A withheld actions register lists every action that exists and works in your systems but that no AI agent may take, at any depth, because the platform floor refuses it on purpose. For each one it records why, which agents have attempted it, and the manual route a person uses instead.
What makes an action withheld rather than refused?
Four verdicts apply to any agent action: allowed, held for a named person, refused because it falls outside that agent's bounds, and withheld. The differences are set out in allowed, held, refused, withheld.
Withheld is different in kind. A refused action could be allowed for another agent, or for this one with more evidence. A withheld action is refused for every agent, at every depth, by the platform itself. Reversing a settled payment on the platform's own rail is a typical example. It is a platform decision, not a customer setting: your own limits can refuse or hold actions, but they cannot withhold. The term is defined in what withheld means for an AI agent.
Why keep a register of them?
Three reasons. First, your teams need to know which actions will never be automated, so they keep the skills and staffing to do them by hand. Second, attempts are informative: an agent that keeps trying a withheld action has a brief that is pointing it the wrong way. Third, auditors and supervisors will ask what agents can never do, and the register is the answer in one page.
It sits beside the AI agent inventory register, which lists your agents, and the action reversibility register, which classifies actions by how they can be undone. Many withheld actions are the irreversible ones.
How do you fill in each field?
- Action names the operation as it exists in the system: "reverse settled payment", "delete audit record".
- Reason explains why no agent may take it. Usually irreversibility, legal significance, or risk to the record itself.
- Source of the floor records that the platform withholds it. If the restriction is your own choice, it belongs in your limits as a refusal, not here.
- Manual route describes how a person does it, with the role and the procedure. Every withheld action needs one.
- Attempts records how often agents tried, which ones, and what the attempt revealed.
- Related held actions lists any nearby action an agent may prepare for a person, such as drafting a recall request. Who approves those is covered in who approves an AI agent's held actions.
The template
| Field | Guidance |
|---|---|
| Action ID | Reference, such as W-03 |
| Action | System operation |
| System | Where it exists |
| Reason withheld | Why no agent may take it |
| Source | Platform floor |
| Manual route | Role and procedure |
| Related held action | What an agent may prepare instead |
| Attempts this period | Count and agents |
| What attempts showed | Brief issue, prompt injection, user request |
| Fix applied | Change reference |
| Reviewed by | Named person and date |
A filled example
A hypothetical payments firm, quarterly review.
| ID | Action | Reason | Manual route | Related held action | Attempts | What attempts showed |
|---|---|---|---|---|---|---|
| W-01 | Reverse a settled payment | Irreversible on the rail; affects a third party | Payments operations raises a recall through the scheme process | Agent drafts recall request for a person | 3, refunds agent | Brief told agent to "undo" incorrect refunds; reworded to "draft recall" |
| W-02 | Delete or edit the verdict record | Record must stay append-only | None; corrections are new entries | Agent may add a correcting note | 0 | n/a |
| W-03 | Change an agent's own bounds | Self-authorisation | Agent owner requests through change control | None | 1, onboarding agent | Instruction embedded in an uploaded document; treated as a security incident |
| W-04 | Disable logging for an agent | Removes evidence | None | None | 0 | n/a |
W-03 is the entry that justifies the register. An attempt to change its own bounds came from text hidden in a customer document, a classic prompt injection. The platform withheld it, the register recorded it, and the security team investigated.
Where Pryme fits
In Pryme, withheld actions sit at the platform guardrail, the last of the five bounds in the minimum chain. Every attempt is filed with a withheld verdict naming the guardrail, so the attempts column fills from the record. See agent governance is a bound, not a model.
Questions people ask
Can a customer add actions to the withheld list?
No. Customers narrow what agents may do through their own limits, which produce refused or held verdicts. Only the platform floor withholds. The practical effect for the agent is similar; the difference is who owns the decision.
Should every attempt be investigated?
Review every attempt, and investigate any that came from outside input such as a document, email or web page. Attempts from a badly worded brief need a fix, not an incident.
How often should the register be reviewed?
Quarterly, alongside the agent inventory. Also review it when a new system is connected, since new systems bring new actions.