I came across a new publication from Josh Woodruff and the Cloud Security Alliance this week: The Agentic Trust Framework (ATF).
It proposes applying Zero Trust security principles to AI agents, which of course is sensible enough, but what stood out was a simple idea buried in the framework: giving AI agents seniority levels.
Intern. Junior. Mid-level. Senior. Principal.
The Problem: People Talk About AI Like It’s One Thing
Here’s what happens in every organisation I’ve worked with: someone says “we’re using AI for that”.
What does that actually mean? It could mean 500 different things.. Is it a chatbot? An autonomous system that can access production databases? Is there a human in the loop?
If you are anybody remotely security conscious, there is usually (rightfully) immediate panic trying to understand what the permissions, security controls, governance, and risk profile of this ‘AI’ is.
The typical response of that question is a series of further meetings to explicitly go through a 20-30 page PRD / documentation to answer the concern. The time taken to articulate simply to stakeholders at varying levels is far too long before they can receive an answer.
With this in mind, and the increasing adoption of AI Agents, there is a need to bridge the communication gap:
- Technical teams describe agents in terms of function, frameworks, APIs, and permission scopes
- Business stakeholders hear “AI” and imagine everything from Siri to Skynet
- Risk teams don’t know what technical questions to ask to gauge limitations
Nobody can quickly explain what an agent actually does without a 30-page PRD
So we’ve built sophisticated AI systems but haven’t given anyone a common language to discuss its role and responsibility.
The Solution: Give Your Agents Role Seniority Titles
The ATF framework suggests that agents should progress through autonomy levels based on demonstrated trustworthiness. Map those levels to familiar organisational roles, and suddenly everyone understands:
| Level | Human Analogy | Trust Profile | What They Can Do |
| Intern | Day 1 new hire | Zero trust, full supervision | Read-only, sandboxed, every action reviewed |
| Junior | 6-month employee | Limited trust, frequent check-ins | Pre-approved workflows, human approval for exceptions |
| Mid-level | 2-year employee | Earned trust, spot-checks | Autonomous within boundaries, escalates edge cases |
| Senior | Trusted veteran | High trust, audited retrospectively | Broad autonomy, can delegate to junior agents |
| Principal | Executive delegation | Strategic trust | Can modify workflows, onboard other agents |
When a CISO asks “what can this agent do?”, answering “it’s a Junior-level agent” communicates more than “it has scoped OAuth tokens with behavioural monitoring and sandboxed execution.” People understand that juniors need supervision and potentially make mistakes. They also do not have access to organisational sensitive data, need constant review, advice and guidance on how to improve on a consistent basis.
Creating a defined AI Agent Level framework within the organisation allows for explicit definition of what an Agent is / should be capable of doing, and can then be used to converse with across all stakeholder levels.
Why This Works
It’s a governance model that maps to how organisations already work.
It acknowledges that trust isn’t binary. An agent that’s been running for 6 months without anomalies could / should earn more autonomy. You don’t give a new employee the same access as a 10-year senior. Why would you treat AI differently?
It enables policy creation that makes sense. “No agent above Mid-level in production” or “financial transactions require Senior-level agents with dual-approval from a human.” Try writing that policy using technical specifications.
It makes incident response clearer. “The Senior agent that handles payroll went rogue” immediately signals severity in a way that “the agent with production database write access exhibited anomalous behaviour” doesn’t flow as easy.
It creates accountability structures. Just like employees, agents can be promoted for good performance and demoted (or terminated) for bad behaviour. This maps to existing HR and compliance frameworks that organisations already understand.
Putting This Into Practice
The ATF framework is new and still quite theoretical, but I like the idea so far..
Who Approves Promotions?
You need a clear governance structure and more importantly a reason to do so.. Each level should have a gate to get through in order to proceed to the next level. This should be controlled by a Committee / Steering Group, guided by risk, compliance and business outcome.
- Intern to Junior: Automated based on metrics (time + success rate)
- Junior to Mid-level: Technical lead approval + security review
- Mid-level to Senior: Department head + passed adversarial testing
- Senior to Principal: Executive approval + formal risk assessment
What Metrics Drive Promotion?
This is where the framework needs the most work and thought cycles. How you define the correct metrics to measure the gate? An example generated:
| Metric | Promotion Consideration | Demotion Trigger |
|---|---|---|
| Time in operation | Minimum tenure at each level before eligibility | N/A |
| Successful task completion | Volume and consistency of expected outcomes | N/A |
| Anomaly rate | Below threshold appropriate to your risk appetite | Exceeds acceptable threshold |
| Adversarial testing | Passed red team assessment (Mid+ only) | Failed = immediate review |
| Unauthorised action attempts | Zero | Any attempt triggers review |
| Scope creep | Stays within defined boundaries | Actions outside designated domain |
| Human override rate | Low intervention needed for routine tasks | Frequent corrections required |
What About Demotions?
This is where it gets interesting. If a Senior agent exhibits anomalous behaviour, does it drop to Junior? Immediately or gradually? What’s the rehabilitation path?
A potential option is a staggered approach:
| Flag | Trigger | Response |
|---|---|---|
| Yellow | Minor anomaly, first occurrence | Increased monitoring, no demotion |
| Orange | Repeated anomalies or moderate severity | Demotion by one level, formal review required for re-promotion |
| Red | Unauthorised action or critical failure | Immediate suspension to Intern level, executive review to reinstate |
The Bottom Line
The Agentic Trust Framework is still early.. the GitHub repo has five commits and no actual implementation code. But for me, one of the core insights is valuable: we need a common language to discuss AI agent capabilities that applicable amongst all levels of the business.
“This is a Senior-level agent” could tell you more in four words than most technical documentation tells you in four pages.
Of course, the lower level / implementation details matter, and there’s real work to be done on metrics, governance, and tooling. But to simplify the understanding of the levels of access, governance and risk to stakeholders at all levels, is a big help for where we are today, and the trajectory we’re going..
What do you think? Would agent seniority levels work in your organisation? What metrics would you use?
Sources & Further Reading
- Cloud Security Alliance: The Agentic Trust Framework: Zero Trust Governance for AI Agents (February 2026)
- OWASP GenAI Security Project: Top 10 for Agentic Applications 2026 (December 2025)
- CSA MAESTRO Framework: Agentic AI Threat Modeling (February 2025)
- Woodruff, J.: Agentic AI + Zero Trust: A Guide for Business Leaders