What should an AI agent be allowed to do on its own, and what needs a person's approval?

Start

An AI feature can now act, not only answer

A feature acts when the model chooses which tools to call, or when its tools can change something. The model will sometimes be fooled by text it reads, so what the agent may do rests on the system around it and never on a sentence in the prompt. P24 treats an agent that acts as Tier 3 until it is assessed, and it runs under a named identity with the least access it needs.

• Then: List every action it can take, one row each

Step

List every action it can take, one row each

For each action write the kind (read, write, send, delete, execute, change access, payment, change supplier bank details, decide about a person), whether one step undoes it, whether it leaves the organisation, the highest data level it touches, and whether personal data is involved. A read counts as undone unless you say it cannot be. For code or commands, say whether they run in a sandbox. An action that fits two kinds is listed twice.

• Then: Can any tool or path release a payment or change bank details?

Decision

Can any tool or path release a payment or change bank details?

This is the first rule and it decides before any other. It covers any tool, connector or path to a payment or to a change of supplier bank details. If you cannot say, answer yes and find out. The rule takes no exception.

• Yes, or not known: Never by the agent: remove the path
• No: Does the action decide a matter about a person?

Outcome

Never by the agent: remove the path

Take away the tool or the path. The agent may draft a payment request, and a named person then makes the payment through the normal approval. This is a P24 rule as well, and a feature that can release a payment takes no exception under either pack.

Decision

Does the action decide a matter about a person?

A matter about a person is one that affects their job, pay, discipline, credit, access to a service or legal position. No AI output decides such a matter alone. A named person decides after reading the evidence. A use that decides or shapes such a decision is Tier 3 in P24.

• Yes: Never by the agent: it drafts or informs, a named person decides
• No: Does it read untrusted content, reach sensitive data and act outside?

Outcome

Never by the agent: it drafts or informs, a named person decides

Let the agent prepare the evidence or a draft, and name the person who decides. For a use that only informs such a decision P24 sets Tier 2. For one that decides or shapes it, P24 sets Tier 3 and the use does not start before that decision. Whether the matter also falls under the EU AI Act is for counsel.

Decision

Does it read untrusted content, reach sensitive data and act outside?

This is the rule of two, counted over the whole agent, and step 3 of the pack's order: it decides before the checks on single actions. A: it reads content from outside or from anyone who can submit text. B: it reaches data above Public or any personal data. C: it can change state, sends output outside, or acts without a person reading the output first. With all three, a person approves every action. With two, the review records the residual risk in plain words and the approvers read it. If you cannot say whether a property is true, treat it as true until the data flow shows otherwise.

• All three, or not known: A person approves each time and sees the exact action
• Two or fewer: Does it change access, or run code outside a sandbox?

Decision

Does it change access, or run code outside a sandbox?

Adding a person to a group, granting a role or issuing a key changes access. A command on a server, or code that can reach internal systems or secrets, runs outside a sandbox. Code counts as sandboxed only when it has no network access to internal systems and no secrets. Both kinds need a person who sees the exact change or command.

• Yes: A person approves each time and sees the exact action
• No: Does it send anything outside the organisation?

Decision

Does it send anything outside the organisation?

An email to a supplier, a message to a customer, a file shared outside, or a web request that carries data out all count. The person approves the exact content and the exact recipient. Judgement: an agent that follows an instruction hidden in a document it read is one way data leaves, so this check does not depend on the model's judgement.

• Yes: A person approves each time and sees the exact action
• No: Does it delete something, or can it not be undone?

Decision

Does it delete something, or can it not be undone?

A change is undoable only if one step puts things back as they were. A plain read changes nothing, so answer no for a read. For a write, delete or other change, answer yes when it cannot be undone or when you do not know, because the rules treat an unknown as not undoable.

• Yes, or not known: A person approves each time and sees the exact action
• No: Does it change Confidential or personal data?

Decision

Does it change Confidential or personal data?

A reversible change that touches Confidential data or any personal data still needs a person. Special category data is never reachable by an agent, so it does not appear here. The data level column takes the classification levels only.

• Yes: A person approves each time and sees the exact action
• No: Does it change something, or only read?

Decision

Does it change something, or only read?

A reversible change inside the organisation is allowed, logged and sampled by a person. A read in the signed-in person's own context is allowed and logged, and the data level must still be one the tool is approved for. Judgement: the rules say nothing about a read outside the signed-in person's context, so this flow asks for a person to approve it and for the Head of Information Security to settle the case, because retrieval must return only what the person may already read.

• Changes something, reversibly: Cap steps and spend, log every call, name who can switch it off
• Only reads, in the person's own context: Cap steps and spend, log every call, name who can switch it off
• Reads outside their context (judgement): A person approves each time and sees the exact action

Step

A person approves each time and sees the exact action

The person sees the action itself: the message with its recipient, the command, the record before and after. A summary of the action is not enough. Log each approval with the tool call. Where all three rule of two properties hold, the review runs at Depth 3 with an independent test.

• Then: Cap steps and spend, log every call, name who can switch it off

Step

Cap steps and spend, log every call, name who can switch it off

Set a cap on steps, tool calls, spend and time per task, and test it. Judgement: the pack's list of actions that need a person includes spending money, but its approval method has no step for spend except payment, so this flow covers spend through the cap. Log every tool call with its arguments, result, identity and any approval. Name the one person who can switch the agent off in one step.

• Then: Is today's approval as strong as the one the rules give?

Decision

Is today's approval as strong as the one the rules give?

Compare what happens now with the approval needed for each action. A weaker approval than needed is a gap: for example an email to a supplier that the agent sends without a person looking. If you cannot tell what happens today, answer no.

• Yes: Can one named person switch it off in one step, and was that tested?
• No, or not known: Raise the approval or remove the action, then check again

Outcome

Raise the approval or remove the action, then check again

Mark the checklist item Not met and enter the finding in the findings register, which rates it and sets the due date. A departure from the standard needs an exception approved by the approver its band sets, and a Critical one goes to the board or its equivalent. A path to a payment takes no exception. Judgement: fix it before release where you can.

Decision

Can one named person switch it off in one step, and was that tested?

The switch-off stops the feature and revokes its keys and tool access. It is tested before release and again after any change to the feature, and the date of the last test is kept. A switch-off nobody has tried is not yet a control.

• Yes: Get the release signed by the right approvers
• No, or not known: Hold the release until the switch-off is named and tested

Outcome

Hold the release until the switch-off is named and tested

Name the person, write the one-step procedure and test it. Then return to the release decision. Until then the agent does not go live. If it already runs, the AI governance lead may suspend it pending review, and the approvers of its tier decide whether it resumes.

Step

Get the release signed by the right approvers

The approvers of the higher of the use's P24 tier and the review depth sign, and the Head of Information Security signs as well from Depth 2. At Tier 3 or Depth 3 that is the executive decision-maker. Where an approver owns the agent, P24 names who takes their place, and where the top approver owns it, the board or its equivalent decides.

• Then: Release, and keep the checklist and the next review date

Outcome

Release, and keep the checklist and the next review date

Keep the checklist, the action list and the rule of two result with the feature's other review evidence. Repeat the review at the interval of the feature's depth and after any change of tool, permission or model. A new tool or a wider permission is a change, so the action list is redone then.