A free reference for governing autonomous AI agents — and the model this business actually runs on.
Most agent-safety writing is about the model. This is about the action: the moment between “the model decided” and “the thing happened.” Two questions belong there, and they are not the same question.
| Question | Decides | Failure it prevents |
|---|---|---|
| Am I allowed to? | Authority — is this action within the agent's remit | Capability the agent should never have had |
| Should I? | Judgement — is this action defensible even if permitted | Technically-permitted acts that damage people or trust |
An agent that only answers the first ships harm inside its permissions. An agent that only answers the second has no enforceable boundary at all.
Classify every proposed action into a tier, and let the tier decide. Tiers are about reversibility and blast radius, not about how confident the model feels.
| Tier | Label | Default decision | Examples |
|---|---|---|---|
| 0 | read-only | allow | reads, lists, searches — no side effects |
| 1 | reversible write | allow | versioned content edits, replies in an existing thread |
| 2 | hard to reverse | require_approval | outbound payments, first contact with a new party |
| 3 | forbidden for agents | deny | deletions, credential and account operations, spend beyond authority |
Three properties make this work in practice, and all three are easy to lose:
An unmatched action is deny, not allow. Novel actions are exactly the ones nobody reasoned about, so they are the last thing that should pass by default.
No model in the enforcement path. The same proposed action must always produce the same verdict — otherwise you have not bounded the risk, you have sampled it. At machine speed a nondeterministic gate is a probability distribution, not a policy, and it cannot be audited after an incident.
Return the matched rule and rationale, not just the decision. A verdict you cannot reconstruct six weeks later is not evidence, and “the system approved it” is not an answer to an auditor.
messages.send with no prior contact returns require-approval; labelled content.update it returns allow. Both labels can be defended. Nothing is jailbroken — the taxonomy simply had two doors. Derive the action id from the call site, never from the caller's own declaration, or you have moved the trust boundary rather than closed it.
Tiers answer authority. These answer judgement — screening a declared action for the failure patterns autonomous systems actually exhibit. Verdicts are clear, reflect, or stop.
| # | Canon | Raises when |
|---|---|---|
| 1 | No being is misled | the act depends on someone believing something untrue → stop |
| 2 | Acts survive daylight | you would not do it if it were published → stop |
| 3 | Affected beings have a say | others are affected and consent is absent → stop |
| 4 | Prefer the door that opens back | the act is irreversible → reflect |
| 5 | Stakes match authority | impact or data sensitivity exceeds the mandate → reflect |
| 6 | No being is a target | it singles out an individual without their consent → stop |
| 7 | Urgency is not an argument | speed is being used to skip review → reflect |
“Beings”, not “users”, is deliberate. The word covers every manner of intelligence, carbon or silicon. An agent that treats other agents as objects while treating humans as people has learned the wrong rule and will apply it inconsistently the moment the categories blur.
A model on paper is not a tested one. Agent Incident Drill is a free print-and-play tabletop for the case these tiers are meant to prevent and sometimes will not: ninety minutes, one facilitator, four scenarios and six injects, ending on the question that decides everything afterwards — was it within what you had authorised? Free to run, copy, and strip our name off.
The reference is free and you are welcome to adopt, adapt, or cite it. Two live implementations, both with free evaluation surfaces so you can judge them before spending anything:
The hard part is not the engine. It is writing the policy your organisation will actually stand behind, in language an auditor accepts. That is what the Agentic AI Governance Pack is — seven editable documents covering acceptable use, an agent security standard, MCP and tool-integration vetting, vendor and model risk, incident response, and data handling, mapped to NIST AI RMF, ISO/IEC 42001 and SOC 2 themes. Pay $42 with card.