A delegation of authority matrix for AI agents records the chain from a person who holds authority to the agent that exercises part of it: which authority, up to what limit, under what conditions, who delegated it, and whether it may be passed on. No agent may hold more authority than its delegator.
Why do agents need a delegation matrix?
Every regulated firm already has a delegated authority framework: the board delegates to executives, executives to managers, with limits at each level. The idea is set out in what delegated authority is. When an agent acts, it is exercising authority that someone in that chain gave it. If the matrix does not show who, the agent's authority floats free of the framework.
That matters for accountability. When an agent agrees a refund, a supervisor will ask whose authority it used. The answer must be a named person whose own delegation covers that amount. It is also why boards should govern agent authority, not agent technology.
When should you use it?
Before an agent gains any capability at depth 3 or above, since those are the depths where it acts without a person approving each item. Update it when the delegating person changes role or leaves: their delegation to the agent ends with their own authority and must be re-granted.
It works alongside two other matrices. The RACI matrix for AI agent oversight says who does what around the agent; the three lines of defence matrix says who checks whom. This one says whose authority the agent is using.
How do you fill in each field?
- Authority is the specific power, worded as in your existing framework: "approve customer refunds", "agree payment arrangements".
- Delegator is the named person whose authority is being used. Their own limit must be recorded alongside.
- Agent limit must be equal to or lower than the delegator's. Usually it is much lower.
- Conditions narrow the authority: only for verified customers, only for listed reasons, only in business hours.
- Sub-delegation says whether the agent may pass the authority to another agent. The default is no. Orchestrating agents that pass tasks on are the main exception, and they need tight rules to avoid authority sprawl.
- Expiry sets an end date, so delegations are re-confirmed rather than left running.
The template
| Field | Guidance |
|---|---|
| Delegation ID | Reference, such as DOA-A-04 |
| Authority | Specific power, from your framework |
| Delegator | Named person and role |
| Delegator's own limit | From the firm's delegation framework |
| Agent | Name and inventory ID |
| Capability and depth | Capability that exercises the authority |
| Agent limit | Equal to or below delegator's limit |
| Conditions | Circumstances in which it may be used |
| Sub-delegation allowed? | No, or to named agents with limits |
| Above-limit route | Who decides beyond the agent's limit |
| Start and expiry | Dates |
| Approved by | Delegator's own line manager or committee |
A filled example
A hypothetical retail bank's servicing agents.
| ID | Authority | Delegator (own limit) | Agent | Depth | Agent limit | Conditions | Sub-delegation | Above-limit route |
|---|---|---|---|---|---|---|---|---|
| DOA-A-01 | Refund bank charges | Head of customer service (5,000) | Servicing agent | 3 | 100 per customer per year | Charge applied in error or first-time goodwill | No | Customer service team lead |
| DOA-A-02 | Agree short payment deferral | Head of collections (12 months) | Collections agent | 2 | Drafts only | No signs of vulnerability | No | Collections specialist |
| DOA-A-03 | Release card from fraud block | Head of fraud operations (all cases) | Fraud triage agent | 3 | Customer confirms transactions via secure channel | Low-risk alert types only | No | Fraud analyst |
| DOA-A-04 | Assign servicing tasks | Head of operations | Orchestrator agent | 5 | Tasks within each receiving agent's own depth | Receiving agent must hold the capability | To listed agents only, never above their own depth | Operations manager |
DOA-A-04 is the important pattern. The orchestrator may hand work to other agents but cannot give them authority they do not already hold. It routes; it does not grant.
If the head of customer service leaves, DOA-A-01 lapses. The new head re-grants it, at their own discretion, with a new start date.
Where Pryme fits
In Pryme, the delegated limit is one of the customer's own limits in the minimum chain, and the lowest bound wins. Depth 5 is reserved for orchestrators, and an orchestrator cannot raise another agent's depth. See agent governance is a bound, not a model.
Questions people ask
Who is accountable when an agent uses delegated authority?
The delegator remains accountable for decisions made under their authority, and the agent's owner is accountable for the agent behaving within bounds. Both should be named.
Can an agent's limit be higher than any one person's?
No. Agents should never hold authority that no person in the chain holds. If a task needs more, a person with that authority approves it.
Does a delegation need board approval?
Only if your framework requires it for that level of authority. Most agent delegations sit well below board level and are approved by the delegator's line manager or a committee.