ORIGINAL FRAMEWORKS
Three phases every organization moves through as its authorization coverage ratio changes. Most are in phase one without knowing it - and the ratio is the proof.
Most organizations enter the Recognition stage only when an external event forces it, a failed audit, a vendor change, or a regulatory inquiry. The model exists to make Recognition a deliberate choice rather than an incident response.
Free to read and cite with attribution to Sougata Roy and sougataroy.com. Do not republish, rebrand, or claim authorship of any framework, term, or model as your own.
The problem
Inside the organization
The framework
The Authorization Coverage Lifecycle names the three phases every organization moves through as its ratio of governed agents to total agents changes. The naming matters because organizations in phase one often believe they are in phase three. The gap between where an organization thinks it is and where its authorization coverage ratio places it is itself a governance finding.
Compounding
Before deployment
WARNING: The Risk of Unquantified Governance Debt. Executives unable to answer these questions carry significant debt in regulated environments. Governance Posture is Reportable Only When Documented. Accountability is established through evidence, not when the environment simply feels managed.
Requirement: Requires a current agent registry with active deployment status for every entry. Evidence Standard: Registry with active status column.
Requirement: Requires signed intent statements for every agent, reviewed on a set cadence. Evidence Standard: Signed and dated intent statement per agent.
Requirement: Requires a named individual assigned as the accountable owner for every registry entry. Evidence Standard: Owner assignment with defined review cadence.
Requirement: Requires active logging tested against the specific regulatory frameworks applicable to your industry. Evidence Standard: Logging verification report dated within 90 days.
Why it lasts
Who it is for
Executive FAQ
These checkpoints make governance debt visible before it becomes an audit finding, a board question, or an incident response problem.
Referenced in
"Who Owns the Agent?" applies this framework to real-world deployment scenarios and maps it to named governance incidents from 2024 to 2026.
White paper
The Intent Architecture Stack white paper, ten sections, complete diagnostic, named incident analysis, Intent Document template.
Research brief
Source: McKinsey and Company, "State of AI Trust in 2026: Shifting to the Agentic Era," March 25, 2026. Survey of approximately 500 organizations, December 2025 to January 2026.
Continue through the connected framework sequence above.
60-minute operating sprint
Use this as a live governance exercise. Leave the session with named evidence, a visible gap, and a next owner rather than another discussion note.
Working session board
6
Steps
60
Minutes
1
Owner
Live
Decision
30 minutes
Answer four questions in writing.
Output
Written evidence ready for the next governance decision.
Action
Question 1: Do you know how many AI agents or tools your organization currently operates, including Microsoft 365 Copilot deployments, custom agents, and third-party AI tools? If no: you are in Accumulation. Governance debt is growing without measurement.
Output
Written evidence ready for the next governance decision.
Action
Question 2: For the AI deployments you know about, what percentage have documented authorization, named owners, and a defined review process? If less than 50 percent: you are in Accumulation regardless of your answer to question 1.
Output
Written evidence ready for the next governance decision.
Action
Question 3: Has your compliance or legal team reviewed AI deployment practices in the last six months and produced a written assessment? If no: you are in Accumulation even if the technology deployment is well-managed.
Output
Written evidence ready for the next governance decision.
Action
Question 4: Is there an active program - with a named owner and a budget - to close the governance gaps identified in questions 1 through 3? If yes: you are in Recognition. If the program has produced closed gaps: you are in Resolution.
Output
Written evidence ready for the next governance decision.
30 minutes
Based on your phase, define one concrete action to take this week. If you are in Unreconciled: complete the agent reconciliation exercise from the Tenant Agent Reconciliation Framework. If you are in Exposure Recognized: produce a written list of the three highest-risk governance gaps and assign an owner to each. If you are in Coverage Operating: schedule a review of the gaps you have already closed to confirm they remain closed.
Output
Written evidence ready for the next governance decision.