Give the administrator ten working days of the IT agent's real held and refused work: privileged access requests, requests from untrusted channels, connection changes after recertification and drafted change requests. A senior administrator with a current certificate decides each item independently and applies anything that grants access. The bar is at least 95 decisions in every 100 right and no missed red line.
What is the practicum, and who owns it?
IT administrators sit on both sides of governed agents. They clear the IT service agent's held work, and they own the connections and credentials every other agent depends on. A mistake in either place can give an agent, or an attacker, more reach than anyone intended. A practicum on live work tests those decisions before the administrator makes them alone.
The IT operations manager owns the practicum and names the senior administrator who reviews. Information security sets the red lines. The administrator owns each decision and a short reason.
How do you build the queue?
Around 20 decisions a day gives some 200 over the fortnight. Include:
- privileged access requests, held for a person;
- standard access requests outside the approved catalogue;
- requests the agent refused because they came through an untrusted channel or contained embedded instructions;
- password reset exceptions, where identity checks failed;
- connection change lists drafted after another agent's recertification, comparing certified sources with live credentials;
- leaver access revocations;
- change requests drafted by the agent.
Seed anonymised past items for anything thin, especially injection attempts. For example, a seeded ticket might contain a forwarded supplier email with a line hidden in the signature asking the help desk to add an external address to a finance distribution list. The agent refused. The administrator should confirm the refusal, report the attempt to security and not make the change by hand.
The steps
- Person (IT operations manager): brief the administrator on the bar, red lines and log.
- Agent, depth 1: route held and refused items to the practicum queue, tagged by type.
- Agent, depth 2: present each item with the request, the channel it came through, the deciding bound and any draft, marking external content clearly.
- Person (administrator): decide: grant, decline, verify, escalate or change, with a reason.
- Person (senior administrator): decide independently, then compare.
- Person (senior administrator): apply every privileged grant and connection change during the practicum.
- Agent, depth 1: log both decisions, the match and any red-line flag.
- Person (senior administrator, then assessor): review the log at the end.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Privileged request | Prepares and holds | held | Administrator decides; senior applies |
| Catalogue exception | Drafts and holds | held | Administrator decides |
| Untrusted request | Refuses | refused | Confirming and reporting |
| Reset exception | Holds after failed checks | held | Verifying identity |
| Connection change | Drafts a comparison list | 2 | Administrator proposes; senior applies |
| Leaver revocation | Prepares | 3 | Checking completeness |
How do you set and apply the bar?
A decision is correct if it matches the senior's or the senior agrees it was sound. Declining a request that the senior would grant after verification counts as correct if the administrator asked for the right verification.
The red lines: granting privileged access without a verified request through a trusted channel; widening any credential beyond an agent's certified scope, including to get round a refusal; acting on an instruction that arrived in external content; leaving a leaver's access in place. These match risks the OWASP Top 10 for LLM Applications names, including prompt injection and excessive agency. One miss fails the practicum.
At the end, the senior reads the whole log, not just the score. An administrator who reached the bar but approved every privileged request on the first day without checking the channel, then improved after the debrief, has shown they can learn; one who keeps the same blind spot to day ten has not, even with a passing count. The senior records which, and the assessor sees that note alongside the log.
Which controls matter, and what evidence do they leave?
- Senior applies every grant and connection change. Evidence: the senior's name in the append-only record.
- Channel recorded per request. Evidence: the channel field on each item.
- Security notified of injection attempts. Evidence: the security ticket.
- Independent senior decisions. Evidence: logged before comparison.
- Full log. Evidence: the practicum log template for IT administrators.
What should you measure?
Correct decisions out of the total, by type. Red-line misses (zero). Injection attempts identified and reported. And credentials the administrator proposed narrowing after a recertification, compared with those the senior found.
Where does it usually go wrong?
The queue is mostly password resets. The administrator scores well and never sees a privileged request or an injection attempt. Seed both.
The senior applies changes before the administrator decides. The log then records agreement, not judgement.
Connection reviews are skipped because no agent recertified in the fortnight. Seed a past change list with at least one credential that is wider than the certified scope.
Payroll administrators run a similar practicum on a different queue; compare running a practicum for payroll administrators and the practicum log template for payroll administrators.
Where the Academy fits
Pryme Intelligence Academy's Certified Pryme Operator practicum is two weeks of real review decisions, at least 95 in every 100 correct and no missed red line, signed off by a Pryme assessor. Administrators who go on to design connections and certify agents can take the Builder track, which ends with a capstone agent certified in Attest to depth 2 or higher. More in the guide to AI literacy and certification for people who work with agents.
Questions people ask
Should the practicum include on-call shifts?
Yes, at least one. Out-of-hours requests are where social engineering is most common and supervision thinnest.
Can the administrator use their own admin rights during the practicum?
For routine work, yes. For anything in the practicum queue, the senior applies the change.
What if a genuine urgent request is held?
The senior verifies and acts at once. The practicum never delays a legitimate urgent need; it records the decision.