AI Agent Approval Policy Builder
PlayCISO heuristic, not a standard. The tiers come from the rules printed below and from your own ratings. Review the result with the owners of the systems involved.
1. Pick the actions your agent can attempt
Tick every action the agent has a tool or credential for, not just what you expect it to do. Defaults are our starting ratings; change them in step 2.
2. Rate each action and read the tier
Blast radius is how much can be affected. Reversibility is how hard it is to undo. Sensitivity is the data or system touched. Rate for your environment, not in general.
Tick actions above and they appear here with a tier.
The rules this tool applies (PlayCISO heuristic, not a standard)
- R1 Anything that changes audit, logging or monitoring, or the agent's own permissions, limits, approval rules or kill switch is Never-allow for the agent.
- R2 Score = blast radius + irreversibility + sensitivity (3 to 9). A score of 9, or 8 with an irreversibility of 3, is Never-allow unless a human does it under break-glass.
- R3 A score of 6 to 8 is Step-up human approval.
- R4 Floor: any action that moves money, changes delegated authority (identities, tokens, roles, new tools) or sends data outside the organisation is at least Step-up, whatever its score.
- R5 A score of 4 or 5 is Allow with logging. A score of 3 or less, with no flags, is Auto-allow.
Your choices stay in this browser (local storage). Nothing is sent to PlayCISO.
TL;DRAt a glance
4 points
- Four tiers: auto-allow, allow with logging, step-up human approval, never-allow (break-glass by a human only).
- Tiers come from five printed rules plus your ratings. They are a PlayCISO heuristic, not a standard, and you can override any tier.
- Step-up approvals show the real action, target, destination and any change in delegated authority; they are single-use, expire and are not approved by the initiating principal alone.
- Exports a policy document (Markdown or PDF) and a generic JSON snippet. Answers stay in your browser.
How the tiers work
OWASP names three root causes of excessive agency: more functionality than the job needs, more permissions than it needs, and too much autonomy, meaning high-impact actions with no independent check. It recommends human approval for high-impact operations and checking authorization in the downstream system rather than trusting the model to decide. This builder is a way to write that down per action.
Each action gets a score from three ratings. The rules, printed in the tool and in every export, turn the score into a tier, with floors for money, delegated authority and data leaving the organisation, and a hard stop for anything that edits the agent’s own controls or the audit trail. The approver, expiry and two-person settings are our defaults for reasoning with, not figures from a standard.
How it differs from its siblings
The Step-Up Approval Lab trains the call on invented scenarios. The Tool Scope Lab practises granting tools. The Guardrails Planner plans guardrail layers. This tool outputs the approval policy itself for your own list of actions. Approval is one control; confirm the others with the Vendor Boundary Test Kit.
Frequently asked questions
What is an approval policy for an AI agent?
It is a written rule set that says, for each action an agent can attempt, whether it may go ahead alone, go ahead with logging, wait for a human to approve it, or never be done by the agent at all. It also says who may approve and what they must see.
How does the tool choose a tier?
It adds three ratings you set, blast radius, irreversibility and sensitivity, each from 1 to 3, and applies five printed rules. Changes to audit settings or to the agent’s own controls are never allowed for the agent. High scores are step-up or break-glass only. Moving money, changing delegated authority or sending data outside the organisation is at least step-up. These rules are a PlayCISO heuristic, not a standard.
Why can’t the person who started the agent approve alone?
If the same principal starts the task and approves its high-impact steps, the approval adds little when that principal’s session is compromised or the request was manipulated. For the highest-impact actions the tool asks for two approvers, at least one an owner of the target system.
What must the approver be shown?
The real action produced from the request that will run, not the agent’s summary; the exact target; the destination of any data, money or content; any change in delegated authority; and what differs from the usual pattern. Approval should be single-use and expire.
How is this different from the Step-Up Approval Lab and the Tool Scope Lab?
The Step-Up Approval Lab is a scored scenario that trains the judgement. The Agent Tool Scope Lab practises granting minimum tools. This builder produces a policy document and a JSON snippet for your own agent’s actions. Use the Task Permission Scoper next to decide what each task may touch in the first place.
Is the JSON tied to a specific product?
No. It is a generic snippet with tier, approval requirements and ratings per action. Translate it into the approval or policy features of your own platform; we make no claims about any vendor’s controls.
Are my answers sent anywhere?
No. They stay in this browser’s local storage. The exports are built in your browser.
Sources
Pages below were fetched on 4 November 2026. We restate them in our own words.
- LLM06:2025 Excessive Agency — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.Names excessive functionality, excessive permissions and excessive autonomy as root causes; prevention includes minimising tools and permissions, human approval for high-impact actions and checking authorization in the downstream system.
- OWASP Top 10 for LLM Applications 2025 (includes LLM06 Excessive Agency, LLM03 Supply Chain) — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- Agentic AI: Threats and Mitigations (v1.0) — OWASP Gen AI Security Project, Agentic Security Initiative, 17 February 2025. Accessed 4 November 2026.
- Zero Trust Architecture (SP 800-207) — NIST, August 2020. Accessed 4 November 2026.
- Security Best Practices (Model Context Protocol) — Model Context Protocol project, as served 4 November 2026. Accessed 4 November 2026.Covers confused deputy, token passthrough, SSRF, session hijacking, local server compromise and scope minimization.
- Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5) — NIST, September 2020, updates as of 10 December 2020. Accessed 4 November 2026.The fetched publication page lists the Access Control family but not control text, so AC-6 (Least Privilege) and AC-3 (Access Enforcement) are named by their official titles only; the wording on our pages is ours.
We tried to read Replit’s “Agent Habitat Architecture” post on 4 November 2026 and the page returned an error, so nothing here relies on it. Replit sells a managed agent product; treat any vendor framework as a vendor’s view, not a standard.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.