Change Authority Review — What can the agent be allowed to change?
Your agent’s access says what it can do. Decide who gives it the authority to act.
Built by Sunil Mathew, co-authored with Claude
- What to bring
- One agent and the artifact or system it changes; a list of every action it can take (edit, save a version, restore, delete, publish, send, notify, change permissions, call an external API); and a test environment where you can try undoing each action.
- What to do
- List every action, try to undo each one and record what remains, give each action an authority level (Agent acts, Preview and consent or Not allowed), fill in what each level needs, and score the ten checks.
- What you leave with
- An authority map for that agent (each action, whether it can really be undone, who authorises it and what the preview must show), a list of actions whose authority isn’t ready, and a decision: Ready, Fix first or Hold.
Excel workbook · also opens in Google Sheets and LibreOffice · free
From The Living Craft, practical learning and consulting with Sunil Mathew. Explore the programmes
Access is not authority. Teams merge the two because the code path is the same.
On a project Sunil led at a MAANG company, agents previewed the changes they would make to an artifact as part of generating content. The design question was what access and authority the agent should have, who should authorise its changes, and how to manage versions and changes that can’t be undone. The approach: every non-reversible change needed the user’s consent. The agent showed the user the changes, got their consent, and then made them on the user’s behalf.
Access is a permission granted once. Authority is a decision about each change.
Actions that feel safe because they can be “rolled back” are often not reversible. Saving a new version is the common case. Rolling back restores the earlier content, but the version the agent created stays in the history, and others may already have seen it. So the workbook classifies each action by what an undo actually leaves behind, not by whether an undo button exists.
Every action gets one, and each level needs something before the agent may act.
| Authority | Use it when | What it needs before the agent may act |
|---|---|---|
| Agent acts | The action can be fully undone, and nobody but the user sees the result before it can be undone | An undo path that has been tested, not assumed |
| The action can’t be fully undone, or other people or systems see the result | A preview showing the full change and what can’t be undone; a named person who consents to each change; the agent acting as that person; a safe outcome if they say no | |
| Not allowed | The agent doesn’t need this action | The access removed, not just unused |
Can it be undone?
You fill this in for each action, from a real undo attempt.
| Answer | Meaning | Example |
|---|---|---|
| Yes | An undo leaves nothing anyone could act on | Discarding a draft in the editor preview |
| Partly | The content can be restored, but a trace remains: a history entry, a notification, a copy, a link someone saved | Saving a new version; restoring an earlier version |
| No | It can’t be undone | Publishing; sending a message; notifying people |
The three questions
| # | Question | Tab |
|---|---|---|
| 1 | What can the agent do, and can each action really be undone? | 1 · Action Inventory |
| 2 | Does each authority level have what it needs? | 2 · Authority Requirements |
| 3 | Is the agent’s authority ready for real users? | 3 · Checklist |
One question each, and the mistake it catches.
What can the agent do, and can each action really be undone?
The mistake it catches Marking an action reversible because an undo button exists, such as treating “save a new version” as safe. Each action is marked from a real undo attempt, and the sheet suggests an authority from what the undo left behind.
Does each authority level have what it needs?
The mistake it catches A consent step on paper that doesn’t work, such as a preview that hides what can’t be undone, or an “always allow” setting. Each row names the first thing missing.
Is the agent’s authority ready for real users?
The mistake it catches Letting an agent act for real users before its authority is ready. Ten checks, four of them critical, end in one decision and name the next thing to fix.
Four are critical. One No on any of them is a Hold.
Each check is answered Yes, Partial or No, and scores 2, 1 or 0. A No on any check marked critical means Hold. Otherwise 16 or more out of 20, with every critical check answered Yes, is Ready. Anything less is Fix first.
- 01
Critical Every action the agent can take is listed, including saving and restoring versions, sending, publishing and external calls.
- 02
Each action’s undo was tested, not assumed.
- 03
Critical Every action that can’t be fully undone, or whose result others see, requires preview and consent.
- 04
Critical Every preview shows the full change and says what can’t be undone.
- 05
Critical Consent is given per change by a named person, not by a standing default.
- 06
The agent acts as the person who consented, and the log records who approved each change.
- 07
If consent is refused, the agent changes nothing, or revises and asks again.
- 08
Every override of the suggested authority has a written reason.
- 09
The agent’s access is no wider than the actions it needs; access for Not allowed actions has been removed.
- 10
A named owner re-runs this review whenever the agent gains a new action or tool.
A document-editing agent, held.
Illustrative example: an agent that drafts and edits a shared document for a user. Not a real system, company or real figures. It is filled in on the workbook’s last tab.
9
3 Agent acts, 5 Preview and consent and 1 Not allowed. 3 were moved off the suggested authority. One of them, “Rename the document”, lets the agent act alone on a change other people see. Its authority is ready, but it is the wrong authority, and only check 3 catches it.
4
One is “Save a new version”. It needs consent, and its preview never tells the user that the version stays in the history after a rollback.
- Publish to the shared space: preview doesn’t show the full change.
- Notify collaborators: no named person gives consent.
- Change sharing permissions: access not removed.
Hold
Don’t let this agent act for real users yet. Critical checks 3 and 4 were answered No. Total 9 of 20.
The first thing to fix is check 3. Every action that can’t be fully undone, or whose result others see, requires preview and consent.
A different question comes first: The Agent Authority Review decides which steps of a workflow an agent may own at all. This review starts after that: the agent has write access, and each change it can make needs an authority.
Access is granted once. Authority is given one change at a time.
You have examined one operating decision. Build the wider reasoning through practical work and review in Architecting Agentic AI Systems: 30 live hours with Sunil Mathew; confirm complete setup and pre-session preparation before joining.
Build a working agentic system and develop the reasoning behind it. Explore Architecting Agentic AI Systems: 30 live hours with Sunil Mathew; confirm complete setup and pre-session preparation before joining. Request a fit call at https://learning.thelivingcraft.ai/programmes/agentic-systems/architecting-agentic-ai-systems/#discuss-architecting-agentic-ai-systems
Published 17 October 2026 · Content CC BY 4.0 · © The Living Craft