# AI Agent Permission Matrix: Who May Read, Propose and Execute

This AI agent permission matrix is an open CSV showing what 33 reference agents on a customer data platform (CDP) may read, propose and execute, who approves, who owns each one and what it must never do. Use it as a starting draft for your own access matrix. It is a vendor-neutral method, not a list of product features.

**Who this is for:** security engineers, data protection officers and marketing-operations leads. Download [agent-permission-matrix.csv](https://privycdp.org/tools/agent-permission-matrix.csv). The matrix summarises the [AI agent rails](https://privycdp.org/ai/rails) method; each row has a fuller card in the [rail card template](https://privycdp.org/tools/agent-rail-card) set. More assets: [tools hub](https://privycdp.org/tools).

## What does the permission matrix show?

The permission matrix shows that execute rights are rare in this reference design, and that most agents need no customer records at all. The counts below come from the CSV. They describe our design, not what the market does.

| Measure | Rows of 33 |
|---|---|
| Hold no execute tool | 24 |
| May execute, bounded by approval, a written rule, routing only or non-production use | 9 |
| Read aggregates or metadata only | 21 |
| Read masked, pseudonymised, by-reference or narrowly scoped data | 10 |
| Read identifiable records within a tight scope | 2 |

The two rows with identifiable records are the [DSAR Assembler](https://privycdp.org/ai/rails/agents/dsar-assembler), limited to one verified subject, and the [CRM Hygiene Fixer](https://privycdp.org/ai/rails/agents/crm-hygiene-fixer), limited to scoped CRM fields.

## How was the matrix built?

The matrix is a reference design written from one source file, the agent roster, so it is not a survey of deployed systems. We built it in four steps.

1. **Define the jobs.** We listed 30 function jobs across eight functions, plus three cross-cutting agents.
2. **Apply the design rules.** Rules enforce and models explain. Enforcement sits outside the prompt. The approver is never the requester. Each session passes the Agents Rule of Two, under which it should hold at most two of untrusted input, sensitive data and the ability to change state or communicate externally [1](#source-1).
3. **Assign a level to each job,** using the [rail levels](https://privycdp.org/ai/rails/rail-levels-autonomy-ladder). Levels belong to a job, not to an agent or a company.
4. **Generate the CSV from the roster.** The `reads_customer_records` column is our plain-language summary of each agent's data scope. The [roster](https://privycdp.org/ai/rails/agents) and the [JSON dataset](https://privycdp.org/tools/agent-roster.json) hold the full wording.

Limits appear in words, because each team sets its own values. We review the matrix twice a year and whenever the roster changes.

## Column definitions

The CSV has 12 columns and one row per agent, and every value is plain text.

| Column | Meaning |
|---|---|
| `agent` | The job name of the agent, used across the AI agent rails section |
| `function` | The team that owns the job, or "Cross-cutting" for the three agents that span teams |
| `typical_level` | The rail level for the job, from L0 Off to L4 Act within bounds |
| `risk` | Our judgement of harm from an error on this job: low, medium or high |
| `reads_customer_records` | Whether the session sees customer records, and in what form |
| `may_read` | What the agent may read, in words |
| `may_propose` | What it may draft; nothing changes until a person acts |
| `may_execute` | The action it may run, if any |
| `approver_or_gate` | Who decides, or the written rule that stands in for a decision |
| `owner` | The accountable role |
| `never` | What the rail excludes, even if someone asks |
| `profile_url` | The relative URL of the agent's profile page |

## How do you read the matrix?

Read each row of the matrix as one sentence: this agent, at this level, may read this, propose this and execute this, past this gate, under this owner. A few values need explaining.

- **`None.` under `may_execute`** means the rail holds no execute tool. "None; a separate service delivers the report." means delivery runs in another service, not as a tool the model holds.
- **"L2 to L3"** is a range across parts of one job: triage at L2, a format-only fix at L3.
- **"L1, L4 pause"** means the agent reads and explains at L1, and takes one bounded action at L4.
- **"L4 on routing only"** applies to the [Orchestrator](https://privycdp.org/ai/rails/orchestrator-agent), which starts runs and broadcasts a pause but never reads a customer record.
- **The [Trainer](https://privycdp.org/ai/rails/trainer-agent)** is the one row at L2 alone with an execute value, because it runs tests in non-production only.

Three rows rule out ranking or reporting on named staff: the [Lead Routing Proposer](https://privycdp.org/ai/rails/agents/lead-routing-proposer), the Trainer and the [VP Marketing agent](https://privycdp.org/ai/rails/vp-marketing-agent). EU AI Act Annex III point 4(b) lists monitoring workers' performance and allocating tasks by individual behaviour as high-risk uses [2](#source-2). Take advice before adapting those rows.

## How does the matrix map to a RACI chart?

The permission matrix maps to a RACI chart with one firm rule: an agent can be responsible for a task, but only a person can be accountable for it.

| RACI role | Matrix column | Note |
|---|---|---|
| Responsible | `agent`, within `may_propose` and `may_execute` | The agent does the work inside its scope |
| Accountable | `owner` | Always a named role, never a team or an agent |
| Consulted | `approver_or_gate` | This is a decision right, so treat it as stronger than consultation |
| Informed | Not in the CSV | Add a column for who receives alerts and readouts |

## Preview of the data

This preview shows 10 of the 33 rows and six of the 12 columns, with values exactly as they appear in the CSV.

| agent | typical_level | risk | reads_customer_records | may_execute | approver_or_gate |
|---|---|---|---|---|---|
| [Segment Drafter](https://privycdp.org/ai/rails/agents/segment-drafter) | L2 | medium | Pseudonymised IDs only | None. | Marketing-operations reviewer, never the requester; approval binds to the definition hash. |
| [Reporting Summariser](https://privycdp.org/ai/rails/agents/reporting-summariser) | L1 | low | No, aggregates or metadata only | None; a separate service delivers the report. | The owner reviews each report at first, then samples. |
| [Anomaly Watcher](https://privycdp.org/ai/rails/agents/anomaly-watcher) | L1, L4 pause | medium | No, aggregates or metadata only | Pause one send under a written rule. | The pause rule is approved in advance; only a person resumes a send. |
| [Audience Sync Steward](https://privycdp.org/ai/rails/agents/audience-sync-steward) | L3 | high | No, aggregates or metadata only | Start one approved sync through the execution service. | Named approver for every sync; a second approver above a size threshold. |
| [Consent Conflict Reviewer](https://privycdp.org/ai/rails/agents/consent-conflict-reviewer) | L2, L4 for hold only | high | Pseudonymised samples where a case needs them | Raise a hold on a launch. | A compliance reviewer clears holds and accepts fixes. |
| [Data Quality Triager](https://privycdp.org/ai/rails/agents/data-quality-triager) | L2 to L3 | medium | Masked samples | Apply an approved format-only fix. | Data steward approves each fix batch. |
| DSAR Assembler | L2 | high | Yes, one verified subject in scope | None. | A privacy analyst signs off every pack and decides exemptions. |
| [Sync Medic](https://privycdp.org/ai/rails/agents/sync-medic) | L3 to L4 | medium | No, aggregates or metadata only | Retry the same approved sync version with idempotency and a fresh consent check. | No new approval for a bounded retry of the same approved hash; the platform on-call approves any other change. |
| Orchestrator | L4 on routing only | medium | No, aggregates or metadata only | Start a run; notify; expire a request; broadcast a pause. | None on routing; changes to the routing table go through change control. |
| VP Marketing agent | L1 to L2 | medium | No, aggregates or metadata only | None; a separate service delivers the readout. | The VP reads it; nothing leaves without a person. |

> **Diagram:** A grid with 33 rows and three columns headed read, propose and execute. Filled cells show where an agent holds a verb. The execute column is mostly empty, and its nine filled cells are labelled with the gate that bounds them.

## How to cite the matrix

Citing the permission matrix takes one line, and reuse follows the site's [dataset reuse terms](https://privycdp.org/dataset-licence).

