Classifying AI Agent Decisions by Risk Tier: A Practical Model

Most AI agent governance conversations start with the wrong question — 'should we allow this agent to be autonomous' — when the more useful question is 'which of this agent's specific decisions should be autonomous.' A single agent typically makes many different kinds of decisions, some genuinely low-stakes and some materially consequential, and treating them all identically is where most agent governance frameworks fail in practice.

The Three-Tier Model, Generalized

• Tier 1 — human-only decisions: actions with real financial, legal, or safety consequences that a human must explicitly take, with the agent limited to preparing recommendations
• Tier 2 — approval-required decisions: actions the agent can prepare and stage, but a human must explicitly approve before execution
• Tier 3 — fully autonomous decisions: low-stakes, reversible, or narrowly-scoped actions the agent can take without a human checkpoint

Why Classifying by Decision, Not by Agent, Matters

A single customer-service agent might autonomously answer a routine order-status question (Tier 3), draft a refund recommendation for human approval (Tier 2), and be explicitly barred from unilaterally issuing a refund above a threshold amount (Tier 1). Classifying the whole agent as 'autonomous' or 'supervised' loses this granularity and either over-restricts genuinely low-risk actions or under-restricts genuinely consequential ones.

How to Actually Build the Classification

• List every distinct action type the agent can take, not just its overall purpose
• For each action, ask: what's the realistic worst-case impact if the agent gets this wrong, and is that impact reversible
• Sort by that answer, not by how technically capable the agent is of performing the action correctly — capability and appropriate autonomy are separate questions
• Revisit the classification after real-world deployment data accumulates — early tiering decisions are educated guesses, not permanent verdicts

Where Most Teams Get This Wrong

The common failure mode isn't under-restricting agents out of recklessness — it's treating the tiering exercise as a one-time setup step rather than an ongoing discipline. New action types get added to an agent's capability set over time, often without anyone re-running the same risk classification exercise against them, and that's exactly how an agent quietly accumulates unreviewed autonomous capability.

This Connects Directly to Audit Logging

A tiering model is only as useful as the audit trail behind it — you need to be able to demonstrate, after the fact, which tier a given action was classified under and that the agent actually respected that boundary at execution time. Building the logging infrastructure alongside the tiering model, not after an incident forces the question, is the difference between a governance framework that holds up under scrutiny and one that's aspirational.