AI agent governance checklist
Twelve controls, ordered so that each one is worth having even if you stop there. Every item is testable — if you cannot demonstrate it with a command or an artifact, it is not implemented.
Get an Agent Trust Gap BriefBefore the agent touches production
- Action inventory. Every action the agent can take, marked reversible or not. Most teams have never written this down, and everything else derives from it. Test: produce the list.
- Named accountable owner. One person, not a committee. Test: they answer the page at 2am.
- Least-privilege credentials. Scoped to the task, not the system. Test: attempt an out-of-scope call and confirm it fails at the provider, not at the prompt.
- Non-human identity. The agent authenticates as itself, never as a person. Test: the audit log names the agent, not a shared service account.
- Policy gate before irreversible actions. Evaluated by the component that executes, not by the model. Test: a blocked action produces a refusal record.
- Approval bound to a specific action. Not a role grant, not a blanket sign-off. Test: the approval artifact names the action id.
- Idempotency on every effect. Retries cannot double-send, double-pay or double-dispatch. Test: replay the same action id and confirm one effect.
- Rate and spend caps. A ceiling that stops a misbehaving agent before a human notices. Test: exceed it deliberately and confirm it blocks.
- Execution receipts. What was attempted, which policy applied, who approved, what the provider returned. Test: reconstruct one action end-to-end from records alone.
- Refusal receipts. Blocks recorded with the same weight as successes. Test: count last week's refusals.
- Revocation with measured propagation. Authority withdrawn, not just a process stopped. Test: revoke under load and record the last accepted action's timestamp.
- Retention matched to obligation. Evidence outlives operational logs. Test: confirm the retention setting against your longest applicable duty.
The three that get skipped, and what it costs
| Control | Why it gets skipped | What it costs when missing |
|---|---|---|
| Idempotency | Feels like an edge case until a timeout happens | Duplicate sends, duplicate charges, duplicate dispatches — the most common real incident |
| Refusal receipts | Nobody asks for evidence of things that did not happen | No way to prove a control is real. Every assurance conversation becomes an argument |
| Tested revocation | The switch exists, so it is assumed to work | Discovered broken during the incident it was built for |
How to use it
Run it as a gate, not a survey. For each item, either produce the artifact or write down the date you will. A checklist with nine honest gaps is more useful than one with twelve optimistic ticks, because the gaps are the roadmap. Related: policy enforcement, execution receipts, revocation.
Common questions
What is the minimum viable agent governance?
Action inventory, least privilege, approval on irreversible actions, idempotency, and receipts. Those five prevent most real incidents and are achievable in weeks, not quarters.
Which control prevents the most incidents?
Idempotency. Duplicate effects from retries after timeouts are the most common agent incident in production and the cheapest to prevent.
Do we need all twelve before launching?
No. Order them by the irreversibility of what your agent can do. An agent that only reads needs a handful; one that can pay needs all twelve.
How do you test a kill switch safely?
In a staging environment under representative load, measuring the timestamp of the last accepted action after the stop. Then repeat in production during a maintenance window, because staging never reproduces real concurrency.
What evidence should exist for every action?
What was attempted, which policy was evaluated and with what outcome, who approved it if approval applied, what the provider returned, and an integrity mechanism proving the record is unaltered.
Last verified 2026-08-07. Sources are named inline. Not legal advice.
By Julian Joseph, Founder, ApexClaw. Written from direct work operating autonomous systems under governance. Reviewed against the claims policy: sourced, first-party, or labelled.