As part of Attestia - Consulting advisory
AI agent governance: from idea to the board report
In Attestia every agent has a card with an owner, guardrails and an autonomy level. It passes a readiness check before launch and regular reviews afterwards.
Free survey: 21 questions across 7 layers, result straight away, no sign-up.
AG-014Complaints handling agent
- Stage
- Controlled launch
- Autonomy
- Supervised autonomy
- Owner
- a named person with the right to pause the agent
- 1Mandate
Drafts replies to complaints up to EUR 100. Refusals stay with people.
Intent statement
- 2Outcome
A reply in 4 hours instead of 3 days, at the same quality.
Outcome statement · Business outcome target
- 3Guardrails
No access to payment data. Every decision goes to the log.
Named owner · Constraints list · Decision log
- 4Autonomy
The agent recommends, a person approves.
Decision rights map
- 5Escalation
An amount above the threshold or a threatened dispute: the case goes straight to a person.
Exception table · Manual fallback protocol
- 6Improvement
Weekly spot checks of replies, a drift monitor, a quarterly review.
Spot-check protocol · Drift monitor
- Pre-Flight passed (11/11)
- Passport signed
A human in the loop is not yet control
In regulated industries an AI agent needs an owner, autonomy limits, a decision log and clear rules for when a person takes over the decision. A human in the process is not yet control: what counts is whether that person has the time, the information and the authority to stop the agent.
The agent governance module records these arrangements in one place and keeps them current. The card has versions, decisions are made by named people and reviews have due dates.
The agent lifecycle, with a gate before launch
An agent moves through five stages. The controlled launch (in IT projects: hypercare) begins only after passing Pre-Flight for the latest card version.
01
Idea
Deployment qualification
Should this task go to an agent at all. Decision: GO, HOLD or NO-GO.
02
Design
Agent card
Owner, goal with exclusions, guardrails and autonomy level.
03
Parallel run
Pre-Flight scenarios
The agent works alongside people. It now counts towards the compliance score and the evidence package.
Gate
Pre-Flight
11 questions, worst-case scenarios and a stop drill. Without a pass the agent cannot move to the controlled launch.
04
Controlled launch
Agent passport
The owner signs the current card version. The passport has an expiry date.
05
Production
Measurement card and reviews
Value gates after go-live: GO, HOLD, REBUILD or KILL. Plus regular agent reviews.
From the parallel run onwards an agent can be paused, and it can be retired from any stage. Every stage change is made by a named person, with a date and a reason.
What's in the module
Everything below works in Attestia today, in organisations led by an advisor.
- Agent register
- An agent is a kind of AI system in the same register as your other systems, with its own code and lifecycle stage. Built, bought or embedded in a SaaS tool.
- Agent card
- Six layers: mandate, outcome, guardrails, autonomy, escalation and improvement. The card has versions, and the changes between them show in a comparison.
- Deployment qualification
- Before any design work: should this task go to an agent at all. A GO, HOLD or NO-GO decision, signed by a named person.
- Pre-Flight
- The gate before the controlled launch: 11 questions, worst-case scenarios, a stop drill and a context test.
- Autonomy history
- Every change of autonomy level has a reason, evidence and the person who made it.
- Agent reviews
- Measurements first, then their interpretation, then changes to the card. An overdue review is flagged.
- Agent passport
- The owner signs off the content of the current card version. The passport has an expiry date and can be revoked.
- Incidents
- An incident goes through a post-incident review with one question: a one-off case or a gap in the card. A gap ends with a fix in a new version.
- Measurement card
- Agent KPIs with a target for today and value gates after go-live. A committee makes the GO, HOLD, REBUILD or KILL decision.
- Net hours balance
- The saving after subtracting the time people spend overseeing the agent.
- Agent portfolio
- The same people's oversight hours across all of the organisation's agents. Each person counts once.
- Quarterly board report
- Figures from the portfolio, reviews, passports, the measurement card and incidents, plus the points that need a board decision.
- Export
- Export to PDF, DOCX and XLSX. The agent card and the stop-drill record also go into the evidence package for buyers.
AI agents and the AI Act
Agent governance does not replace AI Act compliance. It complements it.
- Art. 6In Attestia an agent goes through the same risk classification as any AI system. The agent card shows the result.
- Art. 50(1)An agent that acts towards third parties must disclose that it is AI and, under the European Commission guidelines of 20 July 2026, also on whose behalf it acts.
- Art. 14A high-risk system must be overseeable and stoppable by a person. The stop drill in Pre-Flight tests this in practice.
- Art. 26(6)A deployer of a high-risk system keeps logs for at least 6 months. You record the agent's log policy in the card.
- Art. 73An incident reported in Attestia with the Art. 73 form then goes through a post-incident review.
The agent card and the Pre-Flight record document operational readiness. They are not documents required by the AI Act, nor proof of legal compliance.
How to start
The module runs in organisations led by an Attestia - Consulting advisor. It is not part of the Free, Starter, Pro or Team plans.
- 01
Readiness survey
A free self-assessment: 21 questions across 7 layers, result straight away, no sign-up.
- 02
A conversation with an advisor
We agree which agent or process to start with and which package fits: AI & Agent Governance or Agent Review (Pre-Flight).
- 03
Work in the module
We run the register, the cards, Pre-Flight and the reviews together in your Attestia organisation.
- Same price: an advisory package costs the same with or without Attestia.
- After the project: you keep read access to the agent cards and decisions, plus a full data export.
- Alternative: we can also keep the agent register and cards in your own tools.
Frequently asked questions
Start with the readiness survey
It takes about 10 minutes. The result shows a score for each of the 7 layers and a readiness level: L1, L2 or L3.
Attestia is a compliance automation tool, not legal advice. The agent card and the Pre-Flight record document operational readiness, not proof of legal compliance.