1. Agent inventory
List every agent, owner, purpose, model/provider, business unit, connected systems, permission scope, and emergency revocation path.
Sample deliverable
AI Agent Control Checklist
A buyer-facing sample of what the Agent Governance Quick Audit reviews before a business lets agents touch email, CRM, support, finance, code, or customer workflows.
Control map
The ten checks before agent work scales
The paid audit turns these checks into a scored report with owners, risk notes, and a 30-day control backlog.
2. Business-unit registry
Maintain one registry showing which team owns each agent and require teams to check it before creating another agent.
3. Duplicate-agent cleanup
Find duplicate agents doing similar CRM, support, reporting, finance, service desk, or coding work, then choose which one to keep.
4. Authority exposure
List every inbox, app, repo, database, calendar, payment tool, file store, and customer system the agent can access or change.
5. Action boundaries
Separate read-only work from consequential actions that send, publish, merge, invoice, refund, delete, or update records.
6. Pre-action approvals
Define which actions need human review, who owns approval, and what evidence must be checked before execution.
7. Audit trail
Confirm prompts, inputs, tool calls, outputs, exceptions, approvals, and customer-facing actions are recorded somewhere durable.
8. Code provenance
For AI-generated code, record the agent/tool, prompt or task summary, generated diff, reviewer, validation result, and production owner.
9. Spend and ROI limits
Monitor token usage, API calls, SaaS seats, background jobs, and follow-on automation spend until buyer value is proven.
10. Escalation and rollback
Document when the agent must stop, ask for help, revoke credentials, notify owners, and restore manual workflows.
Scoring sample
What a scored row looks like
A full audit scores every agent workflow for risk, business value, evidence quality, and the next control to add.
Workflow: Agent drafts invoice follow-ups from CRM and email history.
Risk: Medium. It reads customer history and can send billing messages.
Missing control: Agent inventory, business-unit registry, duplicate-agent cleanup, permission scope, pre-action approval before send, final message log, reason code, code provenance for AI-generated code, and owner decision.
Next step: Run in draft-only mode for 10 messages, then review reply quality and payment outcomes.
Next step
Use this as a quick readiness check
If two or more checks are unclear, the business probably needs an agent governance audit before adding more automation.