Several parties, each deciding a different layer, and never the agent. The process owner proposes what it should do. Risk and compliance approve the limits. Evidence from testing on your own cases decides how far it may act. Policy and the platform floor set what nobody changes case by case. Where these disagree, the lower answer wins.
Why can't one person decide?
Because each party sees a different part of the risk. The process owner knows the work and wants it done. Risk knows what can go wrong and how badly. The evidence shows what the agent actually does on real cases, which neither of them can know in advance. A decision made by any one of them alone tends to be too wide, too narrow, or untested.
The agent itself is excluded for a simple reason: whoever acts cannot be whoever grants the authority to act. The vendor is excluded for a related one: it does not bear the consequences in your operation.
Who decides which layer?
| Layer | Who decides | What they decide |
|---|---|---|
| Platform floor | The platform | Actions withheld for every agent everywhere |
| Organisation policy | Board and accountable executive | What no agent here may do; who approves agents |
| Process limits | Process owner, approved by risk | Amounts, volumes, hand-over rules, customer tiers |
| Data access | Data owner, with privacy and security | Which data the agent may see and use |
| Depth | Evidence from certification, approved by risk | How far the agent may act |
| Case decisions | Named people with authority | Exceptions and held actions, one at a time |
Data access is often overlooked as a separate decision. What an agent may see is not the same as what it may do, and seeing more than it needs is a risk of its own; see how to decide which data an AI agent may see.
Why should evidence, not opinion, set the depth?
Because opinion is optimistic in both directions. Sponsors overrate an agent they championed; sceptics underrate one that works well. Testing the agent on several hundred past cases from your own operation, and scoring each answer, settles the question with something both can inspect.
That is why depth is earned, not configured. People set the ceiling and the limits. The evidence sets the depth. Then the lowest of them applies at the moment of action.
What does this look like in practice?
Take a consumer lender that wants its agent to agree repayment plans with customers in arrears. The head of collections proposes that the agent agree any plan up to twelve months. Risk proposes six months, and only for customers with no vulnerability flag.
Testing on past cases shows the agent handles plans up to three months well when no income evidence is needed. On longer plans that depend on reading payslips and bank statements, its proposals often differ from what experienced officers agreed.
The result: the agent may agree plans of up to three months without income evidence at depth 3, within risk's limits. Longer plans are drafted at depth 2 for an officer to agree. Customers with a vulnerability flag go to a specialist at every length. Each party's decision is recorded, and the outcome is narrower than any one of them proposed, because the lowest answer wins. The vocabulary behind those outcomes is explained in allowed, held, refused, withheld.
How is this recorded?
Each layer leaves its own record: the policy and its approval minute; the process limits with risk's sign-off; the data access decision; the certification result per agent; and each case decision with a name. When a verdict is filed, it names which layer decided, so you can trace any action back to the people and evidence that allowed it.
Enforcement has to sit at the moment of action, not in a document. How that works is covered in how to control what an AI agent is allowed to do.
Where Pryme fits
In Pryme, the layers map to the minimum chain: role scope, certificate, sources, the business's own limits and the platform guardrails, checked together at every action. Attest sets the depth from your own cases, and no plan limits it. More in what "allowed" means for AI agents, the short list of what an agent should never be allowed to do, and our guide to agent governance.
Questions people ask
What if the process owner and risk cannot agree?
The accountable executive decides, and records why. Until then, the narrower proposal applies.
Should frontline staff have a say?
Yes, as input. They know where the hard cases are, which makes them the best source of test cases and hand-over triggers.
How often should these decisions be revisited?
At each recertification, after any incident, and when the process changes. Depth can rise or fall with the evidence.