How an AI agent earns permissions: read, advise, draft, record, execute

The question we hear most often about AI agents is not “how clever is it?” but “what will it do without asking?” It is the right question. An agent that can only read is safe and not very useful. An agent that can do everything is useful until the first mistake that nobody saw coming.

The answer is a ladder of permissions, applied to each thing the agent can do, and climbed slowly.

The five levels

Every capability of an agent sits on one of five levels.

Level	The agent may	Example on an invoice
Read	look at data it has been given access to	open the invoice, the order and the delivery note
Advise	point out a problem or suggest the next step	“two lines on the invoice are not on the order”
Draft	prepare a document or decision for a person	a prepared approval with every source attached
Record	write to the organisation’s own records	mark the invoice as matched in the register
Execute	take an action with effect outside its own records	send the payment to the bank

The higher the level, the stricter the permission, the checks around it and the record it leaves. Reading needs access rights. Executing needs all of that plus a person’s approval for anything that matters.

Permissions belong to capabilities, not to agents

The common mistake is to give an agent one level for everything: it is “allowed to draft” or “allowed to act”. Real work does not split that way.

Take a fictional company, Zarvane Trading Group, and its agent that helps with supplier payments. It does several different things, and each sits on its own level:

• matching an invoice against the order and the delivery — record: it marks the match itself, because the check is mechanical and fully on record;
• checking the supplier is still in good standing — advise: it raises a warning, a person reads it;
• preparing the payment for approval — draft: the finance director sees a ready case and decides;
• sending the payment — not given at all: a person pays.

One agent, four capabilities, four different levels. When the agent proves itself on matching, that capability can move up. The payment capability does not move just because matching went well.

What always stays with a person

Some things never move up the ladder to “execute alone”, however good the record:

• money — approving and making payments;
• law — anything that commits the organisation legally;
• signatures — contracts, official letters, documents signed in the organisation’s name;
• anything sent outside — to a customer, a bank, a regulator or another agency.

Inside the organisation an agent can do a great deal by itself: keep internal records, prepare drafts, set tasks for itself and for colleagues. The line is drawn where the action leaves the building or cannot be undone.

On our platform this is how the work is built, so nobody can switch it off on a busy day: the step that sends money or commits the organisation has a person at it.

How an agent moves up a level

An agent earns a wider permission in the same way a new employee does: by doing the work under supervision until the record shows it can be trusted. In practice that means four conditions.

1. A named owner. Every agent has a person who answers for it. That person, not the agent and not the vendor, decides whether a capability moves up.

2. A record of approved work. The agent works at its current level on real cases. Every draft it prepares is either approved as it is, corrected or rejected, and all three are on record. The owner looks at that record, not at a demonstration.

3. A test on agreed cases. Before a step up, the capability is run on an agreed set of cases with known right answers, including the awkward ones: the duplicate invoice, the supplier who changed owners, the request in the wrong language.

4. A step-by-step rollout. A new level is tried first in a test setting, then on a limited share of real work, then in normal operation. At each stage someone knows how to stop it.

A typical path for one capability looks like this: an agent starts by drafting replies to customer status questions, and a person sends each one. After enough replies were sent without changes, the owner allows it to send standard status updates by itself. Replies on complaints, prices or deadlines still go through a person.

What to write down for every agent

Before an agent works anywhere, it should have a short passport. Ours has six parts:

• Task — whom it helps, at which step, with what result.
• Input — which records and fields it may see, from which sources, and how fresh they must be.
• Output — what it hands over: a warning, a draft, a record, with links to the evidence.
• Permissions — separately for read, advise, draft, record and execute, per capability.
• Human decision — who approves its result, where that is recorded, and what the agent does when it is unsure or rejected.
• Checks — the test cases, the expected results, how its work is observed and how it is stopped.

An agent that is not on the register with such a passport does not work on any process. That one rule removes a whole class of surprises.

Agents may propose rules, not change them

There is one more boundary worth stating. An agent sees a lot of cases and often notices that a rule is outdated: a limit that is always exceeded, a check that never finds anything. It should say so. It should not change the rule.

A new working rule takes effect only after a person with the authority for that kind of decision approves a new version of it. The agent’s observation becomes a proposal on the owner’s desk, with the cases that support it. That keeps the organisation’s rules in people’s hands, and it keeps the decision log honest about who changed what.

Questions to ask any AI vendor

If you are choosing an agent platform, these questions show quickly whether permissions are taken seriously:

1. Can I set a different permission level for each capability of one agent?
2. Who is named as the owner of each agent, and where is that shown?
3. What happens when the agent is unsure — does it stop and hand over, or guess?
4. Which actions can never run without a person, regardless of settings?
5. Can I see the record of approved, corrected and rejected work behind a step up?
6. How do I stop one capability without stopping the whole agent?

If the answers are vague, the agent will be too.

You can see the ladder at work on our trust page, or assemble a team of agents for one of your processes and watch which permissions each of them gets.