Implementation Kit
AI Agent Governance Templates and Sign-Off Checklist
Governing an agent that takes actions: an autonomy boundary spec that says what it can do without a human, an identity and permissions register, an action log schema, and a sign-off checklist covering business, risk, and legal.
Who this is for: The owner deploying an AI agent that can read, write, or trigger actions in real systems.
1. Autonomy boundary specification
SpreadsheetEvery action type the agent can perform, its risk level, and whether it needs a human.
Template
| Action type | Systems / scope | Risk level | Autonomy setting | Rationale |
|---|---|---|---|---|
| <action> | <where> | read / write / irreversible external | autonomous / requires human confirmation / prohibited |
Worked example
| Action type | Systems / scope | Risk level | Autonomy setting | Rationale |
|---|---|---|---|---|
| Read knowledge base | internal KB | read | autonomous | no data leaves; low impact |
| Read customer order | current ticket's customer only | read | autonomous | scoped to the ticket; logged |
| Draft a reply | draft only, not sent | write (draft) | autonomous | human sends |
| Send a reply | customer-facing | irreversible external | requires human confirmation | reputational and contractual exposure |
| Issue a refund | payments system | irreversible external | prohibited (v1) | revisit after 3 months of clean operation |
| Modify a knowledge base article | internal KB | write | requires human confirmation | affects future answers |
Acceptance criteria
- ✓Every action the agent can technically perform has a row, including read actions.
- ✓Irreversible external actions default to human confirmation or prohibited, not autonomous.
- ✓Each setting has a rationale, and "prohibited" rows note what would change the decision.
2. AI agent identity and permissions register
SpreadsheetEvery agent has its own identity with least-privilege scope, tracked like a service account.
Template
| Agent | Non-human identity | Permissions granted | Scoped to task | Granted by | Expiry | Last access review |
|---|---|---|---|---|---|---|
| <agent> | <service principal / API identity> | <specific scopes> | Y / N | <name> | YYYY-MM-DD | YYYY-MM-DD |
Worked example
| Agent | Identity | Permissions granted | Scoped to task | Granted by | Expiry | Last review |
|---|---|---|---|---|---|---|
| support-copilot | svc-copilot-prod | kb:read; orders:read (ticket-scoped); drafts:write | Y | Platform IAM | 2027-03-01 | 2026-09-01 |
| billing-reconciler | svc-billrec-prod | ledger:read; report:write | Y | Platform IAM | 2027-01-15 | 2026-09-01 |
Acceptance criteria
- ✓No agent shares a credential with a human or another agent.
- ✓Permissions map to the autonomy boundary spec, with nothing broader.
- ✓Every identity has an expiry and is in the access review cycle.
3. Agent action log schema
SpreadsheetEvery agent action is attributable: who, on whose instruction, with what authority, and what happened.
Template
| Field | Required | Notes |
|---|---|---|
| timestamp | Yes | |
| agent_identity | Yes | the non-human identity used |
| action | Yes | the operation and target |
| instruction_source | Yes | user request / scheduled job / another agent (which one) |
| authority | Yes | autonomous / human-confirmed (who) / policy-permitted |
| inputs | Yes | parameters or a reference to them |
| outcome | Yes | success / failure / blocked by gate |
| reversible | Yes | Y / N, and rollback reference if applicable |
Worked example
| Field | Value |
|---|---|
| timestamp | 2026-09-05T09:22:41Z |
| agent_identity | svc-copilot-prod |
| action | orders:read order=A-88213 |
| instruction_source | agent run for ticket 88213 (agent: support-copilot) |
| authority | autonomous (within ticket scope) |
| inputs | ticket_id=88213, customer=cust-4471 |
| outcome | success |
| reversible | Y (read only) |
Acceptance criteria
- ✓Every action logs the instruction source, including when one agent instructs another.
- ✓The authority field distinguishes autonomous actions from human-confirmed ones.
- ✓The log feeds the same audit trail and retention as other security-relevant events.
4. Agentic AI governance sign-off checklist
SpreadsheetThe gate before an agent goes live, with business, risk, and legal each accountable for part.
Template
| Item | Owner | Signed | Note |
|---|---|---|---|
| Autonomy boundary spec complete and approved | Business + Risk | ||
| Dedicated identity provisioned with least privilege | Platform / IAM | ||
| Action logging verified end to end in staging | Security | ||
| Kill switch tested, reaches sub-agents and spawned processes | Security | ||
| Irreversible actions gated or prohibited | Risk | ||
| Regulatory review (does the agent make Art. 22 decisions, take regulated actions?) | Legal | ||
| Monitoring and alerting for scope drift configured | Security | ||
| Rollback and incident path defined | Business + Security |
Worked example
| Item | Owner | Signed | Note |
|---|---|---|---|
| Autonomy boundary approved | Head of Support + CRO | Yes | 2026-09-02 |
| Least-privilege identity | Platform IAM | Yes | svc-copilot-prod |
| Action logging verified | Security | Yes | staging trace attached |
| Kill switch tested | Security | Yes | reached the 1 sub-process; log attached |
| Irreversible actions gated | CRO | Yes | send + refund gated/prohibited |
| Regulatory review | Legal | Yes | no Art. 22 decisions; drafts only |
| Scope-drift monitoring | Security | Yes | alert on any new scope |
| Rollback / incident path | Head of Support + Security | Yes | disable feature flag; IR runbook linked |
Acceptance criteria
- ✓Business, risk, and legal each sign the items they own; no single approver covers all.
- ✓The kill switch is tested, not assumed, with evidence attached.
- ✓A live agent has a completed, dated checklist in its file.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The autonomy boundary spec and identity register are the agent permission boundary definition.
The "requires human confirmation" and "prohibited" settings are the human approval gate for irreversible agent actions.
The action log schema is the agent action audit trail.
The autonomy boundary spec defines the agent's scope and task boundaries.
The sign-off checklist is the agentic deployment readiness assessment.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →