What's inside

  • Governance & accountability — ownership, inventory, and policy before the first agent ships.
  • Context & data controls — permissioning, freshness, and lineage for everything agents see.
  • Validation & evaluation — testing non-deterministic systems over trajectories, not single outputs.
  • Human oversight — risk gates, reviewer design, and override paths that hold up.
  • Audit trail — decision-grade logging, retention, and integrity.
  • Explainability & fairness — reason codes, adverse action, and bias testing.
  • Third parties & security — vendor AI, guardrails, and prompt-injection defenses.
  • Regulatory mapping — a one-screen map from each control area to the framework that expects it.

It distills the controls covered across our research — from model risk management for agentic AI to the audit trail and human-in-the-loop design— into one working document.