AI agent governance: 12 questions to answer before approval

An AI agent gets approved when its owner can answer the reviewers' questions with evidence. At a bank, an insurer, a hospital or a law firm, the team that builds an agent rarely has the final say. Security, risk, compliance, legal and privacy teams review it, and each one can stop it. Approvals stall when reviewers ask questions that the builders cannot answer with proof.

This guide lists the 12 questions reviewers ask most often, where each one comes from, and the evidence that answers it. It is written for the engineering or AI platform lead who has to get an agent through review.

Key takeaways

• No US regulator has an AI agent rule. Reviewers apply existing rules on cybersecurity, third parties, privacy and supervision, plus new guidance from supervisors.
• The questions are predictable. FINRA, the Financial Stability Board (FSB), the EU AI Act, HIPAA and insurance regulators ask about the same things: scope, identity, data, testing, records, stopping, ownership and vendors.
• Bring evidence, not only a policy. A permissions map, a test report with fixes and retests, a tested kill switch and sample action records answer most of the questions.
• Start narrow. One agent with a fixed job and human approval for high-risk actions is easier to approve than a broad platform.
• Approval is not permanent. A new tool, prompt or model version should trigger a new review.

Who Reviews an AI Agent

Most regulated companies send a new agent through several teams:

• Security: identity, access, attack resistance, logging and incident response.
• Risk management, including model risk where it exists: what can go wrong, which controls reduce it and what risk the business accepts.
• Compliance and legal: which rules apply to the use case, what customers must be told, record keeping and supervision.
• Privacy: which personal or regulated data the agent reads, keeps and sends.
• Third-party risk: the model provider, the agent platform and each tool server.
• Internal audit: later, whether the controls work as described.

Each team owns different questions. When one engineering lead brings answers to all of them in one pack, the review needs fewer rounds.

Why Agent Approvals Stall

Agents act. A chat assistant answers questions. An agent calls tools with real credentials, so it can move money, change records or send email. Reviewers who approved chat assistants must now judge what an agent can do on its own.

The rules were not written for agents. In the US, no regulator has issued a rule for AI agents. In April 2026, the Federal Reserve, the OCC and the FDIC replaced the SR 11-7 model risk guidance with SR 26-2. The new guidance says generative AI and agentic AI "are not within the scope of this guidance". Banks must govern them through their broader risk management and governance practices.

Guidance arrives fast. FINRA's 2026 oversight report named AI agent risks in December 2025. The FSB published sound practices with agent-specific controls on October 15, 2026. The cyber agencies of the Five Eyes countries published joint guidance on agentic AI in May 2026.

Evidence is missing. Builders bring an architecture diagram and a policy. Reviewers need proof that the controls work.

The 12 Questions Reviewers Ask

Each question comes from regulator or supervisory text. Use the evidence under each one as the checklist for your approval pack.

The EU AI Act's high-risk obligations cited below apply under the Digital Omnibus on AI from December 2, 2027 for uses listed in Annex III, such as credit scoring, and from August 2, 2028 for AI in regulated products. Article 50's disclosure duty is different: it has applied since August 2, 2026 (see question 12).

1. What can the agent do, and when must it ask a person?

Reviewers want the agent's job on one page: the tools it can call, the actions it may take and the actions it must never take. The FSB's examples of agent controls include "prohibiting agents from taking certain actions" and "setting clear, risk-based triggers for when an agent must seek human approval, confirmation or review". FINRA warns that agents "may act beyond the user's actual or intended scope and authority". The Five Eyes guidance says to "prevent agents from autonomously executing high impact actions or outputs without prior human approval".

Evidence: an agent profile with allowed actions, prohibited actions and approval triggers, for example payments above a set value, irreversible changes and messages to customers.

2. Whose identity does it use, and is its access the minimum it needs?

An agent that runs on a shared service account can reach far more than its job needs. The Five Eyes guidance says "strict adherence to the principle of least privilege is critical". Where an agent cannot be isolated, the FSB describes limiting its access to APIs, data, systems and other agents "to what is necessary". HIPAA already allows access only to "persons or software programs that have been granted access rights".

Evidence: a permissions map for each tool: the agent's own identity, its scopes, and whether it acts as itself or for a specific user.

3. What data can it reach, and can it send data out?

Privacy and compliance teams check which regulated data the agent can read and where that data can go. The HIPAA minimum necessary standard asks for "reasonable efforts to limit protected health information to the minimum necessary". NYDFS says firms "should also consider monitoring for unusual query behaviors that might indicate an attempt to extract NPI" (nonpublic information).

Evidence: a data map with sources, sensitivity, destinations and retention, plus tests that try to make the agent leak data.

4. How was it tested before launch?

Reviewers want proof that the agent resists attacks, not only that the model behaves. Agent hijacking is a form of indirect prompt injection: an attacker hides instructions in content the agent reads. In a 2026 red-teaming competition that NIST ran with Gray Swan and the UK AI Security Institute, "at least one successful attack was found against all of the target frontier models" across more than 250,000 attempts. The FSB describes "using 'red teaming' and other forms of testing" to check whether agents can escalate to humans, stop safely or return to a safe state.

Evidence: a test report with the attacks run on an isolated copy, the reproduced findings, the approved fixes and retests that show each attack now fails. Our guide to AI penetration testing for agents covers what to test.

