An authority matrix is a table that sets who may approve which actions, up to what limit, and under what conditions. Each row is a type of decision; each column a role or person; each cell the limit or the rule. With AI agents, the matrix also says what the agent may do alone and what it must hold.
Why does an authority matrix matter with agents?
Agents make authority explicit in a way people often do not. An agent's bounds include the customer's own limits, and those limits usually come straight from the authority matrix. If the matrix is vague, the agent's limits are too, and held actions land with whoever is free rather than whoever is authorised.
It also stops access being mistaken for authority. Being able to see a held item in a workspace does not mean you may approve it. The point is made in reviewers need authority, not just access.
How does it work in practice?
An authority matrix that covers agents adds a few columns to the traditional version:
| Action | Agent may | Held for | Limit | Second approver | Credential required |
|---|---|---|---|---|---|
| Supplier payment, existing supplier | Execute up to customer's limit | Finance officer | Up to a set amount | Above that amount | Current reviewer certificate |
| Supplier payment, new supplier | Draft only | Finance manager | Any amount | Always | Current reviewer certificate |
| Credit note | Draft only | Team lead | Up to a set amount | No | Current reviewer certificate |
Each row tells the agent what it may do, tells the platform where to send held actions, and tells auditors who should have approved. Worked versions exist for a procurement team and a lending team.
What is an example?
A manufacturer's procurement agent drafts purchase orders. The authority matrix says the agent may raise orders under a set value with approved suppliers, buyers may approve up to a higher value, and the procurement manager approves above that or for any new supplier. One afternoon the agent drafts an order with a new supplier at a modest value. It is held for the procurement manager, not a buyer, because the matrix routes new suppliers to her regardless of amount. She checks the supplier record and approves. The matrix did the routing; she did the judging.
How is an authority matrix different from a RACI matrix and a training matrix?
A RACI matrix shows who is responsible, accountable, consulted and informed for each activity. It describes involvement, not limits; it does not say who may approve a payment of a given size. A training matrix shows which training each role needs and who has completed it. The three work together: the authority matrix says who may approve, the training matrix shows whether they are trained to, and the RACI shows who else is involved.
Which terms are related?
- Agent approver: the person named in the matrix.
- Second approver: the extra sign-off for high-risk actions.
- Customer's own limits: one of the five bounds every agent action meets.
For the wider topic, read AI agent skills by role.
Questions people ask
How often should the authority matrix change?
Whenever roles, limits or agent capabilities change, and at a regular review otherwise. Any change should be approved and recorded, because the agent's limits follow it.
Can an agent appear as an approver in the matrix?
No. An agent may act within its limits, which the matrix sets, but held actions are approved by named people.