Tirion Agent Permission Model
A permission model for AI agents that use tools, read data or trigger actions without receiving uncontrolled privileges.
Tirion Agent Permission Model
An AI agent should not be treated like a human user with broad rights. The Agent Permission Model separates purpose, identity, tool inventory, scopes, data classes, action tiers, human approval, audit and kill switch.
Architecture model
The framework treats agents as operating risks of their own: they have purpose boundaries, identities, tools, data access and action impact that must be documented and approved separately.
The agent has a narrow purpose and cannot use tools outside that purpose.
User, service and business identity, OAuth/Graph scopes and data classes are separated.
Actions are tiered by impact, validated, logged, approved and disabled when needed.
Scorecard logic
Production-ready for the defined scope.
Pilot-ready with controlled actions.
Demo or read-only only.
Do not deploy.
Is the agent purpose clear and narrow enough?
Is it clear which user, service and business identity acts?
Are all tools documented with owner, purpose and side effects?
Are API, Graph and OAuth scopes minimal and justified?
Are data classes, tenant boundaries and sensitivity defined?
Is every action assigned to P0 through P5?
Does approval match the impact of the action?
Are untrusted contents separated from instructions?
Is validation performed before and after tool execution?
Are tool calls, arguments, approvals and outputs traceable?
Are correction or reversal processes defined for write actions?
Can the agent or tool be disabled immediately?
Hard stop criteria
Short checklist
Where to use this framework
Classify every tool by purpose, side effects, approval and audit.
Prevent agents from receiving global or unnecessarily broad scopes.
Define which actions are autonomous, review-required or forbidden.
Executive FAQ
Because agents combine tools, interpret content and trigger actions. Classic user permissions are not enough as a control model.
Any setup where an agent can write, communicate externally or read broad data without owner, approval, audit and kill switch.
No. Read-only still needs data classification, permission hygiene and prompt-injection defense, but it is often the better pilot start.
Start now
Use the score to identify the strongest AI, cloud or governance leakage before choosing a next step.