The Security Autonomy Matrix: Deciding What Your AI Agents May Do on Their Own

As security leaders, we are deciding, workflow by workflow, how much work to hand to AI and how independently it may act. Consider an AI agent that removes phishing messages from user mailboxes. It can safely read every mailbox, yet one wrong deletion can permanently remove a legitimate message. Should that agent delete messages on its own, or should a person approve each deletion?

The Security Autonomy Matrix helps security leaders make these decisions deliberately and capture them in one place. The goal is to move beyond the one-off, informal approach many of us use when deploying AI agents for security work.

The matrix is a table with one row for each security workflow in which the AI takes actions whose mistakes could be costly or hard to reverse. Each row records our decisions about:

• How independently the AI may act for each kind of action
• Who is accountable
• Which actions a person approves, overrides, or rolls back
• What risk remains
• When to revisit the decision

The full guide is available for you to use, and I'd love to hear your feedback.

Four ideas from the guide explain why the rows are structured the way they are:

One decision per kind of action. The right unit for an autonomy decision is the kind of action because an agent's actions differ in what a mistake could cost. The guide describes five classes of agent action: Read, Write, Send, Spend, and Delete. A wrong read leaves the data unchanged but may expose it. A wrong write may be recoverable, but at a cost. A message cannot be unsent. An agent can spend a budget before anyone notices. A wrong deletion may be permanent. Each class gets its own autonomy level, so that you can decide, for example, that the phishing agent may read mailboxes on its own while a person approves each deletion.

Five levels of autonomy. The guide describes five autonomy levels. At Manual, a person does all the work. At Advisory, the AI recommends an action while a person carries it out. At Supervised, the AI performs each action, but a person approves it before it takes effect. At Conditional, the AI acts within set limits and a person handles exceptions. At Independent, the AI acts on its own and a person audits its actions afterward. The biggest jump in authority is from Supervised to Conditional because Conditional is the first level at which the AI can act without a person approving each action.

A person approves what's hard to undo. The actions that need a person's approval are those that you cannot undo before the damage spreads. For each action, weigh the blast radius of a mistake against how fast you can reverse it, and let the AI act alone only when reversal is fast enough. You can often widen the AI's autonomy by making an action reversible. Route the phishing agent's removals through a recoverable quarantine instead of using hard deletes. An administrator can then restore a message the AI removed incorrectly, allowing the AI to handle routine removals on its own.

Agents earn autonomy, and every grant expires. An AI agent earns autonomy based on its track record, can lose it, and holds it only until a date you set. For example, an agent can start at Supervised and move up when its record supports the change. The row also records what would make you pull that autonomy back, such as the removal of two legitimate messages in a quarter. A significant change to the agent's model or version is also grounds for reopening the decision because the agent earned its autonomy under the previous one.

Your first matrix can be just two or three rows documenting the authority your AI already holds. The full guide includes a blank template, example rows, and a five-stage adoption path. The matrix also builds on prior work by many professionals and organizations, all credited in the guide.

Give it a try.