Tier
Set autonomy per action, from suggest only to act and settle, based on reversibility and impact.
Done when: Irreversible actions never sit above the reviewed tier.
Agent Operations Framework (AGENT)
Agent Operations Framework
Autonomy tiers, tool boundaries and human checkpoints, so agents can act without becoming a liability.
The business problem
Agents that act need rules before they act.
An agent can update SAP, send an email or approve a refund. Without limits, approvals and logs, one wrong step reaches customers.
What you hear inside the organisation
What exactly is the agent allowed to do?
Who approves before it writes to the system?
We cannot trace why it took that action.
Operations will not trust it.
Who it serves and what changes
Your teams, before and after the Agent Operations Framework
Client teams and what they need
Operations leaders
Agents that follow the process
IT and integration
Safe access to core systems
Risk and audit
A full action log
Front-line staff
Clear hand-off to people
The outcome you get
- Defined permissions per agent and action
- Human approval where risk demands it
- Every action logged and explainable
- Agents measured like any operating team
A worked example
A finance team using an agent for supplier invoices
The problem we saw
The agent could post to SAP, but nobody had defined its limits. Risk refused to let it run.
How the framework solved it
We set what it may do alone, what needs approval above a threshold, and logged every action with its reason.
The business result
Routine invoices flow without delay, exceptions reach a person with context, and audit can trace every posting.
Illustrative example based on common client situations.
In short
What is the Agent Operations Framework?
Agent Operations Framework (AGENT): Autonomy tiers, tool boundaries and human checkpoints, so agents can act without becoming a liability.
An agent that can act is a system with permissions, not a chat feature.
- How it moves
- Each step closes with a check before the next begins
- Owned by
- Owned jointly by the process owner and security; operated by the platform team.
- You keep
- Autonomy tier policy, Tool permission map, Agent evaluation suite
How it works
How the Agent Operations Framework works
Autonomy is earned per action type, not granted to an agent as a whole. The same agent can draft freely yet only suggest on payments.
Bound
Give each tool a scope, a rate limit, a spend limit and an identity of its own.
Done when: The agent's identity has least privilege and is separate from a human account.
Checkpoint
Insert human approval where value, risk or irreversibility crosses a threshold.
Done when: Every checkpoint has a target response time and a default if it times out.
Evaluate
Score task completion, tool-call correctness, cost per task and harmful-action attempts.
Done when: Agent evaluations run per release, including adversarial cases.
Observe
Trace every run: plan, tool calls, data touched, cost, outcome.
Done when: Any action can be replayed from the trace during an investigation.
Contain
Keep a kill switch, a rollback path and a defined incident response for agent behaviour.
Done when: The kill switch is tested, not assumed.
Is it right for you?
Is the Agent Operations Framework right for you?
A strong fit if
- You plan agents that write to business systems
- Customer or financial actions are involved
- Operations needs confidence before scale
Probably not yet if
- You only need a read-only chat assistant
- Processes are not yet documented
Free assessment
Discuss the Agent Operations Framework with our team
A working session with our senior team. We review what fits your situation, what does not, and where to start.
A focused conversation
We listen to your situation and goals.
Fit review
Which parts of this framework apply to you, and which do not.
A written view
Clear next steps, whether or not you work with us.
Go deeper
Applying the Agent Operations Framework in practice
Open only the part you need: how it starts, what your team keeps, maturity levels, sector rules and the evidence a reviewer will ask for.
An agent that can act is a system with permissions, not a chat feature. AGENT defines how much autonomy a workload gets, what it may touch, who reviews it and how it is stopped.
Version
v1.6
Last reviewed
August 2026
Family
AI Operating System
How this was developed: Built from delivery practice on Saudi and international engagements, then reconciled clause by clause against the published standards below. Revised when a standard is updated or a gate proves unworkable in the field.
One-pager
Download the AGENT one-pager
Stages, exit gates, artefacts, standards crosswalk and FAQs for Agent Operations Framework on one printable page, share it with the committee.
