Classifying an AI agent means assigning every action it can take to one of the 4 trust zones of the LOOP™ protocol: green (the agent acts on its own), orange (a human approves before execution), red (the agent stops and escalates) or black (immediate block). The classification comes before go-live and sets the human control for each action.

Why classify before deploying

Deploying an agent without classifying it is like signing a blank check. Some of its actions are reversible and harmless, others engage the company's liability, and the time to know which is which comes before production. The LOOP™ framework therefore requires an ex-ante classification, in one of the 4 trust zones, before any deployment.

Zones are set action by action

In LOOP™, the zone is attached to each action the agent can take. A finance agent can generate a standard report in the green zone, submit a large invoice for approval in the orange zone, and be blocked in the black zone if it tries to reach payroll data.

Clear governance upstream makes everyday use smoother

Classification serves speed as much as caution: once an action is classified as green, teams can use it freely, without going back to a committee for every new case. Rules set upstream (zone, approver, escalation thresholds) also spare teams case-by-case arbitration once the agent is running.

Green zone: autonomous execution

The agent executes without prior approval: the decision is made, the action carried out, the result logged. LOOP™ keeps this autonomy for cases where the agent's confidence is above 90%, on low-risk, high-volume tasks. Spot checks review a sample of decisions afterwards, and humans keep the authority to switch the agent off, trace or correct it at any time.

Examples of green-zone actions

This zone holds low-risk, reversible actions where an error costs little and the agent repeats the task at scale.

Orange zone: human approval before execution

The agent prepares a complete, reasoned recommendation, and a designated person approves it before the action goes out. The approval window is set per use case in the registry: real time for a customer exchange, longer for a supplier order. The agent's confidence sits between 70% and 90% here, so it does most of the preparation and errors are caught before they leave the organization.

Examples of orange-zone actions

The orange zone suits actions whose impact is visible outside the company, which can only be partly reversed, and for which an approver is actually available. Without an available approver, the orange zone turns into a queue, and a long queue pushes people to approve without reading.

Uses that the EU AI Act classifies as high-risk belong at least in this zone. Annex III of Regulation (EU) 2024/1689 of 13 June 2024 lists recruitment and the assessment of natural persons' creditworthiness among them. Its Article 14 requires effective human oversight of these systems, an obligation that applies from 2 December 2027 under the postponement set by Regulation (EU) 2026/1744, in force since 27 July 2026.

Red zone: mandatory escalation

In the red zone, the agent stops. It documents what it understood and what it is missing, then alerts the owner named in the registry, who must decide within 4 hours: no automatic action is possible in this zone. An action lands here when the agent's confidence drops below 70%, when the situation falls outside what was planned, or when the stakes require a person to decide with full knowledge of the facts.

The agent still does useful work upstream: it gathers the documents and flags what made it hesitate, so the owner can decide quickly without rebuilding the context.

Examples of situations that trigger escalation

Actions that end up here have a major impact and limited reversibility, and they often fall under binding regulation. This classification keeps the agent in production and marks the point where control returns to a person.

Black zone: immediate block

The black zone covers everything that is absolutely out of scope. As soon as the agent detects such a situation, it blocks execution, the CISO is alerted and the full audit trail is activated: no action, no attempt. No human approval makes these actions acceptable for an agent, which is what separates the black zone from the red zone, where a person takes back control to decide.

Examples of blocked situations

The last two examples reflect a choice by the organization, which lists in the black zone the decisions it refuses to hand to an agent, whatever controls are in place. The governance committee reviews this list every quarter, and an excluded use can come back into scope, in a zone where a human keeps the decision, if the regulatory framework changes.

The criteria that determine the zone

Classification rests on the risk, volume, traceability and reversibility of each action. Each criterion is rated on a simple scale (low, medium, high), and the zone follows from the combination of all four ratings.

This classification is set at design time. The LOOP™ confidence thresholds (above 90% in the green zone, 70% to 90% in the orange zone, below 70% in the red zone) then apply at run time, case by case.

Risk

What is the impact of a wrong decision? Risk is measured on three dimensions: financial (the cost of an error), legal (regulatory exposure) and reputational (the effect on the brand). An agent that recommends a product carries low risk, while an agent that commits spending carries medium to high risk.

Volume

An agent called 10 times a day does not carry the same criticality as one called 10,000 times. Volume changes the nature of the risk: a low error probability becomes a real problem once it applies to thousands of cases, and a systematic error spreads before anyone notices.

Traceability

Can you reconstruct the decision afterwards and explain why the agent chose one action over another? Traceability matters all the more in regulated use cases (finance, legal, HR). A poorly traced action deserves a more controlled zone than an identical action whose every step is logged, because in a dispute the trace is what counts.

Reversibility

Can the action be undone? A ticket routing can be fixed in one click, an email sent to a customer much less easily, and an executed wire transfer not at all. The less reversible the action, the earlier the control has to happen, ideally before execution.

Matrix example

Applied to common agents, the grid reads as follows:

How to move an agent from one zone to another

Classification evolves with the agent. An action classified as red can move to orange, then to green, after a documented period of stability whose length the committee sets at classification time. The reverse also happens: a green action that piles up incidents moves back to orange without waiting for the next review.

Who proposes and who approves

The business sponsor, who knows the use case and its consequences, proposes the initial classification, and a three-way committee bringing together the business, IT and the AI lead approves it. That Chief AI Officer, in-house or outsourced, oversees the registry, which Koneetiv teams maintain when LOOP™ is deployed with them. The CAIO also makes sure two comparable actions do not end up in different zones depending on which team owns them.

The reclassification process

Reclassification follows the same collegial principle and usually runs as follows:

  1. Metrics collection: volumes, error rates, incidents, drift, user satisfaction and the number of corrections made by approvers
  2. Committee review (business sponsor, CAIO, IT)
  3. Documented decision, with its rationale and the thresholds that would trigger a rollback
  4. Living registry update: new zone, new review date, new sponsor if needed
  5. User communication, so people know what the agent now does on its own

The indicators that guide the decision

For an orange action, the rate of approvals without changes is the clearest signal: if it stays very high throughout the observation period, the approver adds little and a move to green is worth discussing. For a red action, the committee looks at the number of escalations and the quality of the files the agent passes on. A reclassification is decided on registry data, so the registry has to record every approval, rejection and escalation.

Symptoms of poor classification

A poor classification shows up in operating data:

These signals stay invisible as long as monitoring stops at the agent's uptime and cost. A useful dashboard shows them action by action, next to the business metrics the sponsor already tracks.

The most common classification mistakes

Classifying by model

The zone depends on how a model (Claude, GPT, Llama) is used, and two agents built on the same model can belong to different zones. A rule such as "everything using Claude is in zone X" confuses the tool with the use, and produces classifications that rarely survive the first incident.

Giving the whole agent a single zone

The agent then inherits the zone of its riskiest action and loses what justified deploying it: an accounting assistant placed entirely in the red zone escalates tasks nobody needed to see. Classifying action by action avoids pushing every task to the strictest level of control.

Putting everything in the red zone by default

"We classify all our agents as red zone by default." The rule sounds reassuring, yet it is false prudence: it overloads escalation owners, blocks simple use cases and discredits a governance process that teams end up working around.

Avoiding the red zone

The opposite habit is to refuse the red zone on principle. Yet it organizes a structured handover: the agent stops and passes control to a person, file in hand. Ruling it out leads teams to put actions in the orange zone by mistake, where a busy approver may sign off on something that needed a real decision.

Forgetting the black zone

An empty black zone should worry the committee. Deciding to keep AI away from a use case is an explicit decision, to be documented and reviewed periodically like any other classification.

Freezing the classification

"Once classified, it never changes." This rule contradicts the "Living" principle of LOOP™: an agent evolves, improves or drifts, its data changes, and the classification has to follow at each review.

Classification as a dialogue tool

Classifying an agent is an act of governance that also gives business teams, IT, compliance and the board a shared language. Each speaks its own: the business talks value, IT talks technical risk, compliance talks rules, the board talks exposure. The 4 trust zones provide a common vocabulary that lets them discuss specific actions, zone by zone.

A blocked agent can restart once it is classified

That vocabulary offers a concrete way out of stalled debates. An agent blocked by the CISO can restart once its sensitive actions are classified as red, with written escalation rules. An agent blocked by a business team can resume once its actions move to orange, under closer supervision.

How to document a classification

A classification is only worth something once it is documented. The living registry keeps at least the following information:

These fields overlap with the dimensions of the LOOP™ living registry: agent identity, owners, data accessed, versioned instructions, scope, metrics and history. An up-to-date registry is the reference whenever people disagree about what an agent is allowed to do.

It also serves as evidence during an ISO 42001 audit: the standard requires defining the scope of the AI management system (clause 4.3) and maintaining its documented information (clause 7.5), two requirements the registry feeds directly.

Where to start

Koneetiv applies LOOP™ at every stage of an agent deployment:

Before classifying anything, it helps to know where the organization stands. The AI maturity assessment gives a first reading in a few minutes and scores governance as one of its six dimensions, a useful reference point before the classification work starts.

Classification remains the first decision in an agent deployment: it sets the pace of go-live as much as the evidence available for an audit. The blog's AI governance and compliance category also covers the LOOP™ protocol in detail, the Chief AI Officer role and the EU AI Act timeline.