# AI agent governance checklist and access matrix

Use this record before an agent receives company data or tools, at every
material scope change, and during quarterly access review.

## 1. Agent inventory

| Field | Value |
| --- | --- |
| Agent ID | |
| Agent name | |
| Purpose | |
| Business owner | |
| Technical owner | |
| Review owner | |
| Environment | experimental / staging / production |
| Host or runtime | |
| Models | |
| MCP servers and APIs | |
| Data classes | public / internal / confidential / restricted |
| Risk tier | 1 / 2 / 3 / 4 |
| First approved | |
| Last reviewed | |
| Review due | |
| Disable owner | |

## 2. Risk tier

- **Tier 1 - advisory:** reads low-sensitivity context and cannot make
  consequential changes.
- **Tier 2 - assisted action:** prepares changes or reports, but a named human
  approves execution.
- **Tier 3 - bounded autonomy:** executes reversible actions inside explicit
  scope, budget, and monitoring limits.
- **Tier 4 - consequential autonomy:** touches sensitive data, production,
  money, legal commitments, employment decisions, or public communications.

Record the selected tier and the evidence supporting it:

```text
Risk tier:
Data sensitivity:
Maximum action impact:
Reversibility:
External impact:
Detection method:
Reasoning:
```

## 3. Identity and access matrix

Use one row per resource boundary. Replace `none`, `read`, `draft`, `execute`,
and `admin` with the actual scopes enforced by the system.

| Resource or workspace | Data class | Read | Create or draft | Continue or update | Publish or execute | Delete | Admin | Approval owner |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |

Identity checks:

- [ ] The agent has a named, single-purpose service identity.
- [ ] Interactive human work uses the person's own identity.
- [ ] Authorship comes from the accepted credential, not tool input.
- [ ] Search enforces the same authorization rules as direct reads.
- [ ] Credentials are absent from prompts, URLs, source control, and shared
      configuration.
- [ ] Tokens are bound to the intended resource and validated on every request.
- [ ] The credential can be disabled without disabling unrelated agents.

## 4. Tool and action controls

| Tool or action | Purpose | Input boundary | Output boundary | Reversible? | Human approval? | Rate or budget limit | Evidence retained |
| --- | --- | --- | --- | --- | --- | --- | --- |
| | | | | | | | |
| | | | | | | | |

- [ ] Destructive operations are separate from ordinary create or update
      scopes.
- [ ] Public publishing is an explicit action.
- [ ] Privilege elevation is time-bounded and attributable.
- [ ] Delegation to another agent cannot widen access.
- [ ] Tool errors distinguish authentication, authorization, validation, and
      internal failures.
- [ ] The agent has a tested stop mechanism.

## 5. Human approval gate

For every gated action, retain:

```text
Requested action:
Affected resources:
Expected outcome:
Evidence:
Uncertainty:
Alternatives considered:
Rollback plan:
Approver:
Approval scope:
Approval expires:
Execution record:
```

Approval must be attributable and limited to the described action. A comment or
mention does not grant access.

## 6. Continuation and audit evidence

- [ ] Objective and acceptance criteria are explicit.
- [ ] Current state separates complete, in-progress, blocked, and unverified.
- [ ] Decisions include their reasons.
- [ ] Claims link to original files, queries, outputs, or other evidence.
- [ ] Constraints include permissions, budgets, deadlines, and exclusions.
- [ ] Open questions and the next action have owners.
- [ ] Every revision records the authenticated human or agent.
- [ ] Human comments remain attached to the reviewed artifact and revision.
- [ ] Corrections create a new revision instead of mutating reviewed evidence.

## 7. Control tests

Run these tests with production-equivalent authorization:

| Test | Expected result | Evidence | Passed | Owner |
| --- | --- | --- | --- | --- |
| In-scope search and read | Only allowed records are returned | | | |
| Out-of-scope search | Restricted records are undiscoverable | | | |
| Out-of-scope write | Request is rejected as unauthorized | | | |
| Attribution | History names the authenticated principal | | | |
| Approval gate | Consequential action waits for approval | | | |
| Cross-agent continuation | Successor recovers exact state and evidence | | | |
| Credential revocation | API, CLI, and MCP access stop immediately | | | |
| Recovery | Owner resumes from the last trusted revision | | | |

## 8. Incident response

```text
Detection:
Time detected:
Agent and credential:
Affected resources:
Last trusted revision:
Containment action:
Credential disabled:
Scheduled jobs stopped:
Data or actions reviewed:
Human owner notified:
Recovery revision:
Root cause:
Control change:
```

## 9. Offboarding

- [ ] Disable the identity before deleting it.
- [ ] Stop schedules, webhooks, queues, and unattended sessions.
- [ ] Revoke and remove credentials from every secret store.
- [ ] Transfer ownership of active handovers and unresolved reviews.
- [ ] Preserve required audit and continuation records.
- [ ] Confirm search, read, write, and publish all fail after disablement.
- [ ] Delete only after the declared retention window.
- [ ] Never reuse the old credential for a replacement agent.

## Review decision

```text
Decision: approve / approve with conditions / reject / retire
Conditions:
Accepted residual risks:
Owner:
Date:
Next review:
```

Canonical guide:
https://handover.sh/guides/ai-agent-governance-framework