# AI Agent Governance Framework Template

Use this template for production readiness and operating evidence. It is not legal advice; legal and governance teams own final classification.

## 1. Scope and inventory

- Agent / workflow name:
- Business purpose:
- Business owner:
- Technical owner:
- Framework and model:
- Tools and data sources:
- Environment and regions:
- Delegated sub-agents:
- Sensitive or regulated use indicators:

## 2. Decision rights

| Action class | Example | Autonomous / gated / blocked | Trigger or threshold | Accountable reviewer | SLA | Timeout behavior |
| --- | --- | --- | --- | --- | --- | --- |
| Financial |  |  |  |  |  |  |
| Access / identity |  |  |  |  |  |  |
| Customer communication |  |  |  |  |  |  |
| Production change |  |  |  |  |  |  |
| Record deletion |  |  |  |  |  |  |
| Policy exception |  |  |  |  |  |  |

## 3. Runtime control map

For every gated action, record:

- Policy trigger and risk level
- Required role, department, region, or shift
- Quorum and separation-of-duties rule
- SLA and escalation sequence
- Fallback and fail-closed behavior
- Exact action data bound to the decision
- Callback signature verification
- Idempotency and replay protection

## 4. Evidence requirements

- Request and correlation ids
- Agent, workflow, model, and tool identity
- Business object and proposed action
- Context shown to the reviewer
- Policy trigger and risk level
- Reviewer identity, role, decision, reason, and timestamp
- Escalation history and timeout state
- Signed callback delivery and verification state
- Final action outcome

## 5. Operating metrics

- Approval P50 and P95 latency
- Rejection rate by action class
- Timeout and escalation rate
- Callback delivery success
- Audit-only coverage for autonomous actions
- Repeated policy exceptions
- Incidents and near misses

## 6. Review cadence

- Weekly during pilot: workflow owner + engineering
- Monthly after stabilization: business + engineering + security
- Quarterly: governance / legal review, access review, control effectiveness, and evidence sampling
- Event-driven: model, tool, data source, owner, policy, or workflow change

## 7. Sign-off

- Business owner:
- Technical owner:
- Security owner:
- Legal / governance reviewer:
- Approval date:
- Next review date: