Section IV
The operating model and its risk tiers
A fixed set of rules cannot fit every agent. The operating model sets how strictly each control applies, by risk tier, so that rigorous control goes where it is needed and low-risk experiments can move quickly. Every control objective on this site says what it requires at each of the four tiers.
The four tiers
| Tier | What the agent is like | How it is governed |
|---|---|---|
| Tier 1 Exploratory | It runs only in a sandbox, uses no production data, and has no effect outside the sandbox. | Teams serve themselves inside fixed limits set by the platform. |
| Tier 2 Operational | It runs on production systems with limited autonomy, and its actions can be reversed. | A peer reviews it, and automated checks run at every release and while it runs. |
| Tier 3 Critical | It acts with high autonomy, handles sensitive data, or takes actions that cannot be reversed. | The architecture board reviews its design in full, it is monitored continuously, and internal audit checks it each year. |
| Tier 4 Strategic | It affects the whole organization, deals with the outside world on the organization's behalf, or falls within regulation. | An executive sponsors it, the governance council decides on it, and an outside auditor attests to its controls. |
Setting an agent's tier
An agent's tier is set at Plan time, confirmed at Design time, and reviewed whenever the agent changes. The tier is the highest one that any of these questions points to:
- How much does the agent decide on its own, without a person approving each act?
- How sensitive is the data it reads, stores or sends?
- Can its actions be reversed, and at what cost?
- Can it spend money, sign, or commit the organization to something?
- Does it deal with customers, partners or the public on the organization's behalf?
- Does a regulation apply to what it does?
When a change raises the answer to any of these questions, the change goes back through Design and Build at the new tier, as the Change phase requires.
Setting a relationship's tier
Tiers apply to the relationships between agents as well as to the agents themselves, because a low-risk agent can be used as a path to a high-risk act. The Network discipline records a tier for every relationship, set by these rules:
- A relationship starts at the higher tier of the two agents it joins.
- A relationship through which one agent can commit money, sign or make an irreversible change for another is at least Tier 3.
- A relationship that crosses into another organization is at least Tier 2, and it is governed by the boundary rules agreed with that organization.
- A chain of relationships is governed at the highest tier of any link in it.
For example, two Tier 2 agents might share a relationship in which one can place orders on the other's account. That relationship is Tier 3, so the mandate it carries is signed and checked on every order, and each order above the set threshold waits for a person.
Reading the tiers in a control objective
Each control objective lists four requirements, one for each tier. The requirements add up as the tier rises: a Tier 3 agent meets the Tier 2 requirement as well as its own, unless the Tier 3 requirement replaces it. Where a requirement says no control is needed at a tier, the objective still applies, and it is satisfied by the limits of that tier, such as the sandbox.
An organization can make any requirement stricter for its own agents. It should record each requirement it makes weaker as an exception, with an approver and an expiry date.