Approve the agent at one depth, with every capability checked against it. A new AI agent goes into production when a named process owner signs off the agent at a stated depth, backed by evidence from your own cases, with held actions staffed, a suspension route tested and an expiry date set. Anything without that evidence stays in shadow or at depth 1.
What does approval cover, and who owns it?
Production approval is the moment an agent's actions start to have consequences for customers, money or records. Until then it has only read data or produced drafts nobody acted on. The decision is about what the agent may do from Monday, with whom watching, and how quickly it can be stopped.
The process owner, the person accountable for the work the agent will do, makes the decision. Risk challenges it, security checks access, and operations confirms that people are in place to work the holds. IT runs the platform but should not be the approver, for the reasons set out in operations, not IT, should own agents in production.
What are the steps to approval?
- Agent builder, with the process owner: assemble the approval pack. The agent's brief, its role scope, the list of capabilities with the depth each needs, its sources and their provenance, and the customer limits it will run under.
- Agent, depth 1: runs against your own cases. Replay a representative set of past cases from your operation, including the awkward ones. Vendor demonstration cases do not count.
- Person, process owner: reviews the results per capability. A capability that passed sits beside one that did not; the owner approves the agent's depth with both in view.
- Person, risk: challenges the pack. Which actions are hard to undo, which customers could be harmed, and whether the agent needs a lower depth than the evidence supports.
- Person, security: confirms identity and access. The agent has its own identity, its credentials are stored and rotated, and its permissions match the approved capabilities and nothing more.
- Person, operations lead: confirms the held queue is staffed with named approvers and cover for absence.
- Person, process owner: tests suspension. Stop the agent in a test environment and confirm work in progress lands safely.
- Person, process owner: signs the approval with the agent's depth and an expiry date.
- Agent, at the approved depth: starts in a narrow slice, such as one product or one region, with a review date set.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Pack | Nothing | none | Writing the brief and scope |
| Replay | Answers past cases | 1 | Choosing the cases |
| Review | Nothing | none | Judging each capability |
| Challenge | Nothing | none | Setting lower depths where needed |
| Access | Nothing | none | Granting permissions |
| Staffing | Nothing | none | Naming approvers |
| Suspension test | Stops when told | none | Running the test |
| Sign-off | Nothing | none | The approval decision |
| Go-live | Works within the approved depth | as approved | Approving held actions |
Which controls make it safe, and what evidence do they leave?
The depth each action needs. An agent that may draft collection letters at depth 2 may still only read payment arrangements at depth 1. Evidence: a signed capability list with a depth beside each line.
Evidence from your operation. The test cases come from your own history, so the results describe your customers and your edge cases. Evidence: the case set, the answers, and the score for each.
Holds with names on them. Every action that waits for a person names who that person is. Evidence: the approver roster and the hold configuration. Our guide to how to design the hold-and-approve step for an AI agent covers this in detail.
No agent approving another. An agent that checks another agent's work is a second opinion, not an approval. The sign-off and every held action go to a person; see why one agent should not approve another agent's work.
Approval that expires. The approval is tied to the certification date and lapses with it. Evidence: an expiry date on the approval record and a renewal reminder.
What signs show the approval is going wrong?
- The held queue grows faster than people clear it. Approvers start approving in bulk, and holds stop being a control.
- Approvers almost never reject anything. Either the agent is excellent or no one is reading. Sample the approved items.
- Refusals cluster in one capability. The role scope may be too narrow, or the agent is reaching for work it was not approved to do.
- Overrides by staff rise. People are correcting the agent's output after the fact rather than at the hold.
- The scope widened without a new approval. A new product or region was added informally.
What should you measure after go-live?
Measure each capability separately: volume handled, actions held, held actions rejected, refusals and the bound that caused them, corrections after the fact, and time to clear the queue. Review them at the date set in the approval. The broader route from trial to full use is in how do you move an AI agent from pilot to production?
Where does approval usually go wrong?
The pilot is mistaken for proof. A pilot that ran on clean, chosen cases tells you little about the hard ones. Approve on replay results across a realistic mix.
One signature covers everything. An approval of "the agent" with no capability list hides which capabilities were weak. Ask for a capability list every time.
No one plans for failure. The suspension route exists on paper but has never been tried. Read what happens when an AI agent fails in production? before signing.
The approval never ends. Without an expiry, an agent approved for one set of rules keeps acting after the rules or the data have moved on.
Where Pryme fits
In Pryme, Attest replays the agent against your own cases and scores it against seven gates. The depth an agent receives is the lower of its role's ceiling and what the evidence supports, and the certificate lapses after 90 days. Every action meets the minimum chain of five bounds, as set out in agent governance is a bound, not a model.
Questions people ask
Who should sit on the approval panel?
The process owner decides, with risk, security and the operations lead contributing evidence. Keep it small enough to meet quickly. A large committee tends to approve everything at once rather than looking at each capability.
How many past cases are enough for approval?
Enough to include the rare and difficult cases, not only the common ones. A few hundred representative cases, with the awkward ones deliberately included, usually says more than thousands of easy ones.
Can we approve an agent at a lower depth than it earned?
Yes, and often you should for the first weeks. Evidence sets the most an agent may do; the owner can choose less and raise it later once production results agree with the test results.