# AI Agent Governance Templates and Sign-Off Checklist Governing an agent that takes actions: an autonomy boundary spec that says what it can do without a human, an identity and permissions register, an action log schema, and a sign-off checklist covering business, risk, and legal. **Who this is for:** The owner deploying an AI agent that can read, write, or trigger actions in real systems. Source playbook: https://aigovernance.com/playbook/governing-agentic-ai --- ## Autonomy boundary specification _Every action type the agent can perform, its risk level, and whether it needs a human._ ### Template | Action type | Systems / scope | Risk level | Autonomy setting | Rationale | |---|---|---|---|---| | | | read / write / irreversible external | autonomous / requires human confirmation / prohibited | | ### Worked example | Action type | Systems / scope | Risk level | Autonomy setting | Rationale | |---|---|---|---|---| | Read knowledge base | internal KB | read | autonomous | no data leaves; low impact | | Read customer order | current ticket's customer only | read | autonomous | scoped to the ticket; logged | | Draft a reply | draft only, not sent | write (draft) | autonomous | human sends | | Send a reply | customer-facing | irreversible external | requires human confirmation | reputational and contractual exposure | | Issue a refund | payments system | irreversible external | prohibited (v1) | revisit after 3 months of clean operation | | Modify a knowledge base article | internal KB | write | requires human confirmation | affects future answers | ### Acceptance criteria - Every action the agent can technically perform has a row, including read actions. - Irreversible external actions default to human confirmation or prohibited, not autonomous. - Each setting has a rationale, and "prohibited" rows note what would change the decision. --- ## AI agent identity and permissions register _Every agent has its own identity with least-privilege scope, tracked like a service account._ ### Template | Agent | Non-human identity | Permissions granted | Scoped to task | Granted by | Expiry | Last access review | |---|---|---|---|---|---|---| | | | | Y / N | | YYYY-MM-DD | YYYY-MM-DD | ### Worked example | Agent | Identity | Permissions granted | Scoped to task | Granted by | Expiry | Last review | |---|---|---|---|---|---|---| | support-copilot | svc-copilot-prod | kb:read; orders:read (ticket-scoped); drafts:write | Y | Platform IAM | 2027-03-01 | 2026-09-01 | | billing-reconciler | svc-billrec-prod | ledger:read; report:write | Y | Platform IAM | 2027-01-15 | 2026-09-01 | ### Acceptance criteria - No agent shares a credential with a human or another agent. - Permissions map to the autonomy boundary spec, with nothing broader. - Every identity has an expiry and is in the access review cycle. --- ## Agent action log schema _Every agent action is attributable: who, on whose instruction, with what authority, and what happened._ ### Template | Field | Required | Notes | |---|---|---| | timestamp | Yes | | | agent_identity | Yes | the non-human identity used | | action | Yes | the operation and target | | instruction_source | Yes | user request / scheduled job / another agent (which one) | | authority | Yes | autonomous / human-confirmed (who) / policy-permitted | | inputs | Yes | parameters or a reference to them | | outcome | Yes | success / failure / blocked by gate | | reversible | Yes | Y / N, and rollback reference if applicable | ### Worked example | Field | Value | |---|---| | timestamp | 2026-09-05T09:22:41Z | | agent_identity | svc-copilot-prod | | action | orders:read order=A-88213 | | instruction_source | agent run for ticket 88213 (agent: support-copilot) | | authority | autonomous (within ticket scope) | | inputs | ticket_id=88213, customer=cust-4471 | | outcome | success | | reversible | Y (read only) | ### Acceptance criteria - Every action logs the instruction source, including when one agent instructs another. - The authority field distinguishes autonomous actions from human-confirmed ones. - The log feeds the same audit trail and retention as other security-relevant events. --- ## Agentic AI governance sign-off checklist _The gate before an agent goes live, with business, risk, and legal each accountable for part._ ### Template | Item | Owner | Signed | Note | |---|---|---|---| | Autonomy boundary spec complete and approved | Business + Risk | | | | Dedicated identity provisioned with least privilege | Platform / IAM | | | | Action logging verified end to end in staging | Security | | | | Kill switch tested, reaches sub-agents and spawned processes | Security | | | | Irreversible actions gated or prohibited | Risk | | | | Regulatory review (does the agent make Art. 22 decisions, take regulated actions?) | Legal | | | | Monitoring and alerting for scope drift configured | Security | | | | Rollback and incident path defined | Business + Security | | | ### Worked example | Item | Owner | Signed | Note | |---|---|---|---| | Autonomy boundary approved | Head of Support + CRO | Yes | 2026-09-02 | | Least-privilege identity | Platform IAM | Yes | svc-copilot-prod | | Action logging verified | Security | Yes | staging trace attached | | Kill switch tested | Security | Yes | reached the 1 sub-process; log attached | | Irreversible actions gated | CRO | Yes | send + refund gated/prohibited | | Regulatory review | Legal | Yes | no Art. 22 decisions; drafts only | | Scope-drift monitoring | Security | Yes | alert on any new scope | | Rollback / incident path | Head of Support + Security | Yes | disable feature flag; IR runbook linked | ### Acceptance criteria - Business, risk, and legal each sign the items they own; no single approver covers all. - The kill switch is tested, not assumed, with evidence attached. - A live agent has a completed, dated checklist in its file. --- ## Governance controls this kit produces evidence for - **AGT-001**: The autonomy boundary spec and identity register are the agent permission boundary definition. - **AGT-005**: The "requires human confirmation" and "prohibited" settings are the human approval gate for irreversible agent actions. - **AGT-006**: The action log schema is the agent action audit trail. - **AGT-007**: The autonomy boundary spec defines the agent's scope and task boundaries. - **AGT-016**: The sign-off checklist is the agentic deployment readiness assessment.