Give the agent a permission matrix, not a pep talk.
A warm, careful system prompt won't stop an agent from changing a record it should only have read. Write down what it may read, suggest and change, who signs off on the risky step, and what the audit trail has to show.
Before an agent acts, define what it may read, suggest, and change; who approves sensitive steps; how escalation works; and what the audit trail must show. Use a matrix, not a personality brief. Expand agency only when the matrix still holds.
A job needs permissions, not a pep talk
Before an agent acts, write down what it may read, what it may suggest, and what it may change. Who approves the sensitive step. How escalation works. What the audit trail must show.
A personality brief will not hold that. A matrix will. Expand what it is allowed to do only when the matrix still holds.
The rows
One row per action, not per mood.
Action. The verb. Read this record. Draft this message. Issue this refund. Change this role.
Data. Which records, and which fields are off limits even for a read.
Mode. Read, draft, or commit. Draft is not commit.
Approval. None, because you have proved the repeat is safe. Or a named role, before the tool runs.
Escalation. Where it goes when the case is outside the row, and how long that person has.
Audit. What is written: who, what, when, and the reason.
If a row says commit and the approval cell is blank, the row is not done. If the data cell says "whatever it needs," you have not drawn a boundary.
How the work moves
From request to permitted result
- Resolve action
Name the verb and object.
- Check matrix row
Data scope, mode, approval.
- Enforce in software
Identity and authority at execution.
- Record audit
Proposal, decision, system result.
Autonomy without a permission matrix is just hope with an API key.
Enforce it in the system that runs the action
A matrix in a document is necessary and not sufficient. The application that executes the action has to check identity, scope, and authority at the moment it runs. Prompt text is not access control.
Practical shape: tools expose narrow operations. Admin capabilities are not the default path. A confirmation shows the proposed change in language a person can refuse. A denied action is logged, not silently retried with a broader tool.
Reading a claim is not confirming it. Drafting a disclosure is not disclosing. Proposing a transfer is not completing one. Put those distinctions in the rows, then in the tool.
Decision guide
Prompt hope vs matrix control
| Consideration | Prompt-only | Matrix-backed |
|---|---|---|
| Authority | Implied by wording. | Named per action. |
| Data scope | Model may retrieve broadly. | Fields and systems listed. |
| Sensitive act | "Be careful" instructions. | Human approval gate. |
| After failure | Chat scroll archaeology. | Audit fields designed up front. |
An audit someone can use
Operators need to answer, after the fact, what the agent was allowed to do and what it did. A log of tokens is not that. A line with the action, the object, the mode, and the approval is.
If you cannot reconstruct a contested action from the trail, the matrix is a policy and the system is something else.
Widen it only with evidence
Add a commit row when the draft row has been boring for a defined window, the disagreements are logged, and the person who accepts the new risk signs it. Enthusiasm is not evidence.
When the matrix and the red lines disagree, the red line wins until someone changes it on purpose.
Put this into practice
List the actions the agent can actually take. Fill the rows. Remove any commit that is not enforced in the executing system.
That product work sits under AI applications and agents.
Related work: Spin Market.
We build alongside the people doing the work.
Bring us the problem you’re thinking about.