GOV-02: Named accountable owner
In short: Assign every agent a named person who answers for what it does, and record that owner in the inventory. When an agent misbehaves, someone must decide what happens next. Without a named owner, incidents and reviews stall while teams argue about responsibility.
What does GOV-02 require?
Assign every agent a named person who answers for what it does, and record that owner in the inventory.
Why does it matter?
When an agent misbehaves, someone must decide what happens next. Without a named owner, incidents and reviews stall while teams argue about responsibility.
How do you test it?
- Filter the inventory for agents with no owner or a shared mailbox as owner.
- Confirm each owner is a current employee in the HR system.
- Ask two owners to describe what their agent does.
Which platforms document GOV-02?
Documented by NewCore, Silverfort, Astrix Security, Cyera Identity, Descope, Token Security, SailPoint Entro and Clutch Security.
- 9.10NewCore documentedSource: NewCore: Discover; NewCore: Govern, read
- 8.35Silverfort documentedSource: Silverfort: AI Agent Security, read
- 7.30Astrix Security documentedSource: Astrix product, read
- 7.30Cyera Identity documentedSource: Oasis Agentic Access Management, read
- 6.85Descope documentedSource: Descope Agentic Identity Hub 3.0, read
- 6.55Token Security documentedSource: Token Security home, read
- 6.55SailPoint Entro documentedSource: SailPoint agentic AI security, read
- 6.35Clutch Security documentedSource: Clutch Security platform, read
- 6.55Aembit partly documentedSource: Aembit home, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- EU AI ActArticle 26(2): Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority. Source: Regulation (EU) 2024/1689, the AI Act, on EUR-Lex
- NIST AI RMFGovern function: Accountability for AI risk sits with named roles. Source: NIST AI Risk Management Framework
Which controls are related?
- GOV-01Agent inventory
- GOV-03Documented purpose
- GOV-15Periodic access review
Glossary: agent governance, accountable owner, agent sponsor, ai rmf.
Reviewed by The Register desk