Start Here
The document that costs forty minutes or four months.
Every enterprise deploying AI agents is writing one document per agent whether it knows it or not. The record that says who authorized the agent, what it may do, and what it must never do. The only choice the organization actually makes is when that record gets written, and almost nobody makes that choice on purpose.
The Thursday afternoon
An accounts-payable manager at a distribution company built an agent in Copilot Studio in March, on her own initiative, without a project code, which is how most agents get built. It matches invoices to purchase orders and routes the mismatches to a human. It has run for eleven weeks. Nothing about this Thursday was triggered by an incident or an examiner. Her company adopted one rule a month ago, every agent gets an authorization record or gets suspended, and her agent's deadline is Friday.
She opens the template and starts the clock. The identifiers take two minutes, because they are copied, not composed. The purpose takes eight, three sentences in her own words for a reader she will never meet. The authorized actions take five, written from memory, because she built the thing. Then the prohibitions, and the clock slows down, because nothing in that entry was ever decided at all. Nobody had asked her what the agent must never do, including her. Twelve minutes, most of them spent deciding rather than typing, which is the correct ratio.
Total the clock and it comes to roughly forty minutes. The number is an estimate of a writing act, generous in both directions, and nothing in the argument rides on the stopwatch. What rides on the afternoon is the date at the bottom of the page, which now precedes whatever happens next.
The same page, four months later
The same document gets written a second way. That version is drafted in a conference room booked through the end of the quarter, in month two of a remediation program, after the finding. Two contractors, a program manager, a rotating chair from the business line, and counsel on Thursdays. The purpose paragraph is assembled from a demo recording because the builder left in June. The authorized actions are recovered from run logs, which show what the agent did, a different list from what it was permitted to do. The prohibitions take longest here too, decided by people who never met the agent.
A record written in month two can be accurate about everything except the one thing an examiner checks first, which is when the deciding happened. Forty minutes of writing, or four months of remediation. It is the same document either way.
Of the agents operating in your environment right now, how many have this page? Reaching for the answer needs two numbers, a count of agents and a count of records, and the first has to come from somewhere more honest than the last slide deck that quoted one. The count you cannot produce is the answer.