IT administrators who support AI agents need two things most training skips: an understanding of what the agent is allowed to do and why, and practice at the administrative actions that change it, such as connections, access, roles and suspension. This plan sets a learning route, hands-on labs, a certifying assessment, internal sign-off and renewal.
What is this plan for?
An IT administrator rarely decides an agent's held actions, but they control the plumbing those decisions run on. They connect the agent to systems of record, which decides whether a source arrives sealed or as something weaker. They manage which people hold which roles in the workspace, and so who can approve what. They suspend an agent during an incident. Each of these changes what the agent can do without touching its brief.
That gives administrators an outsized effect. A connection set up through an export file rather than the system of record can quietly lower a source's provenance. A role granted to a team mailbox breaks the rule that approvals come from named people. The plan teaches these consequences, not just the clicks. If you are new to the format, what is a study plan? explains it; the first-deployment version is in what is a good AI agent training plan for a first deployment?.
How do you fill it in?
Choose the track first. Administrators who design connections, sources and agent setups take the builder route; those who manage access and day-to-day operations take the operator route. Then fill each numbered field. Field 6, the labs, should be done in a practice workspace, never in production.
The template
- Administrator and systems covered
- Track chosen and why
- Foundation learning: date
- Track learning: modules, hours, dates
- Administrative actions in scope: connections, roles, access, suspension, logs
- Labs: each action practised in a non-production workspace, with date
- Assessment: exam, capstone or practicum, and result
- Rules they enforce: list
- Internal sign-off: IT manager and agent owner
- Rights granted in production
- Certificate and expiry
- Renewal: booked date
A worked example
A hypothetical building society's IT team. Two administrators follow different tracks. Values are samples.
| Field | Administrator A | Administrator B |
|---|---|---|
| 1 | Integration lead: core banking, payments, document store | Service desk lead: workspace access and roles |
| 2 | Builder: designs connections and sources | Operator: manages access and suspension day to day |
| 3 | Foundations, week 1 | Foundations, week 1 |
| 4 | Builder, about 24 hours over six weeks | Operator, about 14 hours over four weeks |
| 5 | Connections, sources, suspension | Roles, access reviews, suspension, logs |
| 6 | Connected a test ledger as a sealed source; tested what happens when it goes offline | Granted and revoked approver roles; suspended a test agent and restored it |
| 7 | Proctored exam; capstone agent certified in Attest to depth 2 | Written exam, 33 of 40; two-week practicum on access requests and held role changes |
| 8 | See rules below | See rules below |
| 9 | IT manager and payments agent owner | IT manager |
| 10 | May add connections in production with agent owner's approval | May grant roles named on the authority matrix; may suspend any agent |
| 11 | Certified Pryme Builder, 12 months | Certified Pryme Operator, 12 months |
| 12 | Month 11 | Month 11 |
Rules they enforce
- Approver roles go to named people on the authority matrix, never to shared accounts.
- A person whose certificate has lapsed loses approver roles on the day, if the business ties approval rights to certificates.
- Sources connect to the system of record wherever one exists; a spreadsheet export is never a substitute for a sealed source.
- Suspension is available to the administrator on shift at all hours, with the reason recorded.
- Withheld actions are a platform decision; no setting re-enables them, and requests to do so are declined.
The lab for Administrator A shows why hands-on practice matters. Taking a sealed source offline made the agent hold every case that needed it, which is correct behaviour but floods the review queue. Having seen it, A now warns the operations team before planned maintenance on connected systems. For a neighbouring administrative role, see the training plan for payroll administrators, and the payroll team's consistency work in calibration sessions for payroll administrators. A contrasting decision-making role is in the training plan for underwriters. The full sequence is in training teams for AI agents.
Where the Academy fits
Pryme Intelligence Academy runs every lab in a free Build workspace, so administrators can connect sources, change roles and suspend agents without touching production. Certified Pryme Builder is earned through a proctored exam and a capstone agent certified in Attest to depth 2 or higher; Operator through an exam and practicum.
Questions people ask
Do IT administrators need to understand depth?
Yes. Every role they grant and every source they connect changes what the decision chain allows. Without the vocabulary, they cannot see the consequences of routine changes.
Should administrators be able to change an agent's depth?
No. Depth comes from certification evidence and the owner's decision within the role's ceiling. Administrators manage access and connections, not authority.
What about outsourced IT?
Hold the provider's administrators to the same plan, and ask for certificate numbers you can check at source before granting them production rights.