Agent Governance Checklist

Use this checklist for the specific capability and context being approved. A general model approval is not a substitute.

Purpose and ownership

• The intended outcome, users and boundaries are documented.
• Business, technical and control owners are named.
• The current baseline and target measures are agreed.
• Out-of-scope decisions and prohibited uses are explicit.

Knowledge and evidence

• Approved sources, owners, versions and applicability rules are defined.
• Material outputs retain sufficient provenance.
• Conflicting or missing evidence triggers visible handling.
• Retention and deletion requirements are implemented.

Authority and tools

• Read, write and execution rights use least privilege.
• Human decision and approval points are unambiguous.
• High-impact actions use independent policy enforcement.
• Separation of duties is preserved.
• Actions can be stopped, revoked or rolled back where appropriate.

Security, privacy and compliance

• Data classification and permitted model use have been assessed.
• Identities, credentials and secrets are securely managed.
• Prompt injection and unsafe tool input are addressed.
• Legal, regulatory, contractual and workforce implications are reviewed.

Quality and assurance

• Representative, edge and adverse cases have been evaluated.
• Acceptance thresholds reflect task impact.
• Weak performance by process, country or language is visible.
• Independent challenge is completed where required.
• Material changes trigger regression evaluation.

Operation and adoption

• Monitoring covers outcome, risk, cost and policy behavior.
• Users understand evidence, limitations and escalation.
• Overrides, corrections and incidents are recorded and learned from.
• Support, change, suspension and retirement processes exist.
• Final approval and residual-risk acceptance are recorded.

A checked box should point to evidence. If it cannot, it is only an intention.