A handbook for teams putting agents to work
Give AI agents a clear scope of work
Decide what an agent may do, who can approve a change, and what evidence to keep.
What may this agent do?
| Action | Decision |
|---|---|
| Read service health | Allow |
| Restart production | Ask the owner |
| Export customer data | Deny |
Owner: service team
Scope: one service, one environment
Evidence: request, decision, result
What governance means here
An agent needs a defined job, a responsible owner and permission to use specific tools. Governance turns those decisions into rules that people can review and systems can enforce.
Define the work
Owners, assets and operating limits
02 / Control accessWrite the rules
Permissions and approval decisions
03 / Keep the evidenceReview what happened
Records, incidents and changes
Start reading
Make the next decision clearer
What is AI agent governance?
Understand who should own an AI agent, what it may do, and how to review its actions.
AI agent access control at the action boundary
Decide which agent may perform which action on which resource, and enforce the decision.
Human in the loop AI that people can actually review
Design approval steps that give a person enough context and authority to make a useful decision.
What belongs in an AI agent audit trail
Record agent requests, access decisions and outcomes without copying secrets into your logs.
A tool for the next review
Write down who can approve the action.
Work through the action, its scope and its owner. Download a decision record to discuss with your team.
Build a decision recordPublished by the team behind Emisar, Ryker and co:op. The guides link to their sources and explain where each approach stops. How we write and review.