- Week 1
Write the agent's mandate: the decisions it may take and the ones it must escalate.
- Week 2
Give it its own identity and least-privilege access to a named set of tools.
- Week 3
Evaluate at task level, including adversarial and refusal cases.
- Week 4
Rehearse containment: pause the agent, reverse its actions, and record the drill.
- End of the first thirty days
Autonomy tier policy
Which action types may run at which tier, and who approves changes.
Tool permission map
Scopes, identities, rate and spend limits per tool.
Agent evaluation suite
Task, tool-correctness and adversarial tests wired into release.
T0
Assistive
Drafts only; a human performs every action.
T1
Approved actions
The agent proposes, a human approves each step.
T2
Bounded autonomy
It acts within limits, with reversible operations only.
T3
Supervised autonomy
It acts and reports; humans sample and audit.
T4
Delegated
Full delegation for a narrow, well-evaluated task class.
Banking & finance
Payments and limit changes stay at suggest or draft level, with dual approval.
- Who reviews it
- SAMA, plus PDPL and NCA controls
- Systems in scope
- Core banking, cards, KYC and AML systems, credit bureau feeds, the general ledger
- Where it lands first
- KYC and AML review, credit decisioning support, complaint and dispute handling
1
Tier
- Autonomy tier record
- Reversibility analysis
2
Bound
- Tool permission map
- Budget and rate limits
3
Checkpoint
- Checkpoint policy
- Approval queue design
4
Evaluate
- Agent eval suite
- Adversarial test log
5
Observe
- Run traces
- Cost per task view
6
Contain
- Kill-switch test
- Incident playbook
Autonomy is earned per action type, not granted to an agent as a whole. The same agent can draft freely yet only suggest on payments.
Stage
Exit gate
Artefacts
1
Tier
Set autonomy per action, from suggest only to act and settle, based on reversibility and impact.
- Signed off by
- Process owner
- Typical duration
- Scoped with you
Exit gate
Irreversible actions never sit above the reviewed tier.
Evidence: Autonomy tier decision stating what the agent may and may not decide
Artefacts
- Autonomy tier record
- Reversibility analysis
2
Bound
Give each tool a scope, a rate limit, a spend limit and an identity of its own.
- Signed off by
- Security and application owners
- Typical duration
- Scoped with you
Exit gate
The agent's identity has least privilege and is separate from a human account.
Evidence: Tool and permission matrix with least-privilege proof
Artefacts
- Tool permission map
- Budget and rate limits
3
Checkpoint
Insert human approval where value, risk or irreversibility crosses a threshold.
- Signed off by
- Operations lead
- Typical duration
- Scoped with you
Exit gate
Every checkpoint has a target response time and a default if it times out.
Evidence: Human-in-the-loop checkpoints with recorded overrides
Artefacts
- Checkpoint policy
- Approval queue design
4
Evaluate
Score task completion, tool-call correctness, cost per task and harmful-action attempts.
- Signed off by
- Evaluation owner
- Typical duration
- Scoped with you
Exit gate
Agent evaluations run per release, including adversarial cases.
Evidence: Task-level evaluation set including adversarial and refusal cases
Artefacts
- Agent eval suite
- Adversarial test log
5
Observe
Trace every run: plan, tool calls, data touched, cost, outcome.
- Signed off by
- Platform and service owners
- Typical duration
- Scoped with you
Exit gate
Any action can be replayed from the trace during an investigation.
Evidence: Action-level trace, cost ceiling and alerting wired to a named human
Artefacts
- Run traces
- Cost per task view
6
Contain
Keep a kill switch, a rollback path and a defined incident response for agent behaviour.
- Signed off by
- Service owner
- Typical duration
- Ongoing
Exit gate
The kill switch is tested, not assumed.
Evidence: Containment and rollback drill executed, not just documented
Artefacts
- Kill-switch test
- Incident playbook
Standard
What this framework satisfies
OWASP LLM Top 10LLM01 injection · LLM06 excessive agency · LLM07 insecure plugin/tool use
Injection, excessive agency and insecure tool use covered in Bound and Evaluate.
