Governance Checklist

A well-governed AI agent operates within a structured framework of strategies, policies, and controls.

Does your agent:
comply with industry regulations and standards?
enforce your organization's data use and communication policies?
constrain use by topic, to prevent misuse and reputational damage?
monitor, check for and escalate compliance issues in real-time?
log data use, decisions and output for retrospective audit?
have clear escalation paths for any violations?
apply role-based access control (RBAC) to sensitive data?
substitute, redact or obfuscate personal and confidential data?
follow policy requirements for data retention and deletion?
get frequent compliance audits?
have clear escalation paths for any violations?
detect and reject prompts that encourage rule-breaking or non-compliance?
apply provenance management policies to its training and RAG data?
have tools, models or data sources risk-assessed before using them?
enforce human oversight for high-risk actions and decisions?
have version control for models, knowledge sources, and policies?

Governance Risk: 100

Unless you've addressed most of the items in the above checklist, your agent is unlikely to satisfy your organisation's governance requirements. Answer the above questions by checking the boxes - and get an assessment of your agent's governance risk.