> **Cite as:** iAge / PrivyCDP, "AI Agent Permission Matrix", privycdp.org/tools/agent-permission-matrix (accessed {date}). Data: agent-permission-matrix.csv. Terms: privycdp.org/dataset-licence.
>
> **Short form:** "In the PrivyCDP reference matrix, 24 of 33 agents hold no execute tool."
>
> **Reuse:** credit iAge / PrivyCDP, link to this page and to the terms, and identify your changes. Do not imply that iAge endorses your use [3](#source-3).

## How to adapt the matrix

Adapting the matrix means replacing our words with the names of your own systems and people, one row at a time.

1. **Delete the jobs you do not run.** Add a row only after writing its rail card.
2. **Replace the verbs with real tools.** Rewrite `may_read`, `may_propose` and `may_execute` as tool names from your own allow-list. Our words are not API calls.
3. **Use your own roles.** Put your titles in `owner` and `approver_or_gate`, then check that no approver can also be the requester.
4. **Add the columns you need.** Useful ones are data class, masking level, consent filter, limit values and the session's Rule of Two properties.
5. **Recheck each level.** Start below `typical_level` if the evidence is missing. The JSON dataset lists a `max_level` for each agent.
6. **Name the enforcing system.** For each cell, say which data view, allow-list, approval service or execution service holds the limit. A row that no system enforces is a wish.
7. **Version it, and compare it with the ledger.** The matrix states what should happen, and the ledger shows what did.

The [7 things AI agents should never do](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data) make a good test for your `never` column, and the [boundary architecture patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary) help with placement.

By Art Kukharenko
Published: 2026-11-02
Updated: 2026-11-02

## FAQ

### What is an AI agent permission matrix?

An AI agent permission matrix is a table listing, for each agent, what it may read, propose and execute, who approves, and who owns it. It gives security and privacy teams one view of agent access. This one covers 33 reference jobs on customer data, and you should adapt it to your own systems before relying on it.

### Can I load this matrix into a gateway as an access-control list?

No. The values are words, not tool names or policy rules, so no gateway can enforce them as written. Treat the matrix as the agreed intent. Then write the real allow-lists, data views and approval rules for your systems, and test that those systems refuse anything the matrix does not allow.

### Why do so few agents hold execute permissions?

Execute rights carry the most risk, and most useful work needs only reading or drafting. An agent that explains or proposes can be wrong without changing anything, and a person catches the error. Separate services can deliver reports or run approved actions. So we add an execute tool only where a job truly needs one.

### Does PrivyCDP include these 33 agents?

No. The matrix is a vendor-neutral method, and PrivyCDP does not ship these agents. The product uses AI to help review groups, workflows, unusual events and reports, with limits on data access and review of results. See the [customer data platform page](https://privycdp.org/cdp) for what it does.

### Can I reuse this dataset in my own work?

Yes. The site's dataset reuse terms allow copying, sharing and adapting the compilation, including commercial reuse, as long as you credit iAge / PrivyCDP, link to the dataset page and the terms, and identify your changes. Do not imply endorsement, or present a modified version as an official source [3](#source-3).

## Sources

1. Meta, Agents Rule of Two (31 October 2025): https://ai.meta.com/blog/practical-ai-agent-security/
2. EU AI Act, Annex III: https://artificialintelligenceact.eu/annex/3/
3. PrivyCDP dataset reuse terms: https://privycdp.org/dataset-licence

To turn one row into a working spec, [download the rail card template](https://privycdp.org/tools/agent-rail-card). The [AI agent rails](https://privycdp.org/ai/rails) hub explains how the rows fit together.

This article is general information, not legal advice.

## Further reading

- [AI Agent Rails: An Operating Model for Running Agents on Customer Data](https://privycdp.org/ai/rails)
- [AI Agent Rail Card Template: YAML, Spreadsheet and JSON Schema](https://privycdp.org/tools/agent-rail-card)
- [Customer data platform tools and templates](https://privycdp.org/tools)
- [7 Things AI Agents Should Never Do With Customer Data (and How to Enforce It)](https://privycdp.org/ai/7-things-ai-agents-should-never-do-with-customer-data)
- [Running AI Agents on Customer Data Without Leaving Your Boundary: Architecture Patterns](https://privycdp.org/ai/ai-agents-on-customer-data-inside-your-boundary)