A compliance team's approver authority matrix names who signs off each output an AI agent prepares for the second line: customer communications, regulatory returns, breach assessments, policy exceptions and consent to raise another team's agent depth. In compliance the agent reads and drafts; every judgement that commits the firm to a regulator or a customer stays with a named officer.
What does compliance approve when agents are involved?
Two kinds of thing. The first is compliance's own work, which agents increasingly help prepare: reviewing marketing material against rules, drafting regulatory returns from source data, assessing whether an incident is a reportable breach, and keeping registers current. The second is approval of other teams' agents: many firms require compliance to consent before an agent's depth rises on any capability that touches customers.
Both kinds need a clear line. An agent can compare a draft promotion against the firm's rules at depth 1 and propose amendments at depth 2. It cannot decide that a promotion is fair, clear and not misleading; a compliance officer does that and answers for it. In the UK, the Senior Managers and Certification Regime adds named individual accountability; other markets have their own versions. The matrix makes the name explicit for each action. The concept is the same as any authority matrix; the content is compliance's.
How do you fill it in?
Complete these fields for each action:
- Action: what is being approved.
- Agent's part and depth: what the agent prepares, and at which depth.
- First approver: role and scope.
- Second approver: when a second person is required.
- Certificate required: what the approver must hold, if the firm links approval rights to certification.
- Evidence filed: what the record must contain for the approval to be reconstructable.
The template
| Action | Agent's part and depth | First approver | Second approver when | Certificate required | Evidence filed |
|---|---|---|---|---|---|
| Customer communication review | |||||
| Financial promotion sign-off | |||||
| Regulatory return submission | |||||
| Breach assessment | |||||
| Notification to a regulator | |||||
| Policy exception | |||||
| Consent to raise an agent's depth | |||||
| Register updates |
A worked example
A hypothetical consumer finance firm's compliance team: four compliance officers, a senior compliance manager and a head of compliance.
| Action | Agent's part | First approver | Second approver when | Certificate | Evidence filed |
|---|---|---|---|---|---|
| Customer communication | Compares to rules, proposes edits (2) | Compliance officer | Product launch, senior manager | Operator | Rule references for each edit |
| Financial promotion | Compares and drafts comments (2) | Senior compliance manager | Always, head of compliance | Operator | Final version and sign-off note |
| Regulatory return | Assembles from sealed sources (2) | Compliance officer | Always, senior manager | Operator | Source for each figure |
| Breach assessment | Drafts facts and options (2) | Senior compliance manager | Always, head of compliance | Operator | Facts, assessment, decision |
| Notification to regulator | Drafts (2) | Head of compliance | Always, chief executive | Architect | Final text and timing |
| Policy exception | Summarises request (1) | Senior compliance manager | Above one month, head | Operator | Reason and expiry |
| Raise agent depth | Summarises certification evidence (1) | Senior compliance manager | Depth 4, head of compliance | Builder | Certification result reviewed |
| Register updates | Updates within template (3) | Compliance officer | None | Foundations | Change log |
The regulatory return row specifies sealed sources. Figures in a return should come from the firm's own systems of record, not from a spreadsheet emailed by another team, which is external data. The compliance officer's check is that every figure traces to a sealed source.
Consent to raise an agent's depth carries a Builder certificate requirement because the approver must read a certification result and judge whether the evidence supports the request. A depth 4 increase, where the agent would move money, goes to the head of compliance as well.
Register updates are the only depth 3 action: adding entries within a fixed template, reversible and sampled weekly.
Other teams' approval matrices meet compliance at several points: the approver authority matrix for the IT team covers access changes compliance may need to consent to, and the approver authority matrix for the payroll team covers payments compliance samples. The detailed thresholds belong in the approver rule for the compliance team. Officers who want external evidence of their review skills can use Pryme Intelligence Academy's certificates, which anyone can check at source by number or QR code. Each role's skills are mapped in AI agent skills by role.
Questions people ask
Should compliance approve every agent action?
No. Compliance approves its own outputs and consents to changes in risk, such as depth increases. Day-to-day held actions belong to first-line reviewers; compliance samples them.
Can the agent submit a regulatory return?
It can assemble one. Submission should be held for people, because it is a formal statement by the firm and is hard to correct once filed.
Why require a higher certificate for notifications?
A notification to a regulator commits the firm's position on an incident. The approver needs to understand the whole deployment, which is what an Architect-level credential evidences.