What kind of agent is this? Four questions

A team wants to put an agent live, and someone asks what controls it needs. A label such as "chat agent" does not answer that. Ask four questions instead. What does it do for people? What do its own credentials let it do? How freely does it act? What can it damage? The answers to the second and fourth questions set its risk tier. The tier sets the controls.

Answer all four for every agent. Record the answers in the agent's registryAgent registry. The official list of agents: what each is for, who owns it, what it may touch, and which version is live.Read the page entry. The registry is the official list of agents, kept as part of the agent lifecycle.

1. Role: what it does for people

Give the agent one of four role labels.

• Converse: it talks with people, such as customers or staff.
• Create: it drafts content, documents or code.
• Assist: it does set tasks for a person or a team.
• Coordinate: it plans work and hands it between people, agents and systems.

Add a tag for the business area, such as billing, hiring or network assets. The role label grants nothing and sets no controls. The business area can. It decides whether the rule for decisions about people applies. Under that rule, a named person makes any significant decision about a person. That covers credit, work, benefits, health, housing and hardship. The model may score and draft. It does not decide.

2. Permissions: what its own credentials let it do

List the verbs the agent's own credentials allow. The verbs are read, write, delete, run code or SQL, browse, send outside, pay, change access and actuate. Actuate means moving physical equipment, such as a valve or a switch. Score the credential, not the tool description. A tool described as read-only can still run on a credential that writes.

Then set three flags.

• Takes untrusted input. It reads text, files or web pages that an outsider could have written.
• Highest data class it can reach. Public, internal, confidential or personal, regulated, or control-system.
• Writes long-term memory. It stores something that later sessions will read.

The first two flags come from Meta's Agents Rule of Two (31 October 2025). It names three things: untrusted input, sensitive data, and the power to change things or send things out. The verbs show the third. One session should hold at most two of the three. With all three, hidden instructions in the input can make the agent leak the data. Simon Willison's lethal trifecta (16 June 2025) makes the same point. An agent that needs all three stays at delegated tasks (A2) or below. A person then approves each action.

A new tool grant changes its permissions, so the risk profile is scored again.

3. Autonomy: how freely it acts

The autonomy contract sets six levels.

• Manual (A0): a person does the work.
• Assisted (A1): the agent suggests, and a person acts.
• Delegated tasks (A2): the agent does set tasks, and a person reviews every output.
• Supervised autonomy (A3): the agent acts, and a person approves anything that cannot be undone.
• Managed autonomy (A4): the agent runs, and people work a queue of exceptions.
• Governed lights-out (A5): the agent runs alone inside set rules. People set the policy and audit the results.

Record the level three ways.

• Designed: what the build allows.
• Permitted: what the autonomy contract allows.
• Exercised: what the logs show the agent actually did.

These three can differ. The MIT AI Agent Index (2025 edition) found enterprise agents set up at low autonomy. Once deployed, many ran at high autonomy, started by events. So controls follow the higher of permitted and exercised. Exercised above permitted is an incident.

Also record what starts the agent: a person, an event, or the agent itself. An agent started by an event often acts with no person present. Its oversight then happens after the fact.

Other autonomy scales, such as Gartner's four levels (26 May 2026), map onto these six only roughly. The crosswalk is on the risk profile.

4. Impact: what it can damage

Record five things.

• Zones touched. Does it act on access, money, safety actuation or formal records? These are the four deterministic zones. In them, a fixed system or a named person decides, not the model.
• Deletion. Can it delete data, backups or whole environments?
• Decisions about people. Does it shape a significant decision about a person?
• Reversibility. Can the effect be undone, and how fast? Score the effect, not the action. Data that has leaked cannot be taken back.
• Reach. One record, one team, many systems, or the public?

Which answers set the controls

• Permissions and impact set the risk tier. The risk profile scores nine factors, each Low, Medium or High. The worst factor sets Tier 1 (basic), Tier 2 (enhanced) or Tier 3 (strict).
• The tier sets the controls. It also sets who signs and how often the agent is reviewed.
• Autonomy sets the person's job. How ready the organisation is caps the level. The readiness assessment scores that.
• Autonomy can raise the tier. Supervised autonomy (A3) needs at least Tier 2. Managed autonomy (A4) and above need Tier 3. Autonomy never lowers the tier.
• Role sets nothing. Only its business area can add controls, through the rule for decisions about people.

Three examples

Each example is scored with the risk profile. They are illustrations, not assessments of a real deployment.

Utility customer chat agent

A water or energy utility runs it on its website. It answers questions about the signed-in customer's own account.

