# AI Agent Registry and Permission Matrix

- **Type**: Template (Register)
- **Page**: https://aipolicytracker.org/templates/ai-agent-registry
- **Formats**: XLSX and DOCX
- **Current version**: v7, built 2026-11-12

A register for agents that act — with tools, credentials and autonomy — and a permission matrix stating what each may do alone, with approval, or never.

## What is inside

- Registry sheet: agent, purpose, model, tools, credentials, owner, kill switch, logging
- Permission matrix sheet: agents against actions (read, write, send, execute, pay, browse, act for a user) with Allowed / With approval / Denied dropdowns
- Duties sheet: the oversight and transparency duties on record that apply to autonomous systems

## Laws and frameworks it is built from

- EU AI Act (European Union), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/eu-ai-act
- NIST AI RMF (United States), Verified against the official source 26 Sep 2026: https://aipolicytracker.org/policies/us-nist-ai-rmf

## Recorded duties it covers

- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) (Australian Voluntary AI Safety Standard): https://aipolicytracker.org/obligations/australia-vaiss-testing-human-control-transparency
- Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-admt-pre-use-notice
- Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out
- Answer consumers' requests to access information about how automated decision-making technology was used about them (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-admt-access
- Submit risk assessment information to the California Privacy Protection Agency each year (California CPPA automated decision-making rules): https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission
- Frontier developers must publish a transparency report before deploying a new frontier model (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-transparency-report
- Notify consumers before automated decision-making technology influences a consequential decision (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-advance-notice
- Disclose the use of the technology and the principal reasons after an adverse consequential decision (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-adverse-decision-disclosure
- Offer meaningful human review of an adverse consequential decision (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-human-review
- Keep records of consequential decisions influenced by the technology for three years (Colorado ADMT law (SB 26-189)): https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping
- Design high-risk systems to log events automatically (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-record-keeping
- Provide deployers with clear instructions for use (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers
- Enable and assign effective human oversight (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-human-oversight
- Disclose AI interaction and label synthetic content (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50
- Providers must keep high-risk AI documentation for ten years (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping
- Providers must retain automatically generated logs under their control (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention
- Employers must inform workers and their representatives before using high-risk AI at work (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information
- Deployers must tell natural persons that a high-risk AI system is used in decisions about them (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons
- Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking
- Deployers of emotion recognition or biometric categorisation must inform exposed persons (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice
- Deployers must disclose deepfakes and AI-generated text published on matters of public interest (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure
- Deployers must explain individual decisions taken with high-risk AI on request (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation
- Tell users at the start of an AI companion interaction, and at least every three hours, that they are not communicating with a human (New York AI companion safeguards): https://aipolicytracker.org/obligations/us-new-york-gbl-1702-ai-notification
- Employers and employment agencies must publish a summary of the bias audit results (NYC Local Law 144 (automated employment decision tools)): https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-publish-audit-summary
- Employers and employment agencies must notify candidates and employees before an automated tool is used (NYC Local Law 144 (automated employment decision tools)): https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-candidate-notice
- Employers and employment agencies must let candidates request an alternative selection process or accommodation (NYC Local Law 144 (automated employment decision tools)): https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-alternative-process-request
- Determine the appropriate level of human involvement in AI decisions (Singapore Model AI Governance Framework): https://aipolicytracker.org/obligations/singapore-mgf-human-involvement
- Report incidents and mark AI-generated content (generative AI framework) (Singapore Model AI Governance Framework): https://aipolicytracker.org/obligations/singapore-mgf-genai-incident-reporting-and-provenance
- Notify individuals about the use of personal data in AI recommendations and decisions (PDPC AI advisory guidelines): https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification
- AI business operators must notify users in advance that a product or service runs on high-impact or generative AI (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-advance-notice-of-high-impact-and-generative-ai
- AI business operators must label generative AI output and clearly flag realistic synthetic media (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-31-generative-output-labelling-and-deepfake-notice
- Operators of high-impact AI must be able to explain outputs and the main criteria behind them (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-explanation-measures
- Operators of high-impact AI must ensure human management and supervision (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-human-oversight
- Government agencies must disclose to consumers that they are interacting with an AI system (Texas Responsible AI Governance Act (TRAIGA)): https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-agency-ai-interaction-disclosure
- Health-care providers must disclose the use of AI in patient services (Texas Responsible AI Governance Act (TRAIGA)): https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-health-care-ai-disclosure
- Respect the right to object to automated decision-making without human intervention (UAE PDPL): https://aipolicytracker.org/obligations/uae-pdpl-automated-decision-objection
- Provide appropriate transparency and explainability (UK AI regulation framework): https://aipolicytracker.org/obligations/uk-principles-transparency-explainability
- Provide routes to contest AI outcomes and seek redress (UK AI regulation framework): https://aipolicytracker.org/obligations/uk-principles-contestability-redress
- Apply safeguards to solely automated decisions with significant effects (ICO AI guidance): https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards
- Publish an annual AI use-case inventory (OMB M-25-21): https://aipolicytracker.org/obligations/us-omb-m-25-21-use-case-inventory

## Latest changes

Dataset 4559f86f527b → ef1018b7a6a2. Sheet "Oversight duties": 35 → 43 rows (+8). Record citations: 43 → 51.

- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> Built from structured summaries of official texts. Not legal advice. A record whose review status is not "verified" has not been confirmed against its official source by a named reviewer; open the official source before relying on any date or duty. How records are verified: https://aipolicytracker.org/verification.