Approval matrix template
In short: This template lists which AI agent actions need a human approver and which can run on policy alone. Each row gives a risk tier, the approver role, a response window and the outcome on timeout. Timeouts deny by default, because a missing answer should never quietly become a yes.
Download Approval matrix (CSV)
What is in the template?
| Action | Risk tier | Outcome | Approver | Response window | On timeout |
|---|---|---|---|---|---|
| Read internal documents in the agent's scope | Low | Allow | None | Not applicable | Not applicable |
| Create a draft in a shared workspace | Low | Allow | None | Not applicable | Not applicable |
| Send a message inside the company | Medium | Allow | None | Not applicable | Not applicable |
| Send a message or email outside the company | High | Ask | Agent owner | 30 minutes | Deny |
| Update a customer record | Medium | Allow with log review | None | Not applicable | Not applicable |
| Delete any record | High | Ask | Agent owner | 30 minutes | Deny |
| Export more than 100 records | High | Ask | Data owner | 60 minutes | Deny |
| Move money or approve a payment | High | Ask | Finance approver | 15 minutes | Deny |
| Change access rights or roles | High | Ask | Security on call | 15 minutes | Deny |
| Deploy code to production | High | Ask | Release owner | 60 minutes | Deny |
| Call a tool not on the allow-list | Blocked | Deny | None | Not applicable | Not applicable |
| Approve its own pending action | Blocked | Deny | None | Not applicable | Not applicable |
Reviewed by The Register desk