IT teams supporting AI agents need skills that sit between infrastructure and governance: connecting agents to systems without widening what they may do, assigning the right provenance to each source, responding when an agent misbehaves, and understanding that depth is earned through evidence, never switched on in a settings screen. This matrix sets those skills by IT role.
Why is the IT matrix different from the business matrices?
Because IT controls the plumbing, and the plumbing can quietly change an agent's reach. Give an agent a connection with write access when it needs read, and its role scope may still hold it back, but the risk has moved from one control to fewer. Add a new data source without stating its provenance class, and an emailed spreadsheet may sit beside the general ledger as if they were equal.
IT does not decide what depth an agent holds. The role sets a ceiling, Attest sets the depth from evidence, and the lower wins. What IT does decide is which systems an agent can reach, under which credentials, and how fast it can be stopped. Those are the skills in this matrix. It complements the business-side view in AI agent skills by role and the method in how to build a skills matrix for an AI agent team.
How do you fill it in?
- List the IT roles that touch agents. Typically a service desk analyst, an IT administrator, a security engineer and an integration or platform lead.
- For each skill, enter a target level: 0 not needed, 1 understands, 2 performs unaided, 3 owns the process and trains others.
- Add the evidence that proves the level, such as a completed drill or a reviewed change.
- Cross-check against your RACI matrix, so the person accountable for a step has level 3 in the matching skill.
The template
| Skill | Service desk | IT administrator | Security engineer | Integration lead | Evidence |
|---|---|---|---|---|---|
| Explains depth, verdicts and why depth is earned | |||||
| Grants connections at the least access the role needs | |||||
| Assigns a provenance class to each new source | |||||
| Rotates and revokes agent credentials | |||||
| Recognises prompt injection and excessive agency | |||||
| Stops an agent and confirms it has stopped | |||||
| Explains the effect of a certificate lapse on users | |||||
| Pulls a decision from the record for an investigation | |||||
| Handles access requests for the agent's record |
A worked example
Consider a hypothetical building society's IT function supporting three agents in servicing, payments and complaints.
| Skill | Service desk | IT admin | Security | Integration lead | Evidence |
|---|---|---|---|---|---|
| Explains depth and verdicts | 1 | 2 | 2 | 3 | Foundations test |
| Least-access connections | 0 | 2 | 2 | 3 | Peer-reviewed change |
| Assigns provenance class | 0 | 1 | 2 | 3 | Source register review |
| Rotates and revokes credentials | 0 | 2 | 3 | 2 | Quarterly drill |
| Recognises prompt injection | 1 | 2 | 3 | 2 | Scenario exercise |
| Stops an agent | 1 | 2 | 3 | 3 | Timed drill |
| Explains a lapse to users | 2 | 2 | 1 | 2 | Ticket sample |
| Pulls a decision from the record | 0 | 2 | 3 | 2 | Walkthrough |
| Record access requests | 1 | 2 | 2 | 1 | Procedure sign-off |
The service desk is at level 2 on explaining a lapse, higher than security. That is because when the payments agent's certificate lapses after 90 days, users see work that was automatic yesterday arriving as held items, and the first call goes to the desk. A desk analyst who logs it as an outage sends the wrong people chasing the wrong fault.
The integration lead holds level 3 on provenance. When the complaints agent was given access to a shared mailbox, the lead registered it as external, so nothing arriving there could authorise an action. Had it been registered as signed, a forged email could have carried weight it should never have had. That single decision is why the skill sits with one accountable person.
Security owns prompt injection and credentials at level 3, which matches the OWASP Top 10 for LLM Applications, where prompt injection and excessive agency both appear. The risk team's view of the same controls is in the AI agent competency matrix for the risk team.
Where the Academy fits
Pryme Intelligence Academy runs every lab in a free Build workspace, so IT staff can practise connecting sources, setting provenance and stopping an agent without touching production. Foundations covers level 1 across the team. Integration leads who also design agents can take the Builder track, which ends with a capstone agent certified to depth 2 or higher.
Questions people ask
Can IT raise an agent's depth if the business asks?
No. Depth comes from certification evidence, capped by the role's ceiling. IT can widen a connection, but the agent's role scope and certificate still decide what it may do. A request to "turn up" an agent should go to its owner and the builder.
Who should be able to stop an agent?
More than one person, in more than one team, at any hour. The IT administrator and security engineer should both be able to stop it and confirm it stopped, and the agent's owner should be told at once.
How is this different from the operations team's matrix?
The operations team's competency matrix covers running the work: queues, held items and the daily rhythm. IT's covers the systems the work runs on.