How long does an agent governance audit take?

A structured self-assessment on this checklist takes a focused day per business unit. A third-party audit with evidence sampling typically runs two to four weeks depending on agent count.

What should exist before auditing?

An agent inventory. If the organisation cannot enumerate its agents, owners and permissions, that finding IS the audit result, and everything else waits.

What evidence should each control produce?

Two artifacts per control: proof it fires (including refusals) and proof its records cannot be silently altered. A control with neither is a policy statement, not a control.

Who should own the audit?

Whoever owns model or technology risk — with security, compliance and the business owner of each agent in the loop. Agent governance fails when it is nobody's job.

How often should it repeat?

Quarterly for the inventory and permission review; annually for the full control walk; immediately after any incident or material scope change.

Home › Resources › Audit checklist

RESOURCES

The agent governance audit checklist

Ten checks, in dependency order. Each names the control and the evidence that proves it — because in an audit, a control without evidence is an intention.

Get an Agent Trust Gap Brief

The ten checks

Inventory. Every agent enumerated with owner, purpose and lifecycle state. Evidence: the inventory itself, with a freshness date.
Identity. Each agent holds a distinct, attributable identity — no shared service accounts. Evidence: identity records mapped to the inventory.
Ownership. A named human accountable for each agent. Evidence: the mapping, and proof it survives joiner-mover-leaver events.
Least privilege. Permissions scoped to the task, reviewed on a cadence. Evidence: current permission sets plus the last review's diff.
Policy gate. Deny-by-default evaluation before consequential actions. Evidence: the policy version history and recorded refusals — a gate with zero refusals is unproven.
Approval. Payload-bound, single-use, expiring approvals where actions are irreversible. Evidence: approval records that bind to specific payloads, not sessions.
Receipts. Signed, hash-chained records of consequential executions. Evidence: sample receipts plus a successful tamper-detection demonstration.
Revocation. Authority can be withdrawn and provably propagates. Evidence: a timed revocation drill and the agent's first refused action after it.
Boundaries. Inter-agent instructions verified for authority; external content treated as data, not command. Evidence: boundary test results against injection and confused-deputy cases.
Retention. Evidence survives as long as the obligation it answers, on tamper-evident storage. Evidence: retention policy mapped to regulatory clock, plus verification that old receipts still verify.

Scoring honestly

Score each check 0 (absent), 1 (stated but unevidenced) or 2 (evidenced). Anything scored 1 is the audit's real finding: the organisation believes it has a control it cannot prove. The checklist maps directly onto the OWASP Agentic Top 10 and the crosswalk to NIST AI RMF, ISO 42001 and the EU AI Act.

Last verified 2026-08-11. Copy freely with attribution. For an external read of the same surface, the Agent Trust Gap Brief is the low-friction start.

By Julian Joseph, Founder, ApexClaw. Written from direct work operating autonomous systems under governance. Reviewed against the claims policy: sourced, first-party, or labelled.