Classifying AI agents by model alone is not enough. The same model can power a harmless drafting assistant or a high-risk workflow agent. Classification should focus on context: autonomy, data access, impact, exposure, and control.
A practical classification model helps teams decide review depth, approval path, control requirements, and monitoring expectations.
Autonomy
Start with what the agent can do. Can it only answer questions? Can it draft content for review? Can it recommend decisions? Can it call tools? Can it update records? Can it trigger external actions without human approval?
Higher autonomy usually means higher governance requirements. An agent that drafts a refund explanation is different from one that issues the refund.
Data access
Next, classify the data the agent can read, store, or transmit. Public content, internal documentation, confidential business records, personal data, regulated data, credentials, source code, and customer account data carry different obligations.
Retrieval systems deserve attention. An agent may appear low risk until it receives broad access to internal knowledge bases or customer history.
Impact and affected users
Assess who is affected by the agent's output or action. Internal productivity use is usually lower risk than systems that influence employment, credit, healthcare, education, security, access to services, legal rights, or customer financial outcomes.
Also consider scale. A small internal tool may become high impact if it is embedded into a workflow used by thousands of employees or customers.
Exposure and reversibility
External-facing agents need stronger review because mistakes leave the organization. Reversibility matters too. A wrong draft can be corrected before sending. A wrong account action, public message, or denied service may be harder to unwind.
Controls that reduce risk
Classification should account for controls, but controls should not hide the underlying risk. Human approval, least-privilege tools, monitoring, rate limits, output validation, and incident response can reduce residual risk. They do not erase the need to record why the agent was considered sensitive.
The final classification should be explainable. A good record says: this agent has these tools, this data, this user impact, these controls, and therefore this review path.