AI Agent Permission Matrix: Who May Read, Propose and Execute

Who this is for: security engineers, data protection officers and marketing-operations leads. Download agent-permission-matrix.csv. The matrix summarises the AI agent rails method; each row has a fuller card in the rail card template set. More assets: tools hub.

What does the permission matrix show?

The permission matrix shows that execute rights are rare in this reference design, and that most agents need no customer records at all. The counts below come from the CSV. They describe our design, not what the market does.

The two rows with identifiable records are the DSAR Assembler, limited to one verified subject, and the CRM Hygiene Fixer, limited to scoped CRM fields.

How was the matrix built?

The matrix is a reference design written from one source file, the agent roster, so it is not a survey of deployed systems. We built it in four steps.

1. Define the jobs. We listed 30 function jobs across eight functions, plus three cross-cutting agents.
2. Apply the design rules. Rules enforce and models explain. Enforcement sits outside the prompt. The approver is never the requester. Each session passes the Agents Rule of Two, under which it should hold at most two of untrusted input, sensitive data and the ability to change state or communicate externally 1.
3. Assign a level to each job, using the rail levels. Levels belong to a job, not to an agent or a company.
4. Generate the CSV from the roster. The reads_customer_records column is our plain-language summary of each agent's data scope. The roster and the JSON dataset hold the full wording.

Limits appear in words, because each team sets its own values. We review the matrix twice a year and whenever the roster changes.

Column definitions

The CSV has 12 columns and one row per agent, and every value is plain text.

How do you read the matrix?

Read each row of the matrix as one sentence: this agent, at this level, may read this, propose this and execute this, past this gate, under this owner. A few values need explaining.

• None. under may_execute means the rail holds no execute tool. "None; a separate service delivers the report." means delivery runs in another service, not as a tool the model holds.
• "L2 to L3" is a range across parts of one job: triage at L2, a format-only fix at L3.
• "L1, L4 pause" means the agent reads and explains at L1, and takes one bounded action at L4.
• "L4 on routing only" applies to the Orchestrator, which starts runs and broadcasts a pause but never reads a customer record.
• The Trainer is the one row at L2 alone with an execute value, because it runs tests in non-production only.

Three rows rule out ranking or reporting on named staff: the Lead Routing Proposer, the Trainer and the VP Marketing agent. EU AI Act Annex III point 4(b) lists monitoring workers' performance and allocating tasks by individual behaviour as high-risk uses 2. Take advice before adapting those rows.

How does the matrix map to a RACI chart?

The permission matrix maps to a RACI chart with one firm rule: an agent can be responsible for a task, but only a person can be accountable for it.

Preview of the data

This preview shows 10 of the 33 rows and six of the 12 columns, with values exactly as they appear in the CSV.

How to cite the matrix

Citing the permission matrix takes one line, and reuse follows the site's dataset reuse terms.

How to adapt the matrix

Adapting the matrix means replacing our words with the names of your own systems and people, one row at a time.

1. Delete the jobs you do not run. Add a row only after writing its rail card.
2. Replace the verbs with real tools. Rewrite may_read, may_propose and may_execute as tool names from your own allow-list. Our words are not API calls.
3. Use your own roles. Put your titles in owner and approver_or_gate, then check that no approver can also be the requester.
4. Add the columns you need. Useful ones are data class, masking level, consent filter, limit values and the session's Rule of Two properties.
5. Recheck each level. Start below typical_level if the evidence is missing. The JSON dataset lists a max_level for each agent.
6. Name the enforcing system. For each cell, say which data view, allow-list, approval service or execution service holds the limit. A row that no system enforces is a wish.
7. Version it, and compare it with the ledger. The matrix states what should happen, and the ledger shows what did.

The 7 things AI agents should never do make a good test for your never column, and the boundary architecture patterns help with placement.