Agents and your own AI · Governance · Part 02 · Beginner · 6 min read
Company rules for agents on one page
A twenty-page policy nobody reads protects less than a single page that everyone has on the noticeboard. A complete template with eight points that takes five minutes to read and can be adopted this week.
Last reviewed:
#Governance#AI agents#Security
In this article
Companies make one of two mistakes with rules for AI. Either they have none — and a few months later it turns out that half the team has client data in private accounts. Or they have a twenty-page policy that nobody reads to the end and that, in effect, protects just as well as the non-existent one.
One page that people actually read beats both. Here it is.
Eight questions the rules have to answer
- 1Who may deploy an agentWho decides and who has to be asked. The most common gap is that nobody knows.
- 2What identity it runs underIts own account with limited permissions, not an employee's personal account. Without that nothing can be traced.
- 3What it may do by itselfList it. Not “everything except…”, but an enumeration of permitted actions.
- 4What it may only prepareEverything that someone else will see or that costs money.
- 5Where it must not go at allSystems and data to which the agent is not to get even technical access.
- 6Who answers for the resultA specific person, not a role and not a team. Whoever started the agent answers for it.
- 7How it is loggedWhat is recorded, where it lives and who looks at it.
- 8What is done when things go wrongThe first three steps and one phone number. Nobody reads more than that in a crisis anyway.
A template to adopt
The following text is prepared so that you fill in the names and links. The places to fill in are in italics.
Rules for the use of AI agents
In force from: … · Approved by: … · Review: once every six months
1. What an agent is. An agent is an AI tool that carries out steps by itself without asking at each one. A chat in which you decide after every answer is not an agent, and these rules do not apply to it.
2. Who may deploy an agent. A new agent is deployed after approval by (name / role). Submitted for approval: what it is for, which data and systems it needs access to, and what it will do by itself. Without approval, nobody runs an agent over company data.
3. Identity. Every agent runs under its own account, with permissions limited to what it needs. Employees' personal accounts are not used. Agents' credentials are managed by (name / role) and are renewed once every (period).
4. What an agent may do by itself. Read and search the data it has access to. Prepare proposals, drafts, summaries and supporting materials. Save them to a designated place (path / system). Move and label files in a designated folder.
5. What an agent may only prepare. Anything that someone outside the company will see; anything that costs money; anything that changes records in production systems. Execution is confirmed by a person. Confirmation must not be given in bulk without the content being displayed.
6. Where an agent must not go. Without exception: payroll and HR systems, health data, access to payments, permission management, deletion of data, systems covered by contractual confidentiality (list them). Here the agent does not get even technical access.
7. Responsibility. The person who started the agent is responsible for its output, not the agent's author and not the supplier of the tool. When output goes outside, the person who approved it is responsible.
8. Logging. The following is recorded: what the agent ran, when, on what data, what it returned and who approved it. The logs are kept (where) and are reviewed by (who) once every (period).
9. When something goes wrong. (1) Stop the agent — (how exactly). (2) Report it to (contact). (3) Delete nothing; the logs are needed. In the case of a personal data breach, (name / role) decides on the next steps, within the time limits set by law.
10. What does not belong in AI tools. Credentials, health data, clients' personal data without consent, unpublished company information, other parties' confidential materials and anything covered by confidentiality. Details: (link to internal rules).
Three things the template does differently from the usual policies
It lists what is permitted, not what is forbidden. A list of prohibitions is always incomplete — agents can do things that didn't occur to you while writing. An enumeration of permitted actions is finite and can be complied with.
It names one responsible person. “The team is responsible” means nobody is responsible. The most common silent assumption — that the tool or its author is to blame for an agent's mistake — is useless both legally and operationally.
It has a three-step procedure for a crisis. At the moment things go wrong, nobody reads paragraphs. They read three bullet points and one number.
Why writing it and leaving it isn't enough
In 2026 Meta showed what deploying agents at scale without matching governance looks like. According to internal figures reported by Reuters, the volume of code changes rose by 220% year on year, but what made it to users rose by only 36% — while serious technical and security incidents increased by 40% and the time people spent firefighting them grew by 70%. In the end the company cancelled the most ambitious part of the plan.
The lesson is not “agents don't work”. The lesson is that volume is not value and that you can't tell without measuring. So add one extra thing to your rules: what you will measure and how often you will look at it.
How to get it adopted so that people read it
- One side of A4. If it doesn't fit, cut text, don't shrink the font.
- A half-hour presentation, not a mass email. Go through it with the team and let them ask questions.
- Specific examples from your company. Nobody connects general wording with their own work.
- An easy route to approval. If approving a new agent takes three weeks, people will go round it.
- Review twice a year. Tools change faster than policies.
What to watch out for
- A ban without an alternative gets circumvented. If you ban a tool and offer no replacement, people will use it from private accounts and you won't know about it.
- Rules for agents are not rules for chat. Don't mix them; they're different levels of risk and a different target group.
- Transparency towards the public is a regulatory matter too. From 2 August 2026, transparency rules under the AI Act apply in the EU — anyone running an AI chatbot facing customers has to disclose it. Put it in the rules so it doesn't come as a surprise.
- A template is a template, not legal advice. For regulated sectors and personal data, have a lawyer go over it.
The next part is a short case study about what happens when the very tool you trust gets poisoned.
Sources
Was this helpful?
Get the next part
New parts of the series and what matters in the world of agents, in one weekly email.
The Top 30 tips e-book, free — it lands in your inbox right away.
Then 1 tip a week · no spam · unsubscribe in one click
Prefer a system to single tips? The free email course — seven days, seven emails, one skill a day.