AI Agent Governance Templates

Master governance policy covering agent deployment approval, decision authority levels, monitoring requirements, and incident escalation procedures.

Defines four autonomy tiers (supervised, semi-autonomous, autonomous, restricted) with decision thresholds, review requirements, and override procedures for each tier.

Governs what data agents may read, write, and retain. Includes PII handling rules, data minimisation requirements, and retention schedules for agent-generated outputs.

Defines permitted and prohibited use cases for AI agents across the organisation. Includes department-specific carve-outs and a rapid exception request process.

27-point checklist for launching a new AI agent into production. Covers data access review, escalation path testing, confidence threshold validation, and rollback plan verification.

Structured quarterly review template covering override rate trends, INTERRUPT frequency by agent, decision drift indicators, and retraining trigger evaluation.

ISO 27001 Annex A controls checklist for AI agent integration into information security management systems. Maps directly to control domains A.8, A.9, A.12.

Self-assessment checklist mapping Agent OS governance events to NIST AI RMF Core Functions: Govern, Map, Measure, Manage. Produces a readiness score across 4 dimensions.

Defines who receives INTERRUPT events by severity level (low/medium/high/critical), SLA for response, what happens on timeout, and how the outcome is documented.

Defines mandatory INTERRUPT thresholds by agent type and action category. Includes rationale for each threshold, override procedure for temporary adjustment, and review schedule.

Role-based INTERRUPT response authority matrix. Maps decision types to minimum seniority level required to approve, deny, or redirect. Includes delegation procedures for OOO scenarios.

Weekly override analysis workflow — how to identify systematic patterns in OVERRIDE events, classify root causes (prompt/data/threshold/policy), and trigger retraining or policy updates.

Immediate response procedure for severity:critical OVERRIDE events. Who is notified, what investigation is required within 24h, and how findings feed into the corrective action register.

Step-by-step response to an agent taking unintended high-volume or high-impact actions (e.g. sending 10,000 emails, bulk-deleting records). Includes immediate containment, stakeholder notification, and post-incident review.

Incident response for suspected unauthorised data access by an agent. Evidence preservation, access revocation sequence, breach notification assessment, and regulatory reporting checklist.

Response playbook for discovering systematic discriminatory outputs from an AI agent. Investigation methodology, stakeholder communication templates, and remediation documentation.

Structured agenda for human review of agent DEBRIEF events. Guides reviewer through outcome assessment, edge case prioritisation, and decision on whether learned observations trigger policy updates.

Security and governance questionnaire for evaluating AI agent vendors. 35 questions covering data handling, audit trail quality, override capabilities, SLA commitments, and incident response SLAs.