AI Agent Registry and Permission Matrix
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI Agent Registry and Permission Matrix is a free XLSX and DOCX register for EU AI Act and NIST AI RMF. A register for agents that act — with tools, credentials and autonomy — and a permission matrix stating what each may do alone, with approval, or never. It is licensed CC BY 4.0 and is not legal advice.
- Format
- XLSX and DOCX · Register
- Version
- v7, built 12 Nov 2026
- Duties cited
- 43 from 16 instruments
- Rows from the records
- 43
- Frameworks
- EU AI Act, NIST AI RMF
- Written for
- Deployer / user organisation, Provider / developer, Public authority / government body
- Price and licence
- Free · CC BY 4.0
What's inside
- Registry sheet: agent, purpose, model, tools, credentials, owner, kill switch, logging
- Permission matrix sheet: agents against actions (read, write, send, execute, pay, browse, act for a user) with Allowed / With approval / Denied dropdowns
- Duties sheet: the oversight and transparency duties on record that apply to autonomous systems
Preview
The sheets and sections of version v7, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Registry
| Agent ID | Agent name | Purpose and scope | Model(s) | Tools and integrations | Credentials it holds | Autonomy level ▾ | Hard limits (spend, scope, rate) | Accountable owner | Kill switch tested ▾ | Actions logged ▾ | Last review | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | ||||||||||||
Sheet: Permission matrix
| Agent | Read internal data ▾ | Write or change data ▾ | Send messages or email ▾ | Execute code ▾ | Make payments or commit funds ▾ | Browse the internet ▾ | Call other agents or tools ▾ | Act on behalf of a named person ▾ | Actions allowed alone ƒ |
|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||
One row per agent. Four or more actions allowed alone turns the count red: that is an agent that needs the oversight procedure, not a note.
Sheet: Oversight duties
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) | Human oversight | Australian Voluntary AI Safety Standard | Australia | Deployer / user organisation, Provider / developer | Voluntary | Guardrails 4, 5 and 6 | Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enab | Test reports and user disclosure records | MEASURE and MANAGE functions | Pending review · source-linked | https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency | ||
| Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision | Transparency and disclosure | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7220 | 2027-01-01 | A business that uses automated decision-making technology (ADMT) to make a significant decision about a consumer (one that provides or denies financial or lendi | The published Pre-use Notice for each use, with the date it went live and where it is shown; A record of which significant decisions use ADMT and which notice c | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-admt-pre-use-notice | ||
| Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal | Human oversight | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7221 | 2027-01-01 | Consumers must be able to opt out of the use of ADMT for a significant decision, through at least two designated methods that are easy to use and need minimal s | The opt-out link, form and second method, and a log of requests with dates received and processing stopped; Notices sent to service providers and contractors ab | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out | ||
| Answer consumers' requests to access information about how automated decision-making technology was used about them | Transparency and disclosure | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7222 | 2027-01-01 | On a verified request, the business must explain in plain language the specific purpose for which it used ADMT about the consumer; the logic of the ADMT, enough | An access-response template per system and a log of requests answered; Contract terms requiring vendors to assist with access requests | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-admt-access | ||
| Submit risk assessment information to the California Privacy Protection Agency each year | Record keeping and logging | California CPPA automated decision-making rules | California (United States) | Deployer / user organisation | Legal requirement | Cal. Code Regs. tit. 11, § 7157 | 2028-04-01 | For risk assessments conducted in 2026 and 2027, the business submits information to the Agency by 1 April 2028, and for later years by 1 April of the following | The register of risk assessments by year and processing activity; Each year's submission and its confirmation | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission | ||
| Frontier developers must publish a transparency report before deploying a new frontier model | Transparency and disclosure | California SB 53 | California (United States) | General-purpose AI model provider, Provider / developer | Legal requirement | Business and Professions Code Section 22757.12 (as added by SB 53) | 2026-01-01 | Before or at the time a frontier developer deploys a new frontier model, or a substantially modified version, it must publish a transparency report on its websi | Published model transparency report; Redaction justification log | Annex A.8.2, A.8.3 | GOVERN 4.2, MAP 5.1, MEASURE 2.6 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report |
Document outline (DOCX)
- Agents are systems that act
- Permission levels
- Duties that apply
- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)
- Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal
- Offer meaningful human review of an adverse consequential decision
- Enable and assign effective human oversight
- Employers and employment agencies must let candidates request an alternative selection process or accommodation
- Determine the appropriate level of human involvement in AI decisions
- Operators of high-impact AI must ensure human management and supervision
- Respect the right to object to automated decision-making without human intervention
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The XLSX and DOCX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v7), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Fill in your rows. Complete the "Registry" and "Permission matrix" sheets for your own systems. Dropdowns, formulas and colour rules are already set.
- 4Check the duties against your situation. The "Oversight duties" sheet lists the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 5Complete the document. Work through the DOCX sections (Agents are systems that act, Permission levels, Duties that apply) and replace each placeholder with your organisation's answer.
- 6Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (43)
Each is cited in the file with its source reference and a link back to the record.
- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)
- Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision
- Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal
- Answer consumers' requests to access information about how automated decision-making technology was used about them
- Submit risk assessment information to the California Privacy Protection Agency each year
- Frontier developers must publish a transparency report before deploying a new frontier model
- Notify consumers before automated decision-making technology influences a consequential decision
- Disclose the use of the technology and the principal reasons after an adverse consequential decision
- Offer meaningful human review of an adverse consequential decision
- Keep records of consequential decisions influenced by the technology for three years
- Design high-risk systems to log events automatically
- Provide deployers with clear instructions for use
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v7 | ef1018b7a6a2 | Dataset 4559f86f527b → ef1018b7a6a2. Sheet "Oversight duties": 35 → 43 rows (+8). Record citations: 43 → 51. | |
| v6 | 4559f86f527b | Dataset 1e8ea28a8a93 → 4559f86f527b. | |
| v5 | 1e8ea28a8a93 | Dataset 52bd836b1d6b → 1e8ea28a8a93. | |
| v4 | 52bd836b1d6b | Dataset 9710140e23e4 → 52bd836b1d6b. | |
| v3 | 9710140e23e4 | Dataset 3335c39da4b7 → 9710140e23e4. | |
| v2 | 3335c39da4b7 | Dataset 914895c3103e → 3335c39da4b7. Sheet "Oversight duties": 34 → 35 rows (+1). Document: 53 → 52 blocks. Record citations: 42 → 43. | |
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI Agent Registry and Permission Matrix?
Registry sheet: agent, purpose, model, tools, credentials, owner, kill switch, logging. Permission matrix sheet: agents against actions (read, write, send, execute, pay, browse, act for a user) with Allowed / With approval / Denied dropdowns. Duties sheet: the oversight and transparency duties on record that apply to autonomous systems.
Which duties does it cite?
43 recorded duties from Australian Voluntary AI Safety Standard, California CPPA automated decision-making rules, California SB 53 and Colorado ADMT law (SB 26-189), including Guardrails 4, 5 and 6, Cal. Code Regs. tit. 11, § 7220, Cal. Code Regs. tit. 11, § 7221, Cal. Code Regs. tit. 11, § 7222, Cal. Code Regs. tit. 11, § 7157 and Business and Professions Code Section 22757.12 (as added by SB 53). Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on deployer / user organisation, provider / developer and public authority / government body. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the XLSX and DOCX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v7 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the AI Agent & Autonomy Risk Assessment (23 questions, about 6 minutes). It is free and runs on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.