There are 8 control objectives here. Each one states what it asks for, the risk it addresses and how it is measured. It then says what each risk tier requires, what evidence proves it, and who may check that evidence. The Operating Model page explains the tiers.
PLN-01Strategic alignment
Link every agent initiative to a strategic objective before money is spent on it, so that effort does not go to work the organization does not want.
- Risk addressed
- Agents that do not serve the organization's objectives
- Key metric
- Share of agent initiatives linked to a strategic objective
What each tier requires
- Tier 1 Exploratory
The request names the question the experiment is meant to answer.
- Tier 2 Operational
The request names the business objective and the person who stands behind it.
- Tier 3 Critical
The portfolio board approves the link to a funded initiative before design starts.
- Tier 4 Strategic
The executive sponsor approves the initiative as part of the strategy.
- Evidence
- The approved intake record, with the objective, the sponsor and the approval date.
- Who may check it
- Internal audit.
PLN-02Portfolio rationalization
Find agents that do the same job, and consolidate them, so that the organization does not pay to build and run the same capability twice.
- Risk addressed
- Redundant or overlapping agents
- Key metric
- Duplicate capabilities found and resolved
What each tier requires
- Tier 1 Exploratory
The requester searches the catalog before starting an experiment.
- Tier 2 Operational
Intake checks the catalog for an existing agent that does the job, and records the result.
- Tier 3 Critical
An architect confirms there is no overlap, or approves the overlap with a reason.
- Tier 4 Strategic
The portfolio is reviewed for overlap each quarter across the whole organization.
- Evidence
- The catalog search recorded at intake, and the portfolio review with its consolidation decisions.
- Who may check it
- Internal audit.
PLN-03Standard demand intake
Send every request for a new agent through one intake process, so that each is evaluated before work begins.
- Risk addressed
- Uncontrolled growth in the number of agents
- Key metric
- Share of agents that came through intake
What each tier requires
- Tier 1 Exploratory
A short self-service form registers the experiment.
- Tier 2 Operational
The full intake form is completed and triaged within a set time.
- Tier 3 Critical
Intake includes a first risk tier and an initial list of the obligations from section I.
- Tier 4 Strategic
Intake goes to the portfolio board with a business case.
- Evidence
- The intake record for the agent, linked from its catalog entry.
- Who may check it
- Internal audit.
PLN-04Investment governance
Evaluate what each agent initiative is expected to return before funding it, and compare the result with the projection afterwards.
- Risk addressed
- Poor use of money on agent initiatives
- Key metric
- Projected return compared with actual return
What each tier requires
- Tier 1 Exploratory
Experiments run within a fixed budget set by the team.
- Tier 2 Operational
The request states the expected cost and benefit.
- Tier 3 Critical
Finance reviews the business case, and the actual return is compared with it after six months.
- Tier 4 Strategic
The investment committee approves the case, and the comparison is reported to the executive sponsor.
- Evidence
- The business case, the approval, and the later comparison of projected and actual return.
- Who may check it
- Internal audit and an outside auditor.
Record what each planned agent will depend on and what will depend on it, including other agents, so that failures and changes can be traced. The Network discipline governs these relationships once they exist.
- Risk addressed
- Cascading failures from unknown dependencies
- Key metric
- Share of agents with recorded dