Template · Agent governance
A six-pillar framework and a policy builder. Warm up by classifying five agents, then answer eight questions about your own. You will see its risk tier, the rules behind it, and leave with a governance policy your risk, security and legal teams can review.
The framework
Each pillar is a set of decisions you make once per agent and revisit as it earns trust. Hover or tab through the pillars to see what each one covers and how it tightens as risk goes up.
Risk tiers
A risk tier decides how much control an agent needs. The builder scores five factors, maps the score to a tier, then applies four override rules. Nothing is hidden: the rules that fire for your agent are highlighted below as you answer.
Low risk. Reads and summarises, or drafts low-stakes work. Owner sign-off, light sampling, quarterly review.
Moderate risk. A person approves outputs or the agent acts inside tight limits. Monthly review and documented testing.
High risk. Hard thresholds, tamper-evident logs, risk and security sign-off, staged changes and fortnightly review.
Highest risk. Dual approval for consequential actions, real-time monitoring, executive sponsor and formal change control.
| Factor | Answer and points |
|---|---|
| What it can do | Read only 0 · Draft for approval 1 · Act within limits 2 · Act autonomously 3 |
| Data sensitivity | Public 0 · Internal 1 · Confidential 2 · Regulated 3 |
| Impact of an error | Low 0 · Moderate 1 · High 2 · Severe 3 |
| Volume | Low 0 · Medium 1 · High 2 |
| Sensitive systems | +1 if it can act on payments, finance, HR or customer-facing channels |
Override rules, applied in order
Warm-up · Classify this agent
Read the brief, pick a tier, and see the scoring and rules work it out. Most people miss at least one. The misses teach the most.
Governance slows agents down. Every agent needs a committee before it ships.
Clear tiers speed things up. A Tier 1 agent needs an owner and light sampling, not a board. Save the heavy controls for the few agents that can move money or touch regulated data.
Policy builder
We have loaded an example so you can see a full policy. Change any answer and the document updates as you go. Your answers stay in this browser and in the page link, so you can share the exact result.
Your result
0 of 12 pointsWhat this means
Levers that change the tier
In our experience, the fastest route to a trusted autonomous agent starts in draft mode. Run it for a few weeks, track how often reviewers change its work, and promote it when that number stays low. Even then, keep a person on the key decisions and cap the automated share around 80%.
Next step
We review agent policies against how the agent is actually built and deployed, then help you close the gaps before go-live.
Field guide
What we tell operations, risk and IT leaders before their first agent goes live.
The same model can power a harmless summarizer and a payment agent. Risk comes from what the agent can do, the data it sees and the cost of a mistake. That is why the tier hangs on the job, not the technology.
Rule of thumbAsk what happens if it is wrong a hundred times before anyone notices.
Start with drafts a person approves. Track the override rate: how often reviewers change the agent's work. When it stays low for several weeks, widen the limits one step. Promotion is a change, so it goes through change control.
Rule of thumbStart one step lower than the team asks for.
New tools, new data or a new model can move an agent up a tier overnight. Tie the policy to the agent's configuration, and make "does this change the tier?" a standard question in every change request.
Rule of thumbIf the permissions matrix changes, the policy review is due.
We build custom assessments, skills and internal apps as part of our engagements. Tell us what you need.