Most organisations have an AI policy. Far fewer can show, for a given agent, what it can access, what it did, who approved it and what it cost. That gap — between stated intent and operated control — is where governance actually lives. This checklist is what we work through when we put an agent into production.

Why a checklist beats a policy

A policy is a statement; a checklist is a set of actions. Governance only protects you once each item is implemented and producing evidence. Treat the list below as per-workflow work: apply it to your first agent, then reuse it as more go live. None of it requires slowing the business down — well-designed controls run automatically for routine actions and only add friction where risk genuinely concentrates.

The eight controls

For each agent heading to production, confirm you have:

  • An inventory entry — what it does, what it can touch, and who owns it.
  • A risk classification — so controls are proportionate to the stakes.
  • Least-privilege access — tools and data scoped to the workflow and nothing more.
  • Human oversight — defined approval points, review and escalation.
  • Evaluation suites — regression tests run before and after every change.
  • An audit trail — every tool call, decision, escalation and approval logged.
  • Monitoring — quality, throughput and cost, with alerting on drift.
  • Incident response — the ability to pause, roll back or restrict, with an owner.

If you want the reasoning behind these, we cover it in governed AI agents; here the point is simply to have each one in place.

How to use the checklist

Run it as a gate, not a survey. An agent should not reach production with open items, and each item should point to evidence — a register entry, a permissions config, an evaluation report, a log query — not a tick in a spreadsheet. Reviewed this way, the checklist doubles as your audit-ready evidence base.

Where this sits

The first six controls are largely technical — the substance of AgentOps & AI governance. Inventory, risk classification and evidence extend to the organisational level, which is the role of AI assurance and evaluation. We deliver both, so the checklist is implemented end to end rather than split across teams who each assume the other owns it.