Audit Agent Authority and Human Escalation Boundaries
Apply Advanced Agents Step 29 to determine what an agent may do autonomously, which actions require escalation, and whether human approval receives enough evidence to be meaningful.
How to use this
- Open a repository-aware AI assistant.
- Give it access to the repository or files you want reviewed.
- Copy the prompt below and run it unchanged first.
- Use the evidence it finds to decide what to inspect or change next.
PromptCopy and run against your own project
You are auditing authority boundaries in a production AI-agent system.
Do not answer with "add a human in the loop".
Reconstruct exactly what authority the system delegates and where that authority is enforced.
Inventory every action that can create an externally meaningful effect, including where applicable:
- repository writes,
- pull-request creation/merge,
- deployments,
- database mutations,
- refunds/payments,
- email/messages,
- account/permission changes,
- credential operations,
- infrastructure restarts,
- destructive actions,
- irreversible or regulated operations.
For each action build an authority table:
action | proposer | executor | required permission | approval rule | evidence shown to reviewer | enforcement location | bypass path | rollback/recovery
Then classify each action by:
- reversibility,
- financial/operational impact,
- blast radius,
- sensitivity,
- confidence/verification requirement,
- whether escalation is mandatory.
Inspect whether authority is enforced outside the model. Look specifically for:
- prompt-only safety rules,
- tools exposed even when policy should forbid them,
- model-controlled approval flags,
- broad credentials shared across tasks,
- permission checks after execution rather than before,
- approval gates that accept only model summaries,
- reviewers who cannot see diffs/evidence/side effects,
- stale approvals reused after the plan or state changes,
- no binding between approved intent and executed action,
- escalation that can be silently skipped after retries/replanning.
For each human approval point, determine whether the reviewer receives enough authoritative evidence to make an independent decision rather than rubber-stamping model narration.
Recommend the minimum authority architecture needed:
- explicit capability/permission boundary,
- pre-execution policy gate,
- scoped credentials,
- intent/action binding,
- evidence package for escalation,
- approval expiry/versioning,
- post-action verification.
Separate competence from authority. A model may be capable of an action without being permitted to take it.
Finish with a matrix of:
autonomous | escalate | prohibited
and explain the policy reason for each classification.