Agent control tiers

Proportionate governance. The baseline tier is set by the highest-risk lens from Deciding. For how tiers map to NIST AI RMF and campus rules, see the standards crosswalk. Controls are starting points, not mandates.

Personal / exploratory

Example

Individual productivity assistant on public or own data

Typical controls

Self-check, note purpose, no shared credentials

Shared / low-stakes

Example

Team FAQ agent, internal knowledge helper

Typical controls

Colleague awareness, short README, basic logging

Managed

Example

Faculty course assistant, departmental workflow agent

Typical controls

Data owner awareness, inventory registration, role-based access, sample testing

Institutional

Example

Student advising support, enrollment or HR process agent

Typical controls

Written spec, change advisory, audit logs, automated checks, human review of high-impact actions

Critical

Example

Agent that can initiate financial, academic-standing, or high-volume student decisions

Typical controls

Independent review, executive sign-off, continuous monitoring, red-teaming, kill switch, full traceability

Not sure which tier applies? Score the agent against the six lenses.