Permissions, permissions, permissions

Countersign is an application for services organisations to harness, control, manage and measure AI working alongside staff, starting with private markets fund administration. There will be a webinar in November for anyone who wants to see it; follow the Countersign page on LinkedIn to stay informed.

In the meantime, a few observations baked into Countersign that apply to anyone putting AI into an enterprise. First one: permissions.

Permissions, permissions, permissions. I think we need to rethink access and permissions where an agentic workforce is involved. Switch-based permissions: on/off, read/write, send/receive are too crude for a workforce that includes agents. They were designed for people, who bring their own judgement to every task. An agent brings none, so the judgement needs to be controlled by the organisation.

One approach is prompt and instruction engineering — write the rules into what the model is told. I don't think that is right. Every rule added to a prompt widens the brief put to the model and competes with the task. A rule in a prompt is followed most of the time, but not every time, and that is not a control. The rules also have to be rewritten for each model and re-proven on every version, which makes multi-model and model resilience harder. And you can't show an auditor a prompt and call it a permission. So in my view the organisation controls this in the system the agents work inside — one system of control, with a far more comprehensive permissions system than on/off.

We've solved this before, in banking. Payment systems don't have an on/off switch; they have a dial: who can view, who can approve, at what level (one signatory, two, A+B), by transaction type, configured per account to the firm's risk appetite. Agentic operations need the same thing, applied to processes and every task.

Take two tasks. Posting the bank-charges journal that has gone through cleanly every month for five months: low risk. Replying to a regulator about a filing query: high risk. People know this instinctively and bring more care where it's needed. Agents have to be told — by task, by risk class — what they may do.

So: rate the risk of every task and record it. Decide, by task and risk class, what an agent may do. Use the firm's own risk framework, plus the new classes agents bring — context risks among them. For example: routine, low-risk internal work runs autonomously under a policy the firm sets; anything that leaves the firm — to a client, an investor, a regulator, a bank — carries a higher rating and is released by a named person, per item, every time.

The firm controls the permissions 'dial'. As confidence builds, or as risk appetite shifts across service areas, the firm turns it. Not the model nor a vendor. Responsibility, and line of sight over it, stay with the firm and evidence assembles in real time.