top of page
What’s inside
- Principles. Named owner, least privilege, own credentials, time-limited access, and content treated as data, never instructions.
- Autonomy tiers. Suggest, act with approval, act within limits, autonomous, and what the human does at each.
- Action classes. Read, reversible write, hard to reverse, and money or access, with the minimum control for each.
- Permission record. One row per agent: owner, purpose, tools, data tier, limits, expiry and approver.
- Promotion and stopping. The evidence needed to move up a tier, and a stop procedure you test before go-live.
How to use it
- Fill the action classes for your own systems first.
- Write a permission record before any agent gets credentials.
- Test the stop procedure before the first agent goes live.
- Re-certify every agent's access each quarter.
Read before you fill it in
bottom of page