Methods and protocols
Risk × autonomy classification
This matrix supports internal triage. It does not replace legal analysis, security analysis, or an impact assessment.
Axis 1 — Use-case impact
| Level | Description | Indicative examples |
|---|---|---|
| R0 | Internal, public, easily verifiable, with no consequence for a person | Summarizing a public text, ideation |
| R1 | Work assistance with validation and recoverable errors | Drafting, document research, internal classification |
| R2 | Personal data, external communication, or modification of a system | Customer reply, CRM update, operational recommendation |
| R3 | Rights, health, employment, credit, benefits, surveillance, public authority, or critical infrastructure | Eligibility, diagnosis, allocation, enforcement, regulated decision |
A use case moves to the higher level as soon as one higher-level characteristic is present. Frequency and scale can also raise the level.
The interactive triage applies this rule mechanically: low-impact A0 information or advice is R0; the same low-impact work with A1 or greater assistance is R1; material impact, personal or sensitive data, or direct external interaction is at least R2; high impact or an automated decision about a person is R3.
Axis 2 — Technical autonomy
| Level | Capability |
|---|---|
| A0 | Information or advice only |
| A1 | Search, extraction, classification, or draft |
| A2 | Action only after explicit, informed human approval |
| A3 | Autonomous actions bounded by permissions, budget, duration, and destinations |
| A4 | Broad, multi-system, or self-extending autonomy — disabled by default |
Minimum control by combination
| Combination | Minimum control |
|---|---|
| R0–R1 / A0–A1 | Owner, data rules, domain tests, change log |
| R1–R2 / A2 | Qualified approval, output validation, complete log, tested return |
| R2 / A3 | Threat model, least privilege, limits, monitoring, adversarial tests |
| R3 / any level | Legal qualification, impact assessment, formal governance, audit, and human recourse |
| Any risk / A4 | Documented executive exception, evidence that A3 is insufficient, stronger containment, and independent audit |
The table lists minimum anchors, not every possible pair. For a combination that is not written verbatim, apply every row that matches either axis and keep the stricter control. For example, R2/A1 still requires the R2 protections; R1/A3 still requires the A3 threat model, least privilege, monitoring, and adversarial testing.
Triage questions
- Could an error affect a right, benefit, job, health, or safety?
- Does the system process personal, sensitive, confidential, or privileged data?
- Does a person know they are interacting with an AI system when required?
- Can the system write, send, purchase, publish, delete, or modify?
- Is the action reversible? Within what time?
- Is human approval real, informed, and feasible within the available time?
- Can the system read untrusted content and then call tools?
- Could errors multiply at scale before detection?
Document the answer and evidence in the risk-assessment template.
To print or save as PDF: Ctrl+P (⌘P on Mac).
Source and history · GitHub