Download the checklist template (CSV) to record the five answers, evidence references and next decisions for one agent.
This is a working governance aid. It does not establish that a control is effective or that every agent has been discovered. Keep passwords, access keys and confidential configuration data in their authorised systems.
Set the boundary
Record the agent’s name or internal reference, business process, operating environment, people taking part and date of the review. Identify which agent, configuration and evidence the record covers. Keep excluded systems or questions visible in a separate scope note.
1. Who owns the agent?
Name the person accountable for its business purpose and the person responsible for technical decisions. Confirm that they accept those responsibilities. Identify who can authorise access or policy changes if that authority sits elsewhere.
Record:
Business owner, role and agreed contact route.
Technical decision owner and relevant control owners.
Evidence that the responsibilities have been accepted.
Any ownership gap, the person resolving it and the agreed next review date.
2. What is it here to do?
Describe the business task, the expected input and the intended output. State the boundary of the agent’s role, including whether it prepares information for review or may take an operational action.
Record:
Business task and intended users.
Expected output and permitted actions.
Activity outside the agreed role.
Person who approves a change in purpose or scope.
3. What can it access?
Identify the identities, permissions, connectors and data locations used for the task. Link the answer to authorised evidence and record why each material connection is needed. A connector name alone does not establish the information or actions available through it.
Record:
Identity and relevant permissions.
Connectors, data locations and responsible owners.
Dated evidence reference, reviewed by an authorised person.
Access questions that still need a decision.
4. When must a person decide?
Identify which actions require approval, who can approve them and what evidence they need. Record the escalation route for an uncertain result and the person who can pause the agent. Confirm a practical handover if the normal decision owner is unavailable.
Record:
Approval points and decision owners.
Evidence required for each approval.
Escalation and pause responsibilities.
Changes that require a new decision before the agent proceeds.
5. When will it be checked again?
Set the next review date and the changes that should trigger an earlier check. Consider a change in purpose, owner, permissions, data connections or operating environment. Name the person responsible for retirement when the business task ends.
Record:
Next review date and accountable reviewer.
Events that trigger an earlier review.
Retirement decision owner and relevant technical responsibilities.
Where the current record and decision history are kept.
Turn unknowns into an action record
For each unanswered point, capture the decision needed, evidence required, responsible person, agreed due date and current state. Use the states “Evidence recorded”, “Needs evidence”, “Decision required” or “Outside this scope”. These describe the record, not a security rating.
Read the completed record with the people named in it. Agree the next decision and any separately authorised work. Keep an unknown visible until the relevant evidence or decision is recorded.
Microsoft’s Agent 365 overview provides product context for Observe, Govern and Secure. Available capabilities depend on supported use cases, licensing, permissions and configuration.
Read the ownership guide for the reasoning behind the record.
Request a scoped review
Braintree’s scoped agent governance review starts with a scoping conversation. The agents, evidence, outputs and commercial terms are agreed before the paid review begins.
SECURITY
Make the next decision clear.
Explore the related Braintree security services and resources.
