For the people responsible for the agent
A working handbook for AI agent governance.
Decide what an agent may do, who can approve a change, and what evidence the team needs to keep.
One agent.
A defined scope.
- Owner
- Payments engineering
- Job
- Investigate service failures
- Allowed
- Read selected health data
- Approval
- A specific production restart
- Evidence
- Request, decision and result
What is AI agent governance?
AI agent governance defines who owns an agent, what it may do and how its actions are reviewed. For agents that use tools, those decisions need enforceable permissions, usable records and a way to stop further work.
The chapters
From the first permission to the last review.
Foundations
Choose the work and its owner
Start with ownership, security and the decisions an agent’s work creates.
All 3 foundations guides →Connect identity to actions, resources and time limits.
- AI agent access control at the action boundary
- Non-human identities and AI agents
- Least privilege for AI agents
Operations
Keep track as the system changes
Maintain the inventory, observe actions and prepare to revoke access.
All 6 operations guides →Reviews & policy
Make a decision with evidence
Review a release, resolve an exception and record what remains uncertain.
- An AI agent governance framework for engineering teams
- How to assess the risk of an AI agent
- An AI governance checklist for agent access
Work through a concrete decision
A review needs more than a checked box.
Use completed examples to see what an owner should approve, what needs more evidence and what should remain out of scope.
Open the worked examples ↗Use what you learn
Prepare the next review.
Describe the agent’s work, scope and owner. Download a record to discuss with the people responsible for the system.