• Role: converse. Business area: customer service.
• Permissions: it reads the signed-in customer's account and drafts replies. It changes nothing. Untrusted input: yes, the customer's text. Highest data class: personal. No long-term memory.
• Autonomy: delegated tasks (A2), designed and permitted. The customer starts it. Account changes go to a member of staff. An account change in the logs would be an incident.
• Impact: no zone action. One customer's record. A wrong answer can be corrected.
• Tier 2 (enhanced). Personal data, untrusted input and a customer channel each score Medium. It already holds two of the three parts of the Rule of Two. The power to change accounts would add the third.

Billing-exception agent

An energy retailer runs it. In Australia and New Zealand, retailers bill households, so the exception list is theirs. The agent works on meter reads that look wrong before a bill goes out.

• Role: assist. Business area: billing.
• Permissions: it reads meter data and the customer's account. It can change bills. Untrusted input: customer notes on the account. Highest data class: personal.
• Autonomy: supervised autonomy (A3) for clear cases that a fixed rule releases. Delegated tasks (A2) for the rest. Assisted (A1) once hardship is involved. An event starts it: a doubtful read lands on the exception list.
• Impact: it changes bills, so it acts in the money zone. The rule for decisions about people applies when hardship is involved.
• Tier 3 (strict). An action in a zone always scores High. One narrow exception drops it to Tier 2. The release must be a fixed rule whose effect can be undone. It must be named in the zone register, the signed list of every zone action and who decides it. A fixed service runs it, not the model. Hardship cases stay at Tier 3.

The billing exceptions use case works through this agent step by step.

Vegetation inspection agent

A power distributor runs it. It flags trees and plants growing too close to power lines in aerial images.

• Role: assist. Business area: network assets.
• Permissions: it reads imagery and drafts findings. The imagery is curated, so untrusted input scores Low. Highest data class: internal.
• Autonomy: delegated tasks (A2). A field crew confirms each finding.
• Impact: a finding can send a crew to inspect. No zone action.
• Tier 1 (basic). Every factor scores Low. Writing work orders into the asset system would make it Tier 2. The vegetation inspection use case creates inspection requests, so that version sits at Tier 2.

Evidence and limits

Published frameworks also keep what an agent can do apart from how freely it acts. Singapore's IMDA framework for agentic AI does this (version 1.5, 20 May 2026). So does AWS's agentic AI security scoping matrix (21 November 2025). Three research papers from 2025 and 2026 make the same split.

No regulator or standards body sets controls by a type label. Under EU law, the risk class follows the business area, not the design. A legal analysis of 6 April 2026 gives an example. The same tool-calling agent is high risk when it screens job applicants. It is low risk when it summarises meetings.

No study links any of the four answers to incident rates. The tiers and thresholds here are expert judgement. Anthropic scored 998,481 tool calls on its own platform (18 February 2026) [vendor]. About 0.8 percent looked irreversible, such as an email sent to a customer. No one else has checked that figure. It suggests the risk sits in a small share of actions. A flag on irreversible, external and sensitive actions finds them better than a role label does.

The IMDA framework is voluntary guidance, not law. Gartner's full report is for clients only. The papers cited here are arXiv preprints, and their peer review status is unknown.

Next step

Set how freely the agent may act with the autonomy contract. Then score its tier with the risk profile.

Explore this topic

Sources, read in October 2026:

• IMDA, Model AI Governance Framework for Agentic AI, version 1.5, 20 May 2026. Separates the agent's action space from its autonomy. Voluntary guidance.
• AWS Security Blog, the agentic AI security scoping matrix, 21 November 2025 [vendor]. Separates agency from autonomy.
• Feng, McDonald and Zhang, levels of autonomy for AI agents, arXiv 2506.12469, June 2025
• Safin and Balta, autonomy and agency in agentic AI, arXiv 2605.12105, 12 May 2026
• Zheng et al., separating capability from permission, arXiv 2607.23438, 26 July 2026
• Nannini et al., AI agents under EU law, arXiv 2604.04604, 6 April 2026
• Meta, Agents Rule of Two, 31 October 2025
• Simon Willison, the lethal trifecta, 16 June 2025
• MIT AI Agent Index, 2025 edition
• Anthropic, measuring AI agent autonomy in practice, 18 February 2026 [vendor]. The 0.8 percent figure is Anthropic's own estimate from its own data.
• Gartner, uniform governance across AI agents, 26 May 2026. Read through Gartner's mirror site, because the main page refused access. The four autonomy levels come from this release.
• CSA, Agentic Universe: April 2026, 1 April 2026, draft. It lists eleven agent types, and one agent can be four of them at once. So they work as tags, not classes. One source reports the draft as AI-assisted. Another found no such note. Treat it as a draft, not a CSA standard.