Section I

Objectives and obligations

Every agent has to trace to two things: the business objective it serves, and the obligations that bind what it does. An agent that serves no current objective should be retired, and an agent that cannot show its obligations should not run.

The objective behind each agent

Agents are cheap to start and easy to forget. An agent built for a project that ended last year can keep running, spending money and holding credentials, long after anyone wanted it. To prevent that, every agent carries three facts about why it exists.

A business objective

The agent names the objective it serves and the measure that shows whether it is serving it. Someone in the organization has to still stand behind that objective.

An owner of its value

A named person owns the value the agent is supposed to deliver. That person may not be the one who runs it, and must be able to say whether it is still worth what it costs.

A review date

On that date the objective, the obligations and the value are checked again, and the agent is renewed, changed or retired.

These facts are set at Plan time, checked at every review, and used at Decommission time to decide when an agent should end. Performance and quality reports the objective's measure, and Financial governance sets it against the agent's cost.

The four kinds of obligation

Agent governance has to trace back to obligations that actually bind the organization. Each agent's record maps its capabilities to the obligations that govern them, so that a reviewer can see which rule each limit exists to satisfy.

Contractual

These are the terms the organization has agreed with others.

Customer agreements and service levels
Supplier contracts for models, tools and hosting
Intellectual property terms
Contracts between agents, covered under Network

Regulatory

These are the laws and rules that apply to what the agent does.

Data protection and privacy law
Rules for AI systems
Sector regulation
Export controls

Internal policy

These are the organization's own rules.

Acceptable use
Risk appetite
Data classification

Ethical

These are the principles the organization holds itself to.

Fairness and transparency
Bias mitigation
Explainability

How this section connects to the rest

Objectives and obligations are where the values come from. The lifecycle and the disciplines turn them into controls. A data protection rule becomes a limit on what an agent may store, a contract's service level becomes a response time that is measured, and a risk appetite becomes the agent's risk tier on the Operating Model page. Assurance then shows that each control holds, with evidence that someone outside the team can check.

Control objectives

There are 9 control objectives here. Each one states what it asks for, the risk it addresses and how it is measured. It then says what each risk tier requires, what evidence proves it, and who may check that evidence. The Operating Model page explains the tiers.

CMP-01

Contractual obligation mapping

Map each agent's capabilities and actions to the contracts that govern them, including customer agreements, supplier contracts for models and tools, and intellectual property terms.

Risk addressed: Agent actions that breach contract terms
Key metric: Share of agents mapped to their governing contracts

What each tier requires

Tier 1 Exploratory
The owner lists any contract whose data or tools the agent touches, even in a sandbox.
Tier 2 Operational
Each production capability names the contract clauses it relies on, and the map is checked at release.
Tier 3 Critical
Legal reviews the map before deployment, and a change to a governing contract triggers a review of the agent.
Tier 4 Strategic
Legal signs the map, and contract obligations are enforced as written limits that the agent cannot change.

Evidence: The contract map in the agent's record, with the clause references, the reviewer and the date of the last review.
Who may check it: Internal audit, an outside auditor and a partner.

CMP-02

Regulatory requirement traceability

Trace each agent capability to the regulations that apply to it, so that every obligation is linked to the functions that must meet it.

Risk addressed: Breach of applicable regulations
Key metric: Share of capabilities traced to regulatory requirements

What each tier requires

Tier 1 Exploratory
The owner states whether the agent could fall under any regulation if it went to production.
Tier 2 Operational
Each capability that handles regulated data or decisions names the regulation and the requirement.
Tier 3 Critical
Compliance reviews the trace before deployment and keeps it current with every release.
Tier 4 Strategic
The trace is part of the regulatory filing or register, and an outside auditor reviews it each year.

Evidence: A traceability matrix from capability to requirement, versioned with the agent, with the compliance reviewer named.
Who may check it: Internal audit and an outside auditor.

CMP-03

Regulatory change detection

Watch for changes in the regulations that apply, and assess their effect on existing agents before the change takes force.

Risk addressed: Compliance drift as regulations change
Key metric: Time from a regulation change to its impact assessment

What each tier requires

Tier 1 Exploratory
No separate watch is required while the agent stays in a sandbox.
Tier 2 Operational
Compliance subscribes to changes for the regulations named in the trace and reviews them each quarter.
Tier 3 Critical
Each relevant change gets a written impact assessment, with an owner and a date, before it takes force.
Tier 4 Strategic
Changes are assessed within a set number of days, and the executive sponsor approves the response.

Evidence: A log of regulatory changes received, with the agents assessed, the decision taken and the date.
Who may check it: Internal audit and an outside auditor.

CMP-04

Internal policy adherence

Keep agents within internal policy, including acceptable use, risk appetite and data classification.

