Give every agent a charter before it gets authority.
Control tiers from three ordinal choices
Read the explanation
The charter adds three ordinal choices, autonomy two, data sensitivity two and impact three, to get seven. Scores at least eight are critical, at least six high, at least four managed and lower baseline. Bars compare the default seven and critical boundary eight. This is a source classification heuristic, not a validated risk scale or regulatory assessment. Each choice ranges from one to three, so total score spans three through nine. The source selects weekly review for critical, monthly for high, and quarterly for lower tiers. Bars show the score endpoints in a common unit. These are generated policy text suggestions. The page does not schedule reviews, monitor thresholds or automatically enforce an approval gate. Approval wording first checks impact three, then data sensitivity three, otherwise exceptions and threshold breaches. Other generated controls name emergency stop, least privilege, audit retention, exception path and review cadence, six rows total. Bars count control rows and the three scoring fields. The named approver and retention term are inserted into a local charter; exporting it does not revoke credentials, install controls or authorize actual execution.
Agent Control Charter Mechanism & Governance Scope
How does the charter convert autonomy, data sensitivity, and impact settings into risk tiers and human-in-the-loop approval gates?
This tool generates an operational policy contract by computing an additive risk score from three user-selected attributes: Autonomy (1 to 3), Data Sensitivity (1 to 3), and Action Impact (1 to 3). The resulting sum (from 3 to 9) maps directly to one of four predetermined control tiers (Baseline, Managed, High, or Critical Control) and selects templated rules for what the agent may decide, what requires human sign-off, and review frequency.
The 3-to-9 additive scoring formula is an illustrative heuristic and does not satisfy legal compliance, sector-specific statutory auditing, or formal safety certification. In production environments, enterprise AI governance relies on multidimensional risk mapping, empirical continuous monitoring, and structured organizational profiles rather than single-number arithmetic.
Try a worked example
Under default settings (Controlled execution = 2, Confidential data = 2, High impact = 3), the sum is 2 + 2 + 3 = 7, placing the agent in 'High control' (score ≥ 6). If you change 'Action impact' to 'Reversible' (value 1) while keeping the others at 2, the total score drops to 5, transitioning the risk band to 'Managed control' and updating the approval gate from 'Any irreversible or high-impact action' to general threshold breach oversight.
Additive Scoring vs. Comprehensive Risk Mapping
The tool calculates total score as S = Autonomy + Data + Impact. Scores 8–9 trigger Critical Control, 6–7 High Control, 4–5 Managed Control, and 3 Baseline Control. In formal frameworks, risk cannot be reduced to simple linear addition because non-linear interactions and context-specific threat models dictate real-world safety.
The National Institute of Standards and Technology (NIST) AI Risk Management Framework (AI RMF 1.0) emphasizes that risk is a contextual composite of impact magnitude and event likelihood across socio-technical dimensions, requiring dedicated Map, Measure, and Manage functions rather than isolated numerical tallies. Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Human Oversight and Control Gates
The charter automatically templates human-in-the-loop intervention points. When impact is scored at level 3, the script assigns sign-off authority for high-impact actions to the named approver, establishing emergency stop and exception routing.
NIST AI RMF 1.0 notes that human-AI configurations can span from advisory assistance to full autonomy, highlighting that organizations must clearly define roles, responsibilities, and mechanisms to supersede or deactivate AI systems when performance deviates from intended use. Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Provides foundational enterprise governance guidance on human oversight, continuous monitoring, risk categorization, and audit logging boundaries for autonomous and semi-autonomous AI systems.