Templates and checklists
The printable artifacts the operation pages reference. Copy them, cut what doesn’t apply, and argue with the rest. Each one names the page that explains why it exists, and none of them is a control until someone with authority uses it to say no.
These are this wiki’s own drafting, assembled from the mechanisms on the linked pages. Nothing here carries a standard’s authority, nobody has audited them, and a 40-person fund should expect to delete about a third.
Intake form
Fill in at registration, before the agent runs anywhere shared. Ten fields; if it takes more than five minutes, builders will route around it.
- Agent name, and one sentence on what it does.
- Owner of record: a named individual, not a team.
- Second maintainer, or “none” (which is itself the finding).
- Where it runs: platform, environment, personal or shared account.
- What it reads: systems, folders, mailboxes, databases.
- What it can write or trigger: systems, actions, spend.
- Who or what invokes it: a person, a schedule, another agent.
- Untrusted input? Does it process content from outside the firm: email, PDFs, web pages, vendor files.
- Network reach: can it make outbound calls, and to where.
- Who depends on the output today, and what breaks if it stops.
Fields 5, 8 and 9 are the lethal trifecta check. Two of three is a conversation; three of three is a design change before launch. See agent inventory.
Tiering rubric
Score three axes; the highest one sets the tier. The model is in risk tiers, the process in tiering, and the scorer must not be the owner.
| Axis | 1 | 2 | 3 |
|---|---|---|---|
| Autonomy | Human sees and approves each action | Human approves the plan, not each step | Runs unattended |
| Authority | Read only | Writes to systems, reversible | Irreversible: money, external comms, client-facing, deletion |
| Criticality | One person’s work | A team or a department depends on it | Firm-critical, regulated, or client-visible |
Two modifiers apply after scoring. Declarative or evaluative: an agent given a goal and latitude carries discretion nobody can enumerate in advance, so raise it a tier. Is failure auditable: if a wrong answer would not be visible after the fact, raise it a tier.
Re-score triggers (any one, no exceptions): a new tool or connector, a new data source, a new audience, a change of owner, or a model change underneath it.
User contract
What a builder agrees to before getting build access. One page, signed once, re-signed on tier promotion. See citizen developer roles.
- I will register anything I build before anyone else uses it.
- I am the named owner. If I leave or hand it over, I will name a successor first.
- I will not connect an agent to a data source I would not email to the whole team.
- I will not paste credentials into a prompt, a config file, or a tool description.
- I will report anything that surprised me, including things I fixed myself. Reporting a surprise is never a fault.
- I understand that shared use, production data, or the ability to spend money means a gate and a different set of rules, and I will not widen a share link to get there.
- I will run the eval suite before promotion and after anything changes underneath.
The reporting clause is the load-bearing one. If disclosure costs the discloser anything, the rest of the contract is decorative; see shadow agents.
Gate review checklist
Per promotion gates. The approver is named, is someone other than the builder, and may say no. Turnaround time is published; anything slower than the unsanctioned path governs an empty set.
Every promotion:
- Registry entry current: owner, successor, data map, tools list.
- Tier scored by someone other than the owner, with the rubric attached.
- Trifecta check: which leg is cut, and by what mechanism.
- Eval results against a fixed suite, including cases it is expected to fail.
- Identity: does the agent authenticate as itself, and what is the credential’s lifetime.
- Logging: can you reconstruct what it did, from what input, on whose authority.
- Kill path: who stops it, how, and what remains valid afterwards.
- Decision recorded: approver, date, conditions, expiry.
Tier 3 additionally:
- Second maintainer named and able to describe what it does.
- Rebuild, not a widened share link, into the production zone.
- Data-access scoped to the task rather than inherited from the owner.
- Rollback and containment tested rather than described.
- Retention decided for prompts, tool calls and retrieved context; see recordkeeping.
Gate updates, not only launches. Capability creep enters through changes nobody re-reviewed.
Policy starter language
Sized for a 20-to-500-person firm, to sit inside the existing policy set rather than beside it. Governance structure belongs in the existing risk committee; see governance.
Scope. This policy covers any software built or configured by employees that takes actions in firm systems using an AI model, regardless of the platform used, whether or not code was written, and whether or not the builder considers it an “agent.”
Registration. Agents must be registered before use by anyone other than the builder. An unregistered agent in shared use is a policy exception, reportable to [named function].
Tiering. Every registered agent carries a tier. Controls attach to tiers as set out in the agent control standard. Tier 1 is deliberately light and should stay that way.
Prohibited without prior approval. Irreversible financial actions; sending external communications on behalf of the firm or a client; processing MNPI or client identifiers outside approved systems; connecting third-party tools not on the approved list; agents that create or run other agents.
Credentials. Agents authenticate with their own identities. Personal credentials, shared service accounts and API keys pasted into prompts or configuration are prohibited.
Records. Agent activity in a recordkeeping category is subject to the firm’s retention schedule, on the same terms as any other communication or trade record.
Amnesty. Anything registered during the disclosure window opened [date] carries no consequence for having been unregistered.
Adapt the prohibited list to the business; it is the only paragraph a firm has to write itself.
Escalation criteria — forwardable to compliance
The one page to hand the CCO. Reasoning in when to involve legal and compliance.
Escalate immediately, before remediation. Any agent output that reached a client or a regulator. Any unauthorised access to customer information that has occurred or is reasonably likely to have occurred. Any notice from a vendor about a breach. Any regulator contact. Any agent action nobody can explain.
Escalate at the next review. Capability or tool changes on a tier-2-or-above agent; a new agent touching MNPI, client communications, or records in a required category; a material change in what an agent is used for.
Escalate on aggregation. Individually minor incidents sharing a root cause are reviewed together each quarter. Five trivial failures with one cause are one material weakness.
Clocks, once escalated. Customer notification: no later than 30 days from firm awareness. Service-provider notification to us: 72 hours from their awareness; check the contract says so. Say which clock you mean; at least three unrelated 72-hour deadlines exist in this area.
Do not. Do not work the incident inside an AI tool: entering the facts is disclosure to a third party and can waive privilege. Do not delay reporting because the fix is in progress; reportability does not depend on remediation.
Named decision-maker: [name]. Deputy: [name]. If neither is reachable within [N] hours,
escalate to [name].
Where these are canonical
The checklists live here and the reasoning lives elsewhere, so where a template and a page disagree, the page is right and this file has drifted. Gate authority and process are in promotion gates, the tier model in risk tiers, assignment in tiering, the registry fields in agent inventory, the builder obligations in citizen developer roles, and the escalation reasoning in legal escalation.
See also
- Sequencing — the order to introduce these artifacts, which matters more than their contents.
- Registry review cadence — the recurring use of the intake data.
- Crosswalk — which control each checklist item is standing in for.