Risk addressed: Breach of internal policy
Key metric: Policy findings per audit

What each tier requires

Tier 1 Exploratory
The agent uses only data classified as public or synthetic.
Tier 2 Operational
The agent's declared data classes and acts are checked against policy automatically before release.
Tier 3 Critical
A policy owner reviews the agent's declaration, and exceptions are written down with an expiry date.
Tier 4 Strategic
Policy is expressed as code that is evaluated on every act, and exceptions need executive approval.

Evidence: The policy evaluation results for the current version, and the register of exceptions with approvers and expiry dates.
Who may check it: Internal audit.

CMP-05

Ethical principles in design and operation

Build fairness, transparency and bias mitigation into how agents are designed and how they run, and review each agent against them before it reaches production.

Risk addressed: Harm from biased or unfair agents
Key metric: Share of agents with a completed ethics review

What each tier requires

Tier 1 Exploratory
The owner records any group of people the agent's output could affect.
Tier 2 Operational
The agent passes a standard ethics checklist before release.
Tier 3 Critical
An ethics review board reviews the agent, and its outcomes are tested for bias across affected groups.
Tier 4 Strategic
The review is repeated at each major change, and its results are published or shared with regulators where required.

Evidence: The completed checklist or review, the bias test results for the current version, and the reviewer's decision.
Who may check it: Internal audit and an outside auditor.

CMP-06

Compliance evidence retention

Keep the records that show compliance, including decision logs, policy maps and reviews, for as long as obligations require, in a form that someone outside the team can read.

Risk addressed: Being unable to show compliance under audit
Key metric: Audit readiness score

What each tier requires

Tier 1 Exploratory
Sandbox records are kept for the life of the experiment.
Tier 2 Operational
Records are kept for the period set by policy, in storage the agent cannot write to.
Tier 3 Critical
Records cannot be edited or deleted before their retention date, and retrieval is tested each year.
Tier 4 Strategic
Records are held to regulatory retention periods, and an outside auditor can retrieve them without the team's help.

Evidence: The retention schedule, the storage settings that prevent edits, and the result of the last retrieval test.
Who may check it: Internal audit and an outside auditor.

CMP-07

Business objective traceability

Trace every agent to a business objective that someone in the organization still stands behind. An agent with no current objective is a candidate for retirement.

Risk addressed: Agents that run on after their purpose has gone
Key metric: Share of agents traced to a current business objective

What each tier requires

Tier 1 Exploratory
The owner writes one sentence on what the experiment is meant to learn and when it ends.
Tier 2 Operational
The agent names the business objective it serves and the measure that shows it is serving it.
Tier 3 Critical
The objective is linked to a funded initiative, and the measure is reported each quarter.
Tier 4 Strategic
The objective is part of the organization's strategy, and the executive sponsor confirms it each year.

Evidence: The objective and its measure in the agent's record, with the person who stands behind it and the latest reported value.
Who may check it: Internal audit and an outside auditor.

CMP-08

An owner of the agent's value

Name a person who owns the value the agent is supposed to deliver. That person may be different from the person who runs the agent, and must be able to say whether it is still worth what it costs.

Risk addressed: Agents that nobody can justify
Key metric: Share of agents with a named owner of their value

What each tier requires

Tier 1 Exploratory
The person running the experiment owns its value.
Tier 2 Operational
A business owner is named, and accepts the agent at release.
Tier 3 Critical
The business owner signs off on cost against value each quarter.
Tier 4 Strategic
An executive owns the value, and reports it to the governance council.

Evidence: The named value owner in the agent's record, and their latest sign-off with its date.
Who may check it: Internal audit.

CMP-09

Review date and renewal

Give every agent a review date. At that date its objective, its obligations and its value are checked again, and it is renewed, changed or retired.

Risk addressed: Approvals that never expire
Key metric: Share of agents past their review date

What each tier requires

Tier 1 Exploratory
An experiment ends on its stated date unless it is renewed.
Tier 2 Operational
The agent is reviewed at least once a year.
Tier 3 Critical
The agent is reviewed at least every six months, and after any serious incident.
Tier 4 Strategic
The agent is reviewed at least every quarter, and the governance council records the decision.

Evidence: The review date in the agent's record, and the minutes or record of the last review with its outcome.
Who may check it: Internal audit and an outside auditor.

Quick reference

ID	Objective	Key metric
CMP-01	Contractual obligation mapping	Share of agents mapped to their governing contracts
CMP-02	Regulatory requirement traceability	Share of capabilities traced to regulatory requirements
CMP-03	Regulatory change detection	Time from a regulation change to its impact assessment
CMP-04	Internal policy adherence	Policy findings per audit
CMP-05	Ethical principles in design and operation	Share of agents with a completed ethics review
CMP-06	Compliance evidence retention	Audit readiness score
CMP-07	Business objective traceability	Share of agents traced to a current business objective
CMP-08	An owner of the agent's value	Share of agents with a named owner of their value
CMP-09	Review date and renewal	Share of agents past their review date