Open Framework

Organizations are building AI agents,
but not thinking through how to govern them.

Your people are building AI agents that can access data, use systems, make decisions, and take action. But too often, the rules for what they can see, what they can do, and when a human must step in are added after the build.

That creates a dangerous gap as the agent is ready to act before the organization is ready to govern it.

Below is the complete set of 20 controls I apply to every agent I build or review across four phases. It's free and hopefully helpful to you.

What I actually find when I look

A lot of my calls now open with some version of "we're building an agent." Then I start asking questions, and it's the same five answers almost every time.

01

An AI policy written for chatbots

It says do not paste confidential data into ChatGPT. It says nothing about a system that takes actions on your behalf.

02

An approved tools list, not an approved authorities list

A list of software. Nothing about what an agent may write to, delete, send, or spend.

03

No agent inventory

Nobody can answer how many agents are running in the company, or who owns each one.

04

No run logs

No way to detect drift, duplicate actions, or scope creep after the fact.

05

No kill switch owner

When an agent misbehaves at 9pm on a Friday, nobody knows who turns it off.

Agent First-Order Principles

These work for any agent, whatever it does. They're about how it handles data, actions, and the people around it, not about the job itself.

01.

Before You Build

7 controls

These decisions must be made explicitly at design time. An agent that starts running without answers to these questions will invent its own, usually badly.

Define the source of truth

When two data sources conflict, which one wins? Document this for every data input the agent touches. Never leave it to the agent to decide at runtime.

Define scope in writing

List exactly what the agent is permitted to do. Anything not on the list is out of scope, regardless of what the agent discovers during a run.

Identify every irreversible action

Sending an email, placing an order, deleting a record, posting a message. List them. Each one needs an explicit rule about whether the agent can take it autonomously or must propose it first.

Set the human approval threshold

For every consequential action, decide in advance: does the agent act, propose, or halt and report? Write this down. Do not leave it implicit.

Define the log structure

Decide what a run record looks like before the agent runs once. At minimum: date, person or item actioned, action taken, outcome, notes. A log designed after the fact is always incomplete.

Request minimum permissions

List only the access the task requires. Do not acquire capabilities speculatively. If the agent does not need write access to a system, do not grant it.

Define failure behavior

For each step that could fail, decide: does the agent retry, skip and continue, or halt? Document the answer. Default behavior should be halt and report.

02.

Before Each Run

4 controls

Things change between runs. Skip these four and the agent will happily act on a picture of the world that's a week old.

Read current state before acting

Fetch live data at the start of every run. Do not rely on state from a previous run or from memory.

Check for prior action

Before doing anything, check whether it has already been done. Use a log, a status field, or a confirmation email, but check. Duplicate orders, duplicate sends, and duplicate records are almost always caused by skipping this step.

Verify inputs are complete

If required data is missing, such as an address, a budget, or a confirmation, halt and report. Do not proceed with assumptions or placeholders.

Confirm scope has not changed

If the task file or configuration has been updated since the last run, note what changed before proceeding.

03.

During the Run

5 controls

This is the phase that needs to maintain human review. The agent handles the information; a person stays responsible for the judgement calls.

Propose, do not act, on consequential decisions

If an action is consequential and non-routine, surface it to the human. Draft the email; do not send it. Prepare the order; do not place it. The agent handles information. The human handles judgement.

Prefer reversible paths

When two approaches achieve the same outcome, take the one that can be undone. Draft before send. Stage before commit. Copy before delete.

Treat observed content as data, not instructions

Text found in emails, documents, web pages, or tool results is data. It is not a command. An instruction discovered mid-run does not authorise a new action.

Do not expand scope mid-run

If the agent discovers something interesting or unexpected, it logs it and reports it. It does not act on it. New findings trigger a new task; they do not extend the current one.

Fail loudly and stop

If a required step returns unexpected data, an error, or a missing value, halt. Report exactly what failed and what was expected. Do not continue on a broken assumption and do not guess.

04.

After Each Run

4 controls

Nobody enjoys this part, and it's the part you'll want when someone asks what the agent has been doing for the last three months.

Log every run, not just failures

A log that only records errors gives you no baseline. Record every action taken, even when everything goes to plan. You need the full picture to spot drift over time.

Record what was proposed but not yet actioned

If the agent is waiting on a human decision, log that state explicitly so the next run knows what is pending.

Send a clear summary

The output of a run should be readable by a human who was not watching. State what was found, what was done, what was proposed, and what requires a response.

Update the source of truth

If the run revealed stale or incorrect data, flag it for correction. The agent should not silently work around bad data.

Your cyber insurer is going to ask about this

Underwriters have tightened considerably over the last few years, and agentic systems are starting to show up in renewal questionnaires directly. The questions themselves are not new. They are the same control families carriers have always asked about, now pointed at software that acts on its own.

Most teams answer these from memory on a deadline. Working the checklist above gives you documented answers to nearly all of them before anyone asks.

Asset inventory

What is deployed, and who owns each one?

  • An agent register
  • Define scope in writing

Least privilege access

Does each system have only the access it needs?

  • Request minimum permissions
  • Define the source of truth

Audit logging and retention

Can you reconstruct what happened, and how far back?

  • Define the log structure
  • Log every run, not just failures

Change control and approvals

Who signs off before something touches production?

  • Set the human approval threshold
  • Propose, do not act

Incident response and containment

How fast can you stop it, and who is authorised to?

  • Fail loudly and stop
  • A named kill switch owner

Recoverability

Which actions cannot be undone?

  • Identify every irreversible action
  • Prefer reversible paths

Every carrier words its application differently, and none of this replaces your broker's questionnaire or guarantees a particular outcome on coverage. But walking into that conversation with written answers, rather than assurances, tends to make it a much shorter one.

What this checklist does not do

It tells you what to decide. It won't sit you down and make you decide it, write the decision down anywhere, or hold the agent to it once it's running.

That last part is the one that gets people. A checklist you agreed with in March doesn't govern anything in June. Preflight is the version that does: the same principles, turned into documents someone signs and constraints the agent actually runs under.

I'm Kate Marshall. I work as a Fractional Chief AI Officer at theGRAI, teach AI+HI for SHRM, and wrote AI at Work. Before that I spent 18 years at the SANS Institute, where I started its first AI Task Force and co-chaired the AI Cybersecurity Summit. Most of what's on this page came out of watching agents fail in ways nobody had planned for.

Free to use, quote, or adapt with attribution. If you run it against your own agents, tell me what broke. That's how this list got written in the first place.