IT approves what an AI agent can reach, never how far it may act. An IT team's approver authority matrix names who approves each access change: new system connections, new data sources and their provenance class, credential rotation, releases, emergency stops and restarts. Depth comes from certification evidence, within the role's ceiling.
What does IT approve, and what does it not?
IT controls access. It decides whether an agent can connect to the general ledger, whether a shared mailbox becomes a source, which credentials the agent uses, and how quickly it can be stopped. Each of those changes can widen or narrow the agent's reach, so each needs an approver.
What IT does not approve is the agent's authority. Depth is earned, not configured: the role sets a ceiling, evidence from certification sets the depth, and the lower wins. A request to IT to "let the agent post journals" is really a request for a new capability at a new depth, and it belongs to the agent's owner and the certification process. IT's part is the connection, approved on the principle of least access. The agent approver for business actions is a different person from the IT approver for access changes, and the matrix should show both. For the general concept, see what an authority matrix is.
How do you fill it in?
- List every kind of change IT makes for agents.
- Name the approver and the person who must also agree from the business side.
- State the access principle the approver checks.
- Add whether the change can be made as an emergency, and who reviews it afterwards.
- Record the certificate required, if your organisation links approval rights to certification.
The template
| IT change | IT approver | Business agreement from | Principle checked | Emergency route | Review after emergency | Certificate |
|---|---|---|---|---|---|---|
| Connect agent to a system (read) | ||||||
| Connect agent to a system (write) | ||||||
| Register a new source and its provenance class | ||||||
| Rotate or revoke agent credentials | ||||||
| Release a change to the agent's tools | ||||||
| Emergency stop | ||||||
| Restart after a stop | ||||||
| Grant access to the agent's record |
A worked example
A hypothetical insurer's IT team supporting six agents. Roles are illustrative.
| Change | IT approver | Business agreement | Principle checked | Emergency route | Review after | Certificate |
|---|---|---|---|---|---|---|
| Read connection | IT administrator | Agent owner | Only the data the role needs | No | n/a | Foundations |
| Write connection | Integration lead | Agent owner and risk | Write access matches a certified capability | No | n/a | Builder |
| New source and class | Integration lead | Agent owner | Class reflects true origin; external stays external | No | n/a | Builder |
| Rotate or revoke credentials | Security engineer | Informed: owner | Revocation tested | Yes, any security engineer | Next working day | Foundations |
| Tool change release | Integration lead | Agent owner | Change does not widen scope without certification | No | n/a | Builder |
| Emergency stop | Any of: IT administrator, security, owner | None in advance | Stop confirmed in the record | Yes | Within one day, owner and risk | Foundations |
| Restart | Integration lead | Agent owner | Cause understood and fixed | No | n/a | Builder |
| Record access | IT administrator | Data protection lead | Purpose stated, read-only | No | n/a | Foundations |
Write connections need risk's agreement as well as the owner's. A write connection is where an agent's reach turns into the ability to change things, and it should exist only when a certified capability needs it.
Registering a new source carries a Builder certificate requirement because the approver decides its provenance class. A shared inbox registered as signed rather than external would let forged emails carry weight they should never have.
Emergency stop is deliberately easy: any of three roles may do it, with no prior approval. Restart is deliberately harder: only the integration lead, with the owner, once the cause is understood. Stopping is cheap; restarting a faulty agent is not.
Business-side approvals sit in team matrices such as the approver authority matrix for the operations team and the approver authority matrix for the onboarding team, which rely on IT having registered their sources correctly. IT staff can practise these changes in Pryme Intelligence Academy's labs, which run in a free Build workspace. The wider skills map is AI agent skills by role.
Questions people ask
Can IT raise an agent's depth?
No. IT can grant a connection, but the agent's depth comes from certification evidence and the role's ceiling. A connection without certified depth does not let the agent act.
Who should be able to stop an agent?
Several people across IT, security and the business, at any hour. Stops should be easy and logged; restarts should need understanding and approval.
What happens to the record when credentials are rotated?
Nothing. The record is append-only and independent of the agent's credentials. Every verdict before and after rotation remains available for reconstruction.