Write the agent's work as a list of actions, then give each action its own depth. For every capability, the process owner sets a cap from how reversible the action is, tests on your own cases show what the agent has earned, and the lower applies. The result is a signed matrix.
What is depth, and who assigns it?
Depth is how far an agent may act, and each capability needs one: 1 read, 2 draft for a person to send, 3 execute routine work within bounds, 4 move money or take actions that are hard to undo, 5 coordinate other agents. The idea is explained in depth: what it means for AI agents.
The process owner assigns it. They are accountable for the outcomes of the work, so they decide how much of it a machine may finish without them. Risk challenges the caps, and whoever runs certification supplies the evidence. If no one is clearly accountable for the agent, settle that first; see how to assign an owner to every AI agent.
What are the steps?
- Person, process owner: lists capabilities as verbs on objects. "Read arrears balance", "draft arrears letter", "send arrears letter", "agree payment plan within limits", "waive a late fee". If two actions have different consequences, they are two capabilities.
- Agent, depth 1: proposes missing capabilities. Given the brief and a sample of past cases, it lists actions the work seemed to need that are not on the list. The owner accepts or rejects each one.
- Person, process owner: sets a cap per capability. Ask what happens if the action is wrong. Reading is depth 1. Anything a customer sees first should usually be drafted at depth 2. Routine, reversible updates can go to 3. Money and hard-to-undo actions are 4 at most, and many firms keep them at 2.
- Person, risk: challenges the caps. Especially where a "routine" action touches a vulnerable customer or a regulated communication.
- Agent, depth 1: is tested capability by capability against your past cases, and certified to one depth from the results.
- Person, process owner: records the earned depth, the one depth the agent is certified to, against each capability.
- Person, process owner: signs the matrix with the lower of cap and earned depth in the final column.
- Agent, at the assigned depths: works, and anything above a capability's depth is held or refused.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| List capabilities | Nothing | none | Defining each action |
| Find gaps | Suggests missing actions from past cases | 1 | Accepting or rejecting them |
| Set caps | Nothing | none | Judging consequence and reversibility |
| Challenge | Nothing | none | Lowering caps where needed |
| Test | Answers past cases per capability | 1 | Choosing the cases |
| Record earned depth | Nothing | none | Reading the results |
| Sign | Nothing | none | Final depth in each row |
| Operate | Acts within assigned depths | as assigned | Approving held actions |
What does a finished matrix look like?
Take a collections agent at a consumer lender, earned depth 3, as an illustration. Reading balances and contact history: cap 1, final 1. Drafting arrears letters: cap 2, final 2. Sending the standard first reminder: cap 3, final 3. Agreeing a payment plan within the customer's limit: cap 2, final 2, because testing showed weak handling of customers who mentioned hardship. Waiving a fee of up to 50: cap 4, final 3.
One agent, one earned depth, five capabilities, three different final depths. That is why depth is certified per agent and needed per action. The earned depth alone would have let it agree plans the testing showed it handled weakly. The capability and depth matrix template for an AI agent gives the columns to copy.
Which controls matter, and what evidence do they leave?
One row per consequence. Splitting "draft" from "send" is the most useful single decision. Evidence: the capability list, versioned.
Caps written with a reason. "Cap 2: letter is a regulated communication" tells the next reviewer why. Evidence: a reason column in the matrix.
Earned depth from your own cases. Evidence: the agent's certificate and its test results, linked from the matrix.
Enforcement at the moment of action. The matrix is a document until something checks every action against it. Evidence: verdicts showing which capability and depth applied, and the bound that decided.
Expiry. The earned column lapses with the certificate. Evidence: a review date on the matrix.
What should you measure?
- Held actions per capability, which shows where depth 2 creates the most work for people.
- Rejected held actions per capability. A high count suggests the depth is right and the agent is not ready for more.
- Refusals by capability, which point to capabilities missing from the list.
- Time since each row was last tested.
Where does it usually go wrong?
Capabilities are too broad. "Handle collections" as one row hides a money action inside a reading action. Break it down until each row has one consequence.
Depth is set in a meeting, not from evidence. People pick numbers that feel right. Keep the cap column for judgement and the earned column for test results, and use the lower.
New actions arrive informally. Someone connects a new tool, and the agent gains an action that has no row. Any new tool should mean a new row and a new test.
Depth only goes up. The matrix is reviewed when someone wants more autonomy, never when results slip. Review on a schedule and after incidents.
Where Pryme fits
In Pryme, depth is earned, not configured: Attest sets the agent's earned depth against your own cases, and no plan limits it. A run that clears no depth drops the agent to depth 1 the same day. The wider frame is in agent governance is a bound, not a model.
Questions people ask
Can two agents doing the same job have different depths?
Yes. Depth reflects evidence from a specific agent on specific cases. Two agents with different briefs or sources can earn different depths for the same job, and each matrix should say so.
Should a capability ever be set at depth 0?
Not as a depth. If an action should never happen, remove it from the agent's role scope so it is refused, rather than listing it at a depth that suggests it might one day be allowed.
How often should the matrix be reviewed?
At least whenever the certificate is renewed, and after any incident, new tool, new product or change in the rules the work follows. Each review should leave a dated, signed version.