
- List every action the agent can take, one row per action per system, from its actual tools and permissions.
- Score reversibility, blast radius and data sensitivity for the worst realistic wrong action, from the dropdowns.
- Read the level from the rule, and add a stricter override with a reason where the business wants one.
- Fill in the approver, rate limit, credential scope and kill-switch owner until the Gaps column is empty.
- Have the business owner sign off, and review the matrix after any model, prompt, tool or permission change.
You leave with: A signed-off list of every action the agent can take, each with an autonomy level derived from a stated rule and the approver, logging, rate limit, credential scope and kill switch it needs.
Where it goes wrong
- Writing one row for a broad capability such as "manage accounts". Unlock, reset, add to a group and disable score very differently.
- Scoring the usual case instead of the worst realistic wrong action.
- Enforcing the level in the prompt. An agent told not to do something but holding the permission to do it is not bounded.
- Leaving approval to someone who approves everything. The controls tab asks the owner to review approval rates monthly for this reason.
Get the worksheet
It is free. Enter your work email and we send the download link.
Questions
What are the levels of AI agent autonomy?
The matrix uses four, from least to most restrictive: act without notice, act and notify a named person who can reverse it, act with approval of each action, and suggest only, where a person takes the action with their own access.
How do you decide whether an agent action needs human approval?
Score how hard a wrong action is to undo, how much it touches and how sensitive the data is, 1 to 3 each. In the matrix a total of 7 needs approval and 8 or 9 is suggest only. An irreversible action that reaches more than one person or touches confidential data needs approval whatever its score.
Should an AI agent use its own credentials or the user's?
Either can work, but the choice has to be made and written down. An agent with its own identity is easier to audit but holds standing permissions no one approved for a specific action. One acting with a user's delegated authority must keep the user and the agent separate in the logs. The profile records the choice and the credentials.