Agent Governance Quick Audit Report - Northstar Growth Studio
Date: 2026-07-24
Industry: Marketing agency
Website: https://example.com
Team size: 12
Primary buyer: Founder
Executive summary
- Current tracked monthly software/AI spend: $1,217
- Estimated monthly software savings: $512
- Estimated monthly labor upside from top 3 workflows: $2,111
- Total estimated monthly upside: $2,623
- High-risk AI/tool usage areas: 1
- Agent readiness score: 25/100
- Governance gap: customer-facing AI work needs an agent inventory, permission scope, pre-action approval, durable audit evidence, and a rollback path
- Market fit gap: agent sprawl now requires a business-unit registry, duplicate-agent cleanup, spend-owner assignment, and code provenance for AI-generated code
Recommended decision
Proceed with a paid implementation sprint. The upside is large enough to justify immediate workflow cleanup.
Subscription waste and controls
| Tool | Cost | Usage | Workflow | Risk | Recommendation |
|---|---|---|---|---|---|
| Jasper | $125 | monthly | Blog drafts | Low | Cancel or consolidate |
| Zapier | $89 | rarely | Lead notifications | Low | Cancel or consolidate |
| Report Builder Plugin | $79 | rarely | Client reporting | Medium | Cancel or consolidate |
| ChatGPT Team | $300 | daily | Content drafts and client research | Medium | Keep and monitor |
| Canva Pro | $120 | daily | Creative production | Low | Keep and monitor |
| HubSpot Starter | $45 | daily | Pipeline and follow-up | Low | Keep and monitor |
| Claude Team | $240 | weekly | Long-form strategy docs | High | Keep only with guardrails |
| Surfer SEO | $219 | weekly | SEO briefs | Low | Renegotiate or replace |
Workflow automation backlog
| Priority | Workflow | Monthly labor value | Pain | Impact | Automation idea |
|---|---|---|---|---|---|
| 1 | Client reporting | $1,429 | 5 | 5 | Generate recurring client reports from source exports with review before sending. |
| 2 | Support and client questions | $974 | 4 | 4 | Cluster repeated questions, draft approved replies, and route edge cases to a human. |
| 3 | Sales follow-up | $844 | 3 | 5 | Build follow-up reminders and draft personalized responses from CRM notes. |
| 4 | SEO content briefs | $866 | 4 | 4 | Create a brief-generation workflow with human approval and publishing checklist. |
| 5 | Invoice explanation | $520 | 3 | 3 | Automate document collection, transaction explanations, and exception review. |
Agent governance and risk
Use this before giving AI agents access to email, CRM, Slack, finance tools, GitHub, or customer-facing workflows.
Readiness score: 25/100
Authority exposure map
| Workflow | Systems touched | Action level | Current approval | Audit evidence | Control to add |
|---|---|---|---|---|---|
| Client reporting | Google Drive, reporting export, email | Draft and send | Inconsistent owner review | Final file only | Draft-only agent mode, owner approval before send, store prompt/output/reason code |
| Sales follow-up | CRM, email, proposal docs | Draft customer-facing email | Founder review | CRM note after send | Require pre-action approval checklist and log final sent copy |
| Content or support drafts | Client docs, CMS or helpdesk draft | Create draft | Editor or support lead review | Draft stored in workspace | Keep read-only source access and block direct publish/send |
| Audit trail log | Prompt library, tool calls, outputs, approvals, rollback notes | Evidence only | Owner reviews exceptions | Partial prompt history | Store prompts, tool calls, outputs, approvals, exceptions, and rollback decisions in one audit trail |
Agent inventory and permission scope
| Agent / workflow | Owner | Connected systems | Permission scope | Emergency revocation path | Evidence gap |
|---|---|---|---|---|---|
| Client reporting agent | Account lead | Google Drive, reporting export, email | Draft report and draft email only | Disable email/API token and revert to manual report template | No single inventory record or revocation runbook |
| Sales follow-up assistant | Founder | CRM, email, proposal docs | Draft reply from CRM notes | Remove CRM/email OAuth grant and use CRM task queue | Approval state is not tied to the final sent copy |
| Content/support drafting assistant | Editor or support lead | Client docs, CMS/helpdesk drafts | Read sources and create drafts | Remove CMS/helpdesk token and keep manual draft review | Source data rules are not documented |
Business-unit registry and duplicate-agent cleanup
| Business unit | Agent / workflow | Duplicate risk | Spend owner | Cleanup decision |
