Identity registration
Registered with a distinct agent identity. Human requesters are not used as the agent's operating identity.
Back to framework
CONSTRUCTED EXAMPLE
Completed example: Internal customer case triage agent
A generic enterprise support team is preparing an agent that classifies incoming cases and recommends priority for a human service lead.
Published under CC BY 4.0. Free to reproduce, adapt, translate, and use commercially, including inside your own governance program, with attribution to Sougata Roy and a link to this page. Attribution is a condition of the license. Claiming authorship is not attribution. Full terms at sougataroy.com/rights
Cite this framework
Sougata Roy, "The Organizational Agent Controls", Version 1.0, April 2026, https://sougataroy.com/frameworks/organizational-agent-controls
Filled control record
Five decisions, completed for one generic enterprise scenario
This scenario is constructed for explanation. It is not a real organization and is not drawn from an engagement.
Intent-bound scope
Reads approved case fields and a service taxonomy. It may recommend a priority and route a draft note, but it cannot change the system of record or communicate externally.
Authorization expiry
Reviewed every 90 days and whenever scope, data classification, regulatory context, or the accountable owner changes.
Isolation and stop capability
The service operations lead can suspend the agent through the documented stop procedure without calling the original developer.
Explicit authorization on record
Approval authority, purpose, scope, prohibitions, review triggers, stop authority, and approval date are recorded before production use.
How to use this page
Compare this completed record with the primary control model, then document a real agent against the five decisions. The example demonstrates specificity; it does not replace organization-specific authorization.