A three lines of defence matrix for AI agents sets out what the business that runs the agent, risk and compliance, and internal audit each own, do and evidence at every stage of an agent's life. It stops agents falling between the lines, where the business assumes risk checked and risk assumes the business did.
Where do agents fit in the three lines?
The model is explained in what the three lines of defence are. Agents sit in the first line. They do first-line work, under first-line ownership, and the first line answers for their outcomes. That is often misunderstood: technology teams build agents, but technology does not own the risk of what a claims agent decides.
The second line of defence sets the framework the agent works within, challenges whether the first line's controls work, and sets the ceilings. Internal audit gives independent assurance that both lines are doing their jobs.
When should you use it?
When setting up agent governance for the first time, and as part of approving each new type of agent. Review it annually, or when a line's responsibilities change. It should be read alongside two other matrices: the RACI matrix for AI agent oversight, which goes down to individual activities, and the delegation of authority matrix for AI agents, which shows whose authority each agent uses.
How do you fill in each field?
- Stage follows the agent's life: design, testing and certification, go-live, operation, change, incidents, retirement.
- Owns is the outcome the line answers for at that stage.
- Does lists concrete tasks, not "oversees".
- Evidence names the record each line leaves. If a line leaves no record at a stage, ask whether it is really involved.
- Independence check confirms the second line is not doing first-line work. A common slip is the second line running certification tests and then approving the results.
The template
| Stage | First line: owns / does / evidence | Second line: owns / does / evidence | Third line: owns / does / evidence |
|---|---|---|---|
| Design | |||
| Testing and certification | |||
| Go-live approval | |||
| Operation | |||
| Change | |||
| Incidents and suspension | |||
| Periodic review | |||
| Retirement |
A filled sample
A hypothetical bank's lending operations agents.
| Stage | First line (lending operations) | Second line (operational and model risk) | Third line (internal audit) |
|---|---|---|---|
| Design | Owns the role charter and capability list; evidence: signed charter | Sets depth ceilings per action class; evidence: risk appetite statement | Not involved |
| Testing and certification | Supplies real cases, runs certification; evidence: the agent's test report | Sets the pass floor, reviews results, challenges gaps; evidence: challenge log | Tests whether certification method is sound, annually; evidence: audit report |
| Go-live approval | Requests approval, accepts residual risk; evidence: go-live checklist | Gives independent opinion; evidence: risk opinion memo | Not involved |
| Operation | Reviews held items daily, approves within delegated authority; evidence: held item records | Monitors key risk indicators monthly; evidence: risk report | Samples decisions to check bounds held; evidence: audit workpapers |
| Change | Proposes and tests changes; evidence: change log | Approves changes that raise depth or add connections; evidence: approval record | Reviews change control design |
| Incidents and suspension | Suspends, investigates, fixes; evidence: incident report | Challenges root cause, decides on regulatory reporting with compliance; evidence: incident review | Reviews significant incidents |
| Periodic review | Re-certifies before expiry; evidence: renewed certificate | Reviews inventory and appetite; evidence: annual review paper | Plans audit of agent governance |
| Retirement | Retires agent, keeps records; evidence: decommissioning checklist | Confirms records retained | Not involved |
Look at the testing row. The first line runs the tests on its own cases; the second line sets the floor and challenges the result. If the second line ran the tests, it would be marking its own work.
Where Pryme fits
Pryme gives each line its own evidence without extra work. The first line sees held items and its agents' certificates. The second line can read every filed verdict and which bound decided it. Internal audit can reconstruct any decision from the append-only record. See agent governance is a bound, not a model.
Questions people ask
Should the technology team be first or second line?
For agent risk, technology teams that build and run agents are part of the first line, alongside the business owner. They do not provide independent challenge, so they cannot act as the second line.
Does internal audit need specialist skills to audit agents?
Some, but less than people assume. Auditors test whether bounds were set, evidenced and enforced, and whether records allow reconstruction. Those are familiar control questions applied to a new kind of actor.
What if we only have two lines?
Smaller firms often combine second-line functions or outsource internal audit. Record the arrangement in the matrix and show how independence is maintained, for example through an external review.