FIRST PUBLIC USE
March 20, 2026
- What it is
- The set of organizational decisions that has to exist beneath the platform controls, establishing who decided that the agent may operate, the limits of that operation, and the authority behind the decision.
- What it is not
- Not a product, not a console, and not a technical control. A vendor can provide the controls and the settings. The organization still has to make the decisions that give those controls their purpose.
- The evidence it produces
- A dated and signed record that names a person, defines the agent's scope, and identifies the conditions that require the authorization to be reconsidered.
- Who is accountable
- The business authority with the standing to accept the risk, separate from the team that built or administers the agent.
- The examination question it answers
- Who authorized this agent, and can you show me the decision behind that authorization rather than the configuration?