MITRE ATLASReconnaissance · ML attack staging · Exfiltration tactics
Adversarial technique catalogue used for the agent red-team set.
NIST AI RMFMANAGE 4 (incident response, containment, recovery)
Manage function, incident response, containment and rollback.
NCA ECCECC 2-2 identity and least privilege · 2-12 event logging
Identity, least privilege and logging requirements applied to non-human actors.
One shared service account
Without a distinct identity per agent, no action can be attributed after the fact.
Unbounded tools
A tool with broad scope turns a prompt-injection into a data incident.
No cost ceiling
Looping agents are a budget risk before they are a safety risk.
Built on
- 1
OWASP Top 10 for LLM Applications and MITRE ATLAS
The AI attack surface and adversarial technique catalogue.
- 2
EU AI Act
Risk tiering, documentation and transparency obligations.
- 3
NCA Essential and Cloud Cybersecurity Controls
National Cybersecurity Authority control catalogues.
- 4
NIST AI Risk Management Framework 1.0 and Generative AI Profile
National Institute of Standards and Technology, Govern, Map, Measure, Manage.
Citations describe the parts of each standard the framework answers. Bilytica is not an accreditation or certification body.
In Saudi Arabia
What this family has to satisfy before a release in Saudi Arabia
The AI operating system frameworks carry a workload from a readiness score to a governed release. These are the Saudi checks each stage is built against.
AuthorityWhat it requiresWhat we buildWhat you keep
SDAIA, PDPL
Purpose, lawful basis and disclosure recorded before the first personal-data field is used.
Diagnosis and assurance stages block a build that has no recorded basis.
Processing register entry attached to the release record.
NCA ECC
Authorisation and containment for anything the system can do on its own.
Agent operations defines action classes, dual control and a tested rollback path.
Containment test result and an authority matrix signed by the business owner.
NDMO data management controls
No workload builds on an uncertified data domain.
The data foundation gate certifies ownership, lineage and quality thresholds first.
Signed domain certificate referenced by the release.
Where it runs
Training, evaluation and serving run inside Saudi Arabia on your infrastructure, with any hosted component documented as a boundary.
Arabic, as it is spoken here
Arabic quality is a release condition: evaluation sets include Saudi Arabic content, not translated English.
FAQ
Frequently Asked Questions
What are the autonomy tiers?
0 suggest, 1 draft for approval, 2 act on reversible steps, 3 act with post-review, 4 act and settle within limits.
Does this replace our security review?
No. It gives the security review a defined object to assess: identities, scopes, limits, traces and a tested kill switch.
What makes an AI agent safe to put in production?
A tier that sets its blast radius, bounded tools, its own identity and credentials, human checkpoints on irreversible actions, and containment that can stop it.
Why does each agent need its own identity?
A shared service account makes actions untraceable and over-permissioned. Per-agent identity gives least privilege and an audit trail per action.
How long does tiering take?
Timeline agreed with you to define tiers and boundaries once; after that it is applied per agent inside normal delivery, not as a separate programme.
Which threat models are used?
OWASP LLM Top 10 for prompt and tool abuse, MITRE ATLAS for adversarial techniques, NIST AI RMF for risk functions, and NCA ECC for enterprise security controls.
Where this sits on the spine
Where this connects
Rest of the library
DFFData Foundation FrameworkAIRMAI Readiness ModelVALUEAI Value FrameworkTRUSTAI Assurance FrameworkDELIVERAI Delivery FrameworkSOVEREIGNSovereign AI FrameworkDMMData Management Maturity ModelDPAData Platform Architecture FrameworkDQFData Quality & Observability FrameworkDECIDEAnalytics & Decision FrameworkDGOVData Governance Operating ModelSDCFSaudi Data Compliance FrameworkAQSArabic Quality StandardKSA-READYIn-country Deployment Framework
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.