A RACI matrix for AI agent oversight assigns, for each oversight activity, who is Responsible for doing it, who is Accountable for it, who is Consulted and who is Informed. Activities include approving deployment, certifying capabilities, reviewing held items, monitoring, handling incidents, suspending and changing the agent. Each activity has exactly one accountable person.
What oversight activities belong in the matrix?
Oversight is the set of things people do to stay in control of an agent, not just watching it. The concept is defined in what human oversight is. Dashboards and logs help, but they are tools for oversight, not oversight itself; see observability is not oversight.
List the activities across the agent's life: design, approval, certification, daily operation, change, incidents, review and retirement. Then assign letters. The usual failure is not a missing R; it is a missing or duplicated A.
When should you use it?
Draft it before go-live, alongside the role charter. Review it when the organisation changes, when a new agent joins a team, and after any incident where people were unsure who should act.
Frameworks expect clear roles for oversight. The NIST AI RMF places accountability structures in its Govern function, and ISO/IEC 42001 expects defined roles and responsibilities. The matrix is the simplest evidence of both. More in NIST AI RMF and human oversight of AI agents and ISO/IEC 42001 human oversight controls for AI agents.
How do you fill in each field?
- List activities as verbs: approve, certify, review, suspend.
- List roles, not people, across the columns: agent owner, named approvers, operations, risk, compliance, data protection, IT, internal audit.
- Assign one A per row. If two people feel accountable, decide; if none, the activity is not happening.
- Assign R to whoever does the work. The agent itself may be R for preparing; it is never A.
- Use C sparingly. Every C slows the activity. Consult only those whose input changes the outcome.
- Check independence. The A for certification should not be the agent owner; the A for audit should not be anyone in the first line.
The template
| Activity | Agent owner | Named approvers | Operations | Risk (2nd line) | Compliance | Data protection | IT | Internal audit |
|---|---|---|---|---|---|---|---|---|
| Approve role charter | ||||||||
| Approve deployment | ||||||||
| Certify capabilities | ||||||||
| Approve held items | ||||||||
| Daily review of held and refused items | ||||||||
| Monitor key risk indicators | ||||||||
| Approve changes to bounds | ||||||||
| Suspend the agent | ||||||||
| Investigate incidents | ||||||||
| Report to board | ||||||||
| Independent assurance | ||||||||
| Retire the agent |
A filled example
A hypothetical insurer's claims intake agent.
| Activity | Agent owner | Approvers | Ops | Risk | Compliance | DP | IT | Audit |
|---|---|---|---|---|---|---|---|---|
| Approve role charter | A | C | R | C | C | |||
| Approve deployment | R | C | C | C | C | C | I | |
| Certify capabilities | I | R | A | C | ||||
| Approve held items | I | A/R | ||||||
| Daily review of held and refused | I | A/R | I | |||||
| Monitor key risk indicators | A | R | C | |||||
| Approve changes to bounds | R | A | C | |||||
| Suspend the agent | A/R | R | R | R | R | |||
| Investigate incidents | A | R | C | C | C | R | I | |
| Report to board | R | A | ||||||
| Independent assurance | I | A/R | ||||||
| Retire the agent | A | R | C | C | R |
Notes on the example: deployment approval sits with the head of claims as accountable executive, recorded separately above the matrix. Risk is accountable for certification and for changes to bounds, which keeps those decisions independent of the owner. Suspension has several Rs on purpose: anyone in those roles may act alone.
The matrix says who does what. For whose authority the agent exercises, use the delegation of authority matrix for AI agents.
Where Pryme fits
Pryme names a person for each held item and files every verdict, so the R and A for approving held work and the daily review leave a record without extra effort. Certification evidence comes from Attest, which keeps that row independent of the agent owner. See agent governance is a bound, not a model.
Questions people ask
Can the agent itself appear in the RACI?
Yes, as R for preparation tasks such as drafting or compiling reports. It should never be A for anything, because accountability needs a person.
How detailed should the activity list be?
Ten to fifteen rows is usually enough. If you need more, split the matrix by phase: build, operate, change.
What if one person holds several roles in a small firm?
Record it and add compensating controls, such as an external reviewer for certification. The matrix should show the overlap rather than hide it.