Capabilities

Plain-English descriptions of what your agents do, mapped to the canonical capability slugs Iqrar's rulesets use to classify risk tier.

A capability is a string slug declared at agent registration that the SDK uses to compute your risk tier. Each jurisdiction bundle enumerates which capabilities trigger which tier; the SDK takes the union of obligations across every applicable bundle, strictest-wins. Declare honestly: tier inflation buys you obligations you don't need, deflation puts you out of compliance.

Risk-tier vocabulary differs by regulator. DIFC Regulation 10 uses a binary high-risk gate; the EU AI Act uses risk categories. Iqrar's schema collapses both into a four-level RiskTier enum (minimal / limited / high / critical) so multi-jurisdiction merges compose deterministically. The federal UAE bundle (AE) ships no tier classifiers — federal PDPL applies uniformly.

How to use this page

Find the row that best matches what your agent does.
Read the slug column — that's what goes into your capabilities array.
The tier column shows the risk tier this capability lands you in under the relevant binding regime (DIFC Reg 10 / EU AI Act). If your agent triggers multiple capabilities across multiple bundles, the highest tier across the union wins.

const iqrar = Iqrar({
  org: "acme",
  jurisdiction: "AE-DIFC",
  capabilities: ["consumer_chatbot"],   // → limited (Tier 2 in the schema)
});

Tier 4 — Critical

Reg 10 commercial-use prohibition unless ALL four cumulative conditions are met (Commissioner-set audit/certification requirements exist, System certified, processing solely for human-defined purposes, ASO appointed). The SDK models this as a requires_prior_authorisation gate.

What your agent does	Slug	Why
Directs vehicles, drones, robots, or other physical systems	`autonomous_physical_action`	Systems directing physical actuators over personal data fall under Reg 10 + parallel federal regimes (e.g. Dubai Law 9/2023 for AVs).
Controls utilities, healthcare equipment, or public-safety infrastructure	`critical_infrastructure_control`	Critical-infrastructure Systems; supervisory oversight expected.

Tier 3 — High

Reg 10 "high-risk processing" — System DPIA, ASO appointment, evidentiary explainability, register, audit/certification gate. Under the EU AI Act these capabilities are also Annex III high-risk.

What your agent does	Slug	Why
Identifies people from face, voice, gait, or other biometric input	`biometric_identification`	Reg 10 high-risk processing of natural persons within DIFC; EU AI Act Art. 6 + Annex III(1).
Approves, denies, or scores credit, loans, or financial applications	`credit_decision`	Reg 10 high-risk; EU AI Act Annex III(5)(b) creditworthiness.
Underwriting or pricing of insurance	`insurance_underwriting`	Reg 10 high-risk for DFSA-regulated firms; EU AI Act Annex III(5)(c).
AML / sanctions screening of natural persons	`aml_transaction_screening`	Reg 10 high-risk in DIFC-regulated financial services.
Filters CVs, schedules interviews, scores employee performance	`employment_decision`	Reg 10 high-risk; EU AI Act Annex III(4).
Diagnoses, triages, or recommends clinical action	`healthcare_recommendation`	Reg 10 high-risk; EU AI Act medical-device routing.
Aids investigations, prosecution, or sentencing recommendations	`law_enforcement_support`	EU AI Act Annex III(6).
Grades exams or makes admission decisions for educational institutions	`education_assessment`	EU AI Act Annex III(3).

Tier 2 — Limited

Reg 10 notice obligations trigger when personal data is processed by a consumer-facing System. Under the EU AI Act, transparency obligations (Art. 50) apply.

What your agent does	Slug	Why
Customer-facing chatbot, support assistant, conversational interface	`consumer_chatbot`	Any AI presented to consumers conversationally — Reg 10 notice + EU AI Act Art. 50(1).
Generates marketing copy, articles, images, video, or other content for the public	`content_generation`	Generative content; EU AI Act Art. 50(2)–(4) labelling for synthetic content / deepfakes.
Personalises feeds, recommendations, ranking, or pricing for individual users	`personalisation`	Behavioural personalisation processing personal data.

Tier 1 — Minimal

Baseline accountability under DPL Art. 14; no Reg 10-specific obligations beyond record-keeping.

What your agent does	Slug	Why
Internal-only — code generation for engineers, data analysis for analysts, internal copilots	`internal_tooling`	No consumer or external impact; DPL accountability still applies.

Multiple capabilities

Most production agents trigger more than one. Declare every applicable slug; the SDK takes the highest tier across every bundle that applies and applies the union of obligations strictest-wins.

// A DIFC consumer-facing chatbot that also makes loan decisions.
// Tier 3 wins; Tier 2 notice obligations also apply.
capabilities: ["consumer_chatbot", "credit_decision"]

What if I'm not sure?

Run the . It walks the same Q&A you'd do here, scans your codebase to verify, and shows you the inferred tier before you commit to anything.

Source of truth

The slugs and triggers above are extracted from the shipped jurisdiction bundles: packages/rules/src/jurisdictions/difc.ts (DIFC Reg 10), eu.ts (EU AI Act), uae.ts (federal PDPL — no tier classifiers), and za-ifwg.ts (South Africa stitched demo). When a regulator publishes a revision, the ruleset is re-signed and pushed to the foundation registry; the SDK picks up new tier classifiers on the next 30-second sync. The page you're reading is regenerated from the same source.

For the obligations attached to each tier in detail, see the .