|---|---|---|---|---|
| Sales | CRM follow-up assistant | May overlap with email follow-up automation | Founder | Keep one CRM-owned workflow and retire duplicate email-only drafts |
| Support | Helpdesk drafting assistant | May overlap with chatbot, FAQ generator, or inbox assistant | Support lead | Keep draft-only helpdesk agent until quality and escalation are measured |
| Operations | Reporting assistant | May overlap with client-reporting scripts or BI exports | Ops lead | Create one registry entry and require teams to discover-before-they-build |
AI coding agent rollout and code provenance
| Control | Why it matters | Evidence to keep |
|---|---|---|
| AI-generated code label | Teams need to distinguish AI-generated code from human-written code during incidents and audits | PR tag, commit note, or review checklist field |
| Intent and owner | Every AI-generated change needs a stated purpose and a human accountable in production | Issue link, owner, expected behavior, rollback note |
| Review bottleneck | AI coding shifts work from writing code to reviewing and validating it | Reviewer approval, test result, risk class, merge decision |
| Toolchain traceability | Fragmented coding tools make code origin and policy enforcement harder | Agent/tool name, prompt or task summary, generated diff, validation result |
Main risks
- AI or automation touches operational systems such as email, CRM, Slack, finance, or deployment workflows.
- Sensitive customer, client, financial, or private data appears in AI/tool workflows.
- Ownership or written usage rules are missing for at least one AI/tool workflow.
- AI-assisted work may create customer-facing outputs without consistent human review.
Required controls before expansion
- Limit agent access by task, not by full account access; start with read-only or draft-only permissions.
- Create a written data policy and block sensitive data from unmanaged prompts.
- Assign one owner per AI tool and require a short approval checklist for new automations.
- Keep humans in the loop for customer-facing messages until quality is measured.
- Maintain an agent inventory with owner, purpose, connected systems, permission scope, and emergency revocation path.
- Maintain an audit trail that records prompts, tool calls, outputs, approvals, exceptions, and rollback decisions in one durable location.
Pre-action approval map
| Action | Risk | Approval rule | Fallback |
|---|---|---|---|
| Send client email | Medium | Owner approves final text before send | Save as draft and notify owner |
| Publish CMS or helpdesk content | High | Editor approval plus source check | Keep draft unpublished |
| Update CRM deal stage | Medium | Owner approves when value or next step changes | Add note only |
| Trigger invoice, refund, or payment request | High | Founder approval and finance evidence required | Create finance task |
| Revoke agent access | High | Owner confirms incident or expiry and logs affected systems | Disable tokens, OAuth grants, and scheduled jobs |
AI guardrails to add
- Create a written rule for which data can be pasted into AI tools.
- Require human review before AI-generated customer-facing messages go out.
- Assign one owner for each paid AI/software tool.
- Review tool spend monthly and cancel tools with rare usage.
- Keep a prompt/playbook library for repeated workflows.
30-day implementation plan
Week 1
- Cancel or consolidate the obvious low-usage tools.
- Assign owners to every remaining paid tool.
- Create the agent inventory and emergency revocation sheet.
- Write the one-page AI usage guide.
Week 2
- Build the first automation for Client reporting.
- Add human review, logging, and a fallback path.
- Measure time saved against the current manual baseline.
Week 3
- Expand the workflow to one adjacent process.
- Create reusable templates/prompts for the team.
- Set monthly budget alerts for AI/software spend.
Week 4
- Review actual savings and quality issues.
- Decide whether to continue with monthly monitoring.
- Pick the next implementation sprint only if the first workflow saved measurable time.
Upsell offer
Recommended next step: a fixed-price implementation sprint to remove waste, build the first automation, and add guardrails.
- Starter implementation: $499 for one workflow and tool cleanup.
- Growth implementation: $1,500 for three workflows, usage guide, and monitoring checklist.
- Monthly monitoring: $49/month for spend review, workflow backlog updates, and vendor-change alerts.