Governing agents: approvals, audits and accountability
Security controls need a process around them: who approves an agent, how risky it is, who owns it, and how you check it is still safe months later.
In 60 seconds
Governing agents: approvals, audits and accountability
Security controls need a process around them: who approves an agent, how risky it is, who owns it, and how you check it is still safe months later.
Risk tiers
| Tier | Example | What it needs before going live |
|---|---|---|
| Low | Drafts internal text from public information; no tools that change anything | Registration in the inventory, owner, standard settings |
| Medium | Reads internal data for staff; writes to low-risk systems; reversible actions | Security review, scoped identity, logging, gateway policy |
| High | Touches money, personal data, production systems, or reads untrusted content and can act | Threat model, red-team test, human approval steps, kill switch tested, sign-off by risk owner |
The go-live approval
- 1
Intake
The business owner fills a short form: purpose, data, tools, users, vendor, expected volume. - 2
Tiering
Security assigns a tier using fixed questions, so similar agents get similar treatment. - 3
Review
Checks match the tier: identity and scopes, tool list, gateway rules, logging, approvals, testing. - 4
Sign-off
A named business owner accepts the remaining risk; security confirms controls are in place. - 5
Register
Inventory entry with owner, tier, review date, and links to the design and test results.
After go-live
- Periodic access reviews: the owner confirms the agent still needs each permission and tool. Unused ones are removed.
- Change control: new tools, new data sources, a new model or major prompt changes trigger a fresh review.
- Audit trails: tool-call logs, approvals and configuration changes are kept for an agreed period and can be searched.
- Metrics: incidents, blocked calls, approval rates, overrides. A sudden change is worth a look.
- Retirement: when an agent is no longer needed, its identity, grants, memory and data are removed on purpose.
Mapping to frameworks
| Framework | What it is | How agent governance fits |
|---|---|---|
| NIST AI RMF 1.0 | A voluntary US framework with four functions: Govern, Map, Measure, Manage | Govern: policy, roles, approvals. Map: inventory and context. Measure: testing and metrics. Manage: controls, incidents, retirement |
| NIST AI 600-1 | The Generative AI Profile of the AI RMF | Lists risks specific to generative AI that agents inherit |
| ISO/IEC 42001 | An international standard for an AI management system; organisations can be certified against it | Your approval process, risk tiers, reviews and records become part of the management system |
| OWASP Top 10 for LLM Applications | A list of common LLM application risks | LLM06 Excessive Agency and LLM01 Prompt Injection map directly to agent controls |
Accountability
- "The AI decided"
- Owner listed as "IT"
- Approvals recorded as "system"
- Nobody reviews old agents
- A named business owner for every agent
- A named approver for every high-risk action
- Records showing who approved the agent and what they saw
- Review dates that trigger reminders and, if missed, suspension
Watch and read more
Lab
An agent intake form, a tiering rule and a completed approval record for one agent.
The problem
Design the governance paperwork for your company's agents. Keep it short enough that people will actually use it.
- Write an intake form of no more than 10 questions.
- Write a tiering rule: which answers make an agent low, medium or high.
- Fill in the form for one agent (real or imaginary) and assign its tier.
- Write its approval record: controls required for that tier, which are done, who signed off, next review date.
- Map your process to the four NIST AI RMF functions in one line each.
AGENT INTAKE (draft)
1. Agent name and purpose (one sentence):
2. Business owner (named person):
3. Users (who talks to it or benefits from it):
4. Data it can read (and its classification):
5. Actions it can take; which cannot be undone:
6. Does it read content from outside the company (email, web, tickets, partner agents)?
7. Vendor, model provider and where data is processed:
8. Expected volume (tasks per day):
9. Approvals or human checks in the design:
10. How is it switched off?You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Two teams answer the intake form differently for very similar agents, and get different tiers. How do you fix that?Reveal
Make the questions more factual and less open to opinion (for example "Can it send email outside the company? yes/no" instead of "Is it risky?"). Have security confirm answers against the actual configuration, and keep examples of tiered agents so reviewers can compare. Consistent tiering is a sign the process is fair and trusted.
Q2An auditor asks, "How do you know the agents in production are the ones you approved?" What evidence would you show?Reveal
The inventory with approval records, matched against what is actually running: identities in the identity system, OAuth grants, gateway policies, and tool-call logs showing only registered agents. Periodic discovery (as in the shadow AI lesson) shows you would notice unapproved agents. A gap between the inventory and reality is itself a finding to fix.
Questions people ask
Will this process slow down innovation?
Not if it is tiered. Low-risk agents should be approved in days with a short form. Strict review is kept for agents that touch money, personal data or production. A clear, fast process also reduces shadow AI, because people are more willing to ask.
Who should own AI governance?
Usually a cross-functional group: security, data protection, legal, risk and business leaders. Security runs the technical review; business owners accept risk for their agents; leadership sets the risk appetite.
Do we need ISO/IEC 42001 certification?
Not necessarily. Some organisations seek it because customers or regulators value it. Others use it or the NIST AI RMF as a guide without certifying. Either way, the frameworks help you organise what you already do.
What happens if an owner misses a review?
Set a clear rule in advance, for example a reminder, then escalation, then suspension of the agent's access. A review date nobody enforces is not a control.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.