Executive Summary
This matrix turns agent authority into a reviewable control model. It separates what the AI system can read, suggest, draft, queue, approve, and execute across each connected tool. The key point is simple: agent security is not one permission. It is a set of bounded authorities, each with a risk level, owner, approval requirement, and audit trail.
Recommended agentic risk decision
Continue read and draft capabilities under the gateway, but block customer-visible execution, billing changes, CRM writes, and external webhooks until action classes, approval bundles, and trace evidence are fully implemented.
Permission Matrix Snapshot
The real risk is authority, not chat
Action classes
| Action class | Meaning | Default approval | Risk |
|---|---|---|---|
| Read | Retrieve allowed context without changing state | not required | medium |
| Suggest | Propose a next action without executable payload | not required | medium |
| Draft | Prepare customer-facing or system-facing content | required before send | high |
| Queue | Create a pending action object | required before execute | high |
| Approve | Authorize an action | human-only | critical |
| Execute | Perform a state-changing action | restricted | critical |
Agent Tool Permission Matrix
The matrix shows which capabilities are approved, conditional, blocked, or denied for each connected tool.
| Agent | Tool | Action | Scope | Approval | Risk | Owner |
|---|---|---|---|---|---|---|
| Support Copilot | Case Management API | read | tenant-scoped support cases visible to the authenticated user | no | medium | Support Platform |
| Support Copilot | Customer Messaging | draft | draft response text for the active case only | yes, before send | high | Product Operations |
| Support Copilot | Customer Messaging | execute | send customer-visible response | yes, human-only approval | critical | Product Operations |
| Support Copilot | Case Management API | queue | priority, category, routing tags, summary fields | yes for priority and routing changes | high | Support Platform |
| Support Copilot | CRM | read | account profile and entitlement fields needed for support context | no | medium | Revenue Operations |
| Support Copilot | CRM | execute | update account fields | yes, restricted to human operators | critical | Revenue Operations |
| Support Copilot | Billing System | read | plan, invoice status, entitlement flags | no for entitlement lookups | high | Finance Systems |
| Support Copilot | Billing System | execute | issue credits, refunds, plan changes | human-only approval and finance policy gate | critical | Finance Systems |
| Support Copilot | Notification Service | queue | internal team notification for escalation only | no for internal escalation templates | medium | Product Operations |
| Support Copilot | External Webhook | execute | third-party workflow triggers | yes, security-reviewed allowlist only | critical | Integration Platform |
Permission Findings
Action classes are not consistently enforced
The product separates some draft and execute paths, but the permission model is not yet enforced uniformly across all tools.
Why this matters
Approval context is too thin for sensitive actions
Approvers need evidence, target, rationale, blast radius, and rollback details. Current approval screens do not always show enough context.
Third-party webhook execution should remain blocked
External webhooks create hard-to-bound blast radius and should remain blocked until allowlists, payload schemas, approval bundles, and trace evidence are complete.
Tool policy by risk
| Tool surface | Allowed now | Conditional | Blocked |
|---|---|---|---|
| Case Management API | read cases | queue metadata updates | direct destructive changes |
| Customer Messaging | draft responses | send with approval | auto-send |
| CRM | read entitlement context | none | write account fields |
| Billing System | read entitlement flags | none | credits, refunds, plan changes |
| Notification Service | internal escalation notifications | external notifications | broad broadcast |
| External Webhooks | none | allowlisted draft payloads | direct execution |
Approval bundle decision
Do not approve sensitive actions from a generic confirmation modal. Require an approval context bundle with target, diff, evidence, rationale, blast radius, rollback path, reviewer identity, and immutable trace reference.
Controls required before expanding agent authority
Procurement value
Related artifact: AI Trust Boundary Map
The trust boundary map shows where authority changes. This matrix defines which authority is allowed at each tool boundary.