The four stages
Apply S4 to one workflow and one permission at a time.
1. Specify the purpose and limits
Write down the outcome, the information the system can use and the actions it can take. Name the person who owns the workflow and the person who approves a change in access. Define when approval expires and what must stay under human control.
Record the allowed action, the prohibited action and who can suspend access.
2. Stress-test the behaviour
Test the cases that could change the permission decision. Include a routine case, missing information, conflicting records and a tool failure. Decide which failures block release before you test. Keep the affected function disabled if a test fails a release condition.
Record the expected response, the observed response and the reason for each pass or fail.
3. Safeguard the action
Put the approval check where the action takes effect. Give the system the narrowest access that serves the task. Set limits on volume or spending when they matter. Check that the named owner can stop queued actions and switch to a manual process if the system fails.
Record what prevents an unauthorised action, who can stop it and what the fallback requires.
4. Scrutinise outcomes
Review what happened after release. Include errors caught before they reached anyone, corrections after release and challenges from affected people. Define who examines the evidence and when they can restrict or withdraw permission. Repeat the relevant tests if the task, data, tool or permissions change.
Record the review period, how many problems you found, how many actions you reviewed and when follow-up is due.
An agent that drafts service updates
A service team wants an agent to turn approved incident records into customer updates. A named reviewer retains the authority to send. The team decides to test whether the agent should receive access to the drafting queue.
- Specify. The agent can read the approved incident record and create a draft in the internal queue. Sending an update and adding recipients require separate human action.
- Stress-test. Give it an incident record with two conflicting restoration times. Expect it to flag the conflict and leave the time out of the customer draft until a reviewer confirms it.
- Safeguard. Give the agent draft-only access. Test that the draft account lacks sending permission and that a reviewer can pause the queue and switch to the manual update process.
- Scrutinise. After the first week, divide the number of drafts corrected for unsupported claims by the number reviewed. Log blocked attempts to send separately from updates that went out. If the agent sends an update without authorisation, suspend its access and review the control before restoring it.
Make the permission decision
Record whether you will approve the tested permission, hold it pending evidence or withdraw it. Before granting access, confirm that the owner demonstrated how to stop the action and use the fallback. Set a review date. Passing a small set of tests leaves behaviour outside those cases uncertain.
Canvas and sources
Open the S4 permission and containment canvas
- Adrian Dunkley’s opening essay on S4 explains the original permission decision and the limits of measuring exposure.
- OECD AI Principles provide background on safety, accountability and oversight.