Risk-tiered tool authorisation with mandatory approval gates

Control objective

Risk-tiered tool authorisation checks that an AI agent can only invoke tools (APIs, database writes, payment rails, ticket creation) in proportion to how much damage each tool could cause, with the riskiest actions gated behind a human sign-off. It matters because an autonomous agent left unchecked could initiate a fund transfer, close an account, or push a regulatory filing without anyone reviewing it. Tools are classified into tiers (read-only, low-impact, high-impact, Critical) and the control enforces that 100% of Critical-tier tools sit behind a human approval gate, that there are 0 unauthorised invocations, and that any binding action is human-signed. To implement it, build a central authorisation broker that every tool call routes through: the broker resolves the tool's tier, checks the agent's granted scopes, and for Critical actions pauses execution to request explicit human approval before proceeding. Log every request, its tier, the approver identity, the cryptographic signature on binding actions, and any denials. The threshold is absolute - any Critical tool reachable without approval, any unauthorised call, or any unsigned binding action is a breach that should block the action, raise an alert, and trigger review of the agent's permission configuration. Aligns with OWASP ASI02, IBM Unauthorized Use, and MAESTRO L3.