Specialist review
Specialist review only. Use this page when the topic is concrete; the simple entry point remains the AI check.
Tirion Agent Permission Model
Agent Permission Model
A permission model for AI agents that use tools, read data or trigger actions without receiving uncontrolled privileges.
Start AI check
Framework overview
An AI agent should not be treated like a human user with broad rights. The Agent Permission Model separates purpose, identity, tool inventory, scopes, data classes, action tiers, human approval, audit and kill switch.
The Rights And Control Model
The framework treats agents as operating risks of their own: they have purpose boundaries, identities, tools, data access and action impact that must be documented and approved separately.
The agent has a narrow purpose and cannot use tools outside that purpose.
User, service and business identity, OAuth/Graph scopes and data classes are separated.
Actions are tiered by impact, validated, logged, approved and disabled when needed.
Each dimension is scored from 0 to 3. The most critical issues are write access, global admin rights, untrusted content and missing audit.
Production-ready for the defined scope.
Pilot-ready with controlled actions.
Demo or read-only only.
Do not deploy.
Readiness dimensions0-3
Purpose Bound
0-3Is the agent purpose clear and narrow enough?
Identity
0-3Is it clear which user, service and business identity acts?
Tool Inventory
0-3Are all tools documented with owner, purpose and side effects?
Scope Minimality
0-3Are API, Graph and OAuth scopes minimal and justified?
Data Boundary
0-3Are data classes, tenant boundaries and sensitivity defined?
Action Tiering
0-3Is every action assigned to P0 through P5?
Human Approval
0-3Does approval match the impact of the action?
Prompt Injection Defense
0-3Are untrusted contents separated from instructions?
Tool Guardrails
0-3Is validation performed before and after tool execution?
Auditability
0-3Are tool calls, arguments, approvals and outputs traceable?
Rollback
0-3Are correction or reversal processes defined for write actions?
Kill Switch
0-3Can the agent or tool be disabled immediately?
Hard stop criteria
- Write access without tool and approval policy.
- Global admin, mailbox, drive or Graph rights without justification.
- Untrusted content plus tool execution without isolation.
- No audit for external or mutating actions.
- No accountable owner.
Short checklist
- Agent identity and owner defined.
- Tool list and tool manifests available.
- Scopes are minimal and separated by task.
- P0-P5 action tier defined for each tool.
- Human approval configured before P4/P5 actions.
- Traces, rollback and kill switch available.
Where to use this framework
Classify every tool by purpose, side effects, approval and audit.
Prevent agents from receiving global or unnecessarily broad scopes.
Define which actions are autonomous, review-required or forbidden.
Executive FAQ
Why does an agent need its own permission model?
Because agents combine tools, interpret content and trigger actions. Classic user permissions are not enough as a control model.
What is a hard stop criterion?
Any setup where an agent can write, communicate externally or read broad data without owner, approval, audit and kill switch.
Is read-only always safe?
No. Read-only still needs data classification, permission hygiene and prompt-injection defense, but it is often the better pilot start.
Start now
Need this translated into a real decision?
Use the AI check to identify the strongest AI, cloud or approval lever before choosing a next step.