RegisterFree · no accountEU AI ActNIST AI RMF
AI Agent Registry and Permission Matrix
A register for agents that act — with tools, credentials and autonomy — and a permission matrix stating what each may do alone, with approval, or never.
What's inside
- Registry sheet: agent, purpose, model, tools, credentials, owner, kill switch, logging
- Permission matrix sheet: agents against actions (read, write, send, execute, pay, browse, act for a user) with Allowed / With approval / Denied dropdowns
- Duties sheet: the oversight and transparency duties on record that apply to autonomous systems
Preview
The sheets and sections of version v1, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Registry
| Agent ID | Agent name | Purpose and scope | Model(s) | Tools and integrations | Credentials it holds | Autonomy level ▾ | Hard limits (spend, scope, rate) | Accountable owner | Kill switch tested ▾ | Actions logged ▾ | Last review | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | ||||||||||||
Sheet: Permission matrix
| Agent | Read internal data ▾ | Write or change data ▾ | Send messages or email ▾ | Execute code ▾ | Make payments or commit funds ▾ | Browse the internet ▾ | Call other agents or tools ▾ | Act on behalf of a named person ▾ | Actions allowed alone ƒ |
|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||
One row per agent. Four or more actions allowed alone turns the count red: that is an agent that needs the oversight procedure, not a note.
Sheet: Oversight duties
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) | Human oversight | Australian Voluntary AI Safety Standard | Australia | Deployer / user organisation, Provider / developer | Voluntary | Guardrails 4, 5 and 6 | Test AI models and systems before deployment and monitor them in operation; enable meaningful human control and intervention; and inform end users about AI-enab | Test reports and user disclosure records | MEASURE and MANAGE functions | Source-linked | https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency | ||
| Frontier developers must publish a transparency report before deploying a new frontier model | Transparency and disclosure | California SB 53 | California (United States) | General-purpose AI model provider, Provider / developer | Legal requirement | Business and Professions Code Section 22757.12 (as added by SB 53) | 2026-01-01 | Before or at the time a frontier developer deploys a new frontier model, or a substantially modified version, it must publish a transparency report on its websi | Published model transparency report; Redaction justification log | Annex A.8.2, A.8.3 | GOVERN 4.2, MAP 5.1, MEASURE 2.6 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report |
| Notify consumers and explain adverse consequential decisions | Transparency and disclosure | Colorado AI Act | Colorado (United States) | Deployer / user organisation | Legal requirement | C.R.S. 6-1-1703(4) | 2026-06-30 | Before a high-risk system makes a consequential decision, deployers must notify the consumer that AI is used, describe its purpose and nature, and provide conta | Consumer notice and adverse-action explanation templates | GOVERN 5.x, MANAGE 4.x | Source-linked | https://aipolicytracker.org/obligations/us-colorado-consumer-notice-and-adverse-decision-explanation | |
| Deployers must publish a statement about the high-risk AI systems they use | Transparency and disclosure | Colorado AI Act | Colorado (United States) | Deployer / user organisation | Legal requirement | C.R.S. 6-1-1703(5) | 2026-06-30 | A deployer must make available on its website, or in another public way, a clear and readily available statement summarising the types of high-risk AI systems i | Public statement on high-risk AI use | Annex A.8.5 | GOVERN 4.2, MAP 5.2 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-public-statement |
| Deployers and developers must disclose to consumers that they are interacting with an AI system | Transparency and disclosure | Colorado AI Act | Colorado (United States) | Deployer / user organisation, Provider / developer | Legal requirement | C.R.S. 6-1-1704 | 2026-06-30 | Any developer or deployer that makes an AI system available to consumers that is intended to interact with them must disclose to each consumer that they are int | AI interaction disclosure copy and screenshots | Annex A.8.5 | GOVERN 5.1, MANAGE 4.1 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/us-colorado-ai-act-consumer-ai-interaction-disclosure |
| Design high-risk systems to log events automatically | Record keeping and logging | EU AI Act | European Union | Provider / developer, Deployer / user organisation | Legal requirement | Article 12; Article 26(6) for deployers | 2026-08-02 | High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operati | Logging specification and retention policy | Annex A control on event logging | MEASURE 2.x, MANAGE 4.1 | Source-linked | https://aipolicytracker.org/obligations/eu-ai-act-record-keeping |
Document outline (DOCX)
- Agents are systems that act
- Permission levels
- Duties that apply
- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)
- Enable and assign effective human oversight
- Employers and employment agencies must let candidates request an alternative selection process or accommodation
- Determine the appropriate level of human involvement in AI decisions
- Operators of high-impact AI must ensure human management and supervision
- Respect the right to object to automated decision-making without human intervention
- Provide routes to contest AI outcomes and seek redress
- Apply safeguards to solely automated decisions with significant effects
Duties this template covers (35)
Each is cited in the file with its source reference and a link back to the record.
- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6)
- Frontier developers must publish a transparency report before deploying a new frontier model
- Notify consumers before automated decision-making technology influences a consequential decision
- Disclose the use of the technology and the principal reasons after an adverse consequential decision
- Offer meaningful human review of an adverse consequential decision
- Keep records of consequential decisions influenced by the technology for three years
- Design high-risk systems to log events automatically
- Provide deployers with clear instructions for use
- Enable and assign effective human oversight
- Disclose AI interaction and label synthetic content
- Providers must keep high-risk AI documentation for ten years
- Providers must retain automatically generated logs under their control
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
- Is the AI Agent Registry and Permission Matrix free?
- Yes. Download the XLSX and DOCX without an account, under CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
- What is it generated from?
- Version v1 was built on 26 September 2026 from dataset 914895c3103e: 42 recorded duties are cited in it, drawn from 13 instruments. Every row that cites a duty links to the record, and the record links to the official source.
- How will I know when it changes?
- The library is rebuilt daily. When a change to the records reaches this template it gets the next version, a changelog in the version history below, an entry in the AI policy updates hub and the templates feed, and a line in the weekly digest for subscribers of the templates topic.
- Does completing it make us compliant?
- No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
Frequently asked questions
- Is the AI Agent Registry and Permission Matrix free?
- Yes. Download the XLSX and DOCX without an account, under CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
- What is it generated from?
- Version v1 was built on 26 September 2026 from dataset 914895c3103e: 42 recorded duties are cited in it, drawn from 13 instruments. Every row that cites a duty links to the record, and the record links to the official source.
- How will I know when it changes?
- The library is rebuilt daily. When a change to the records reaches this template it gets the next version, a changelog in the version history below, an entry in the AI policy updates hub and the templates feed, and a line in the weekly digest for subscribers of the templates topic.
- Does completing it make us compliant?
- No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.