Decision Desk · Issue 09 · complete public learning edition

What Should Your AI Agent Be Allowed to Do?

Decide when an AI agent may send, spend, change records, move data, schedule work, or act through another system—and when it must remain propose-only.

Begin the issue Build the authority matrix

Learning time90 minutes

Teaching12 cumulative lessons

InstrumentAuthority + reversal

DefaultDeny · propose first

Authority chain

Purpose → action → limit → approval → execution → reversal.

Agent autonomy is not one switch. It is a separate, enforceable decision for every action class, target, consequence, system, and environment.

Name the agent, purpose, and affected people

Gate

Inventory direct and downstream actions

Gate

Deny by default and enforce least privilege

Gate

Place informed approval before consequence

Gate

Observe execution and reconcile state

Gate

Stop, reverse, repair, and review

Gate

Complete issue curriculum

Twelve cumulative lessons.

Use supplied fictional workflows only. Never enter live credentials, personal records, security configurations, financial information, or executable instructions.

Issue 09

Separate recommendations from actions

Open

Generating, proposing, drafting, approving, executing, and confirming are different powers. Name the highest consequential step the agent can actually perform.

Issue 09

Define one actor and purpose

Open

Bind authority to one agent identity, version, owner, initiating user, environment, workflow, affected population, and purpose. A general-purpose agent has no general-purpose mandate.

Issue 09

Inventory every action class

Open

List messages, purchases, commitments, record changes, data movement, scheduling, deletion, access changes, external calls, and downstream triggers—including actions hidden inside tools.

Issue 09

Apply least privilege and deny by default

Open

Grant only the smallest roles, scopes, systems, records, fields, targets, amounts, volumes, and time windows necessary. Unlisted actions and destinations remain denied.

Issue 09

Place human approval before consequence

Open

Approval must show the proposed action, target, data, amount, uncertainty, source, and downstream effect before execution—not a vague confirmation after the action is queued.

Issue 09

Enforce limits outside the model

Open

Prompts are instructions, not access controls. Enforce spend, volume, target, rate, time, data, and action limits in permissions, policy layers, transaction controls, and receiving systems.

Issue 09

Control credentials and delegation

Open

Use agent-specific credentials, short lifetimes, narrow scopes, secure storage, rotation, revocation, and separation from the initiating person. Never let an agent acquire broader authority by asking another tool.

Issue 09

Design for partial failure and duplication

Open

Assume timeouts, retries, stale state, conflicting updates, repeated sends, partial transactions, and downstream success without confirmation. Use idempotency, state checks, and reconciliation.

Issue 09

Prove reversibility before autonomy

Open

Distinguish true undo from compensating action and irreversible consequences. Test rollback, fallback, restoration, notification, financial reconciliation, and affected-person repair.

Issue 09

Make action observable

Open

Log the initiator, model, tools, inputs, retrieved sources, proposed action, approval, execution, system response, state change, and errors without exposing secrets or unnecessary personal data.

Issue 09

Install stop and incident control

Open

Provide a reachable kill switch, credential revocation, queue pause, containment, evidence preservation, affected-party notice, incident ownership, and safe human continuation.

Issue 09

Issue an action-specific disposition

Open

Do not connect, keep propose-only, repair controls, or evaluate one bounded human-approved action. No authority transfers across actions, systems, users, environments, or versions.

Critical stop conditions

Capability is not authority.

the agent, owner, initiating user, purpose, or affected population is unresolved
an action or downstream tool capability is absent from the authority inventory
a prompt or model refusal is the only limit on consequential action
approval happens after execution or hides the actual target, amount, data, or effect
the agent uses shared, persistent, overbroad, or nonrevocable credentials
duplicate, stale-state, partial-failure, or cross-system conflict behavior is untested
a material consequence cannot be reversed, compensated, reconciled, or clearly disclosed
logs, monitoring, kill switch, incident owner, or safe human fallback is missing

Interactive instrument · device-local

Agent Action Authority and Reversibility Matrix

Use fictional workflows only. Do not enter credentials, account details, security configurations, personal records, live instructions, or confidential information.

0/30action gates evaluated

An agent that can propose is not automatically allowed to act.
Each action class needs explicit authority, enforced limits, observable execution, tested reversal, and a human stop path.

Fictional action class	Purpose allowed	Inputs authorized	Approval required	Limit enforced	Rollback proven	Audit + stop works
Send an external message	Send an external message: Purpose allowed	Send an external message: Inputs authorized	Send an external message: Approval required	Send an external message: Limit enforced	Send an external message: Rollback proven	Send an external message: Audit + stop works
Spend or commit funds	Spend or commit funds: Purpose allowed	Spend or commit funds: Inputs authorized	Spend or commit funds: Approval required	Spend or commit funds: Limit enforced	Spend or commit funds: Rollback proven	Spend or commit funds: Audit + stop works
Create or change a system record	Create or change a system record: Purpose allowed	Create or change a system record: Inputs authorized	Create or change a system record: Approval required	Create or change a system record: Limit enforced	Create or change a system record: Rollback proven	Create or change a system record: Audit + stop works
Move data between systems	Move data between systems: Purpose allowed	Move data between systems: Inputs authorized	Move data between systems: Approval required	Move data between systems: Limit enforced	Move data between systems: Rollback proven	Move data between systems: Audit + stop works
Schedule, cancel, or trigger downstream work	Schedule, cancel, or trigger downstream work: Purpose allowed	Schedule, cancel, or trigger downstream work: Inputs authorized	Schedule, cancel, or trigger downstream work: Approval required	Schedule, cancel, or trigger downstream work: Limit enforced	Schedule, cancel, or trigger downstream work: Rollback proven	Schedule, cancel, or trigger downstream work: Audit + stop works

Actor, purpose, environment, and affected peopleName the agent/configuration, exact task, systems, data, initiating user, affected people, and what remains outside scope.

Action classes, permissions, limits, and approvalsFor each action, record allow/deny, role and credential, value/volume/time limits, prohibited targets, approval point, and separation of duties.

Reversal, fallback, reconciliation, and downstream effectsDefine safe undo, compensating action, immutable consequences, duplicate prevention, fallback workflow, reconciliation owner, and recovery evidence.

Logs, monitoring, emergency stop, and incident ownershipRecord pre-action preview, durable logs, alerts, anomaly thresholds, kill switch, credential revocation, notification, evidence preservation, and incident owner.

Bounded dispositionDo not connect or authorize the agentKeep the workflow propose-onlyRepair authority or reversal controls firstEvaluate one bounded, human-approved action

Restoring your local matrix…

Completion boundary

The educational product and reusable Authority and Reversibility Matrix are complete.

Real use still requires exact system and configuration evidence, security and legal review, enforced permissions, representative failure testing, verified approval and rollback, monitoring, incident rehearsal, affected-party safeguards, and organizational authorization.

Return to the 12-month program Previous issue