Agent onboarding checklist template
In short: This template is the checklist to complete before an AI agent goes live. It covers the owner, purpose statement, data classes, credentials, tool list, approval rules, logging and an end date. Each line names the control it evidences, so the finished checklist doubles as audit evidence for that agent.
Download Agent onboarding checklist (MD)
Identity and ownership
- Agent registered in the inventory with a unique identity (GOV-01)
- Named accountable owner recorded, who is a current employee (GOV-02)
- Backup owner recorded
Purpose and scope
- Purpose statement written and approved by the owner (GOV-03)
- Data classes the agent may read and write listed (GOV-22)
- Risk tier assigned
Policy and approval
- Policies tested against recorded sessions (GOV-09)
- High-risk actions mapped to approvers in the approval matrix (GOV-07)
- Self-approval blocked (GOV-08)
End of life
- Planned end date or review date set (GOV-12)
- Kill switch tested for this agent (GOV-11)
Third-party agents only
- Supplier assessment completed and contract covers logging and incident notice (GOV-21)
Which controls does it support?
- GOV-01Agent inventory
- GOV-02Named accountable owner
- GOV-03Documented purpose
- GOV-04Least privilege at creation
- GOV-05Short-lived credentials
- GOV-07Human approval for high-risk actions
- GOV-08No self-approval
- GOV-09Policy testing before go-live
- GOV-10Tool allow-listing and hiding
- GOV-11Revocation and kill switch
- GOV-12Decommission at task end
- GOV-13Per-action audit log tied to a person
- GOV-14SIEM export
- GOV-17MCP server registry
- GOV-18Delegation bounded by the person's permissions
- GOV-21Third-party agent onboarding
- GOV-22Data access boundaries
- GOV-23Evidence retention
Reviewed by The Register desk