5. Can we reconstruct every action?

When something goes wrong, reviewers need to know what the agent did and why. FINRA lists "how to track agent actions and decisions" among its considerations for agents. The FSB's examples of what to record include "the reasoning at each autonomous decision point; the APIs' data and other tools accessed by the agent; and the final outcome". For high-risk systems, the EU AI Act requires automatic logs (Article 12), and deployers must keep them for at least six months (Article 26).

Evidence: sample records for a few real tasks, the list of logged fields, where the logs go and how long they are kept.

6. Can we stop it quickly, and has anyone tested that?

The FSB asks firms to implement and test "risk-based 'kill-switch' mechanisms to pause, limit, override or remove an agent's access to systems, tools, databases or decision-making functions". The EU AI Act asks that people can interrupt a high-risk system through "a 'stop' button or a similar procedure" (Article 14).

Evidence: a record of a kill switch test: who triggered it, what stopped, how long it took and how the agent returned to a safe state.

7. Is human oversight real?

A human approval step helps only if the approver can say no. The EU AI Act asks deployers of high-risk systems to assign oversight to people who have "the necessary competence, training and authority" (Article 26). The FSB warns against automation bias and asks firms to assess "whether human overseers are providing effective oversight". Reviewers look for rubber-stamping: approvers who accept every recommendation without change.

Evidence: who approves what, what the approver sees before deciding, and sample approvals, including ones the approver changed or rejected.

8. Who owns the agent, and who approves changes?

An agent can gain new abilities from a new tool, a new prompt or a new model version. The FSB asks firms to "assign and document accountable individuals for each AI agentic use case". NYDFS says the asset inventory "should serve as the foundational input to the Risk Assessment".

Evidence: an inventory entry with the owner and risk tier, and a change-control rule that names who approves changes to the model, prompts, tools and permissions.

9. Which third parties are involved, and what do the contracts say?

Most agents depend on a model provider, an agent platform and tool servers. NYDFS suggests contract clauses on "the acceptable use of Artificial Intelligence" and on whether the firm's data "may be used to train AI models". For insurers, the NAIC model bulletin, adopted in 29 jurisdictions as of October 8, 2026, lists contract terms that "provide audit rights" and require vendors to "cooperate with the Insurer with regard to regulatory inquiries and investigations".

Evidence: a vendor list with the data each vendor receives, training-use terms, audit rights and incident notice terms.

10. How will we monitor it in production?

Approval at launch is not enough. FINRA describes "ongoing monitoring of prompts, responses and outputs" for generative AI. The FSB's examples include monitoring for scope creep, such as "an agent accessing data or customer records beyond what is necessary to achieve its pre-defined goals".

Evidence: a monitoring plan: what is watched, the alert thresholds, who responds and when the agent is paused.

11. What is the incident plan, and does it meet our notice deadlines?

A compromised agent is a security incident. NYDFS requires notice within 72 hours after a firm determines that a qualifying cybersecurity incident has occurred (Part 500.17). HIPAA and other rules have their own breach notice duties.

Evidence: an incident runbook for the agent: how to detect misuse, how to contain it, who decides on notice and how evidence is kept.

12. Does the use case change our legal duties?

Some uses carry extra duties. Under the EU AI Act, credit scoring and life and health insurance pricing for individuals are high-risk uses, with obligations from December 2, 2027. Since August 2, 2026, people must be told when they interact with an AI system, unless that is obvious (Article 50).

Evidence: a short legal assessment of the use case, including customer notices and any impact assessment it needs.

Build the Approval Pack

One pack answers all 12 questions:

Reviewers often file the same evidence under a framework. Our crosswalk to MITRE ATLAS and the NIST AI RMF shows how to label each finding, and our guide to AIUC-1 and ISO 42001 for AI agents maps the pack to both standards.

How to Get Approved Faster

• Start with one agent and a narrow job. The Five Eyes guidance says to "deploy agentic AI incrementally, beginning with clearly defined low risk tasks". The FSB says firms may widen an agent's access "as they gain confidence it can do so safely".
• Bring reviewers in at design time. Agree on the approval triggers and the evidence pack before you build, not at launch.
• Put hard limits in code, not only in the prompt. The FSB describes deterministic controls that "are introduced at design and implemented as code in the control plane".
• Show that fixes do not break the work. Replay approved tasks after each fix, so reviewers see that the agent still does its job.
• Plan the next review. Retest when tools, permissions, prompts or the model change, and update the pack.

Questions

What is AI agent governance?

AI agent governance is the set of rules, controls and records that decide what an agent may do, who is accountable for it, how it is tested and monitored, and how it is stopped. In regulated companies, it is how reviewers approve an agent and keep it approved.

Is there a US regulation written specifically for AI agents?

No. As of October 2026, no US regulator has issued a rule specific to AI agents. Supervisors apply existing rules on cybersecurity, third parties, privacy and supervision, plus guidance such as FINRA's 2026 oversight report. Bank model risk guidance SR 26-2 leaves generative and agentic AI out of scope.

What evidence do reviewers need to approve an AI agent?

Usually an agent profile with approval triggers, a permissions map, a data map, a test report with fixes and retests, sample action records, a tested kill switch, a change-control rule, vendor contract terms and an incident runbook.

Which agent actions should need human approval?

Actions that have a high impact or are hard to reverse: payments above a set value, changes to customer records, messages to customers and data that leaves the company. The FSB lists clear, risk-based triggers for human approval among its example controls.

How often should an approved agent be reviewed again?

Whenever its tools, permissions, prompts or model change, and on a regular schedule. An agent gains new abilities when it gets new tools, and attack techniques change. Retest the agent, update the evidence and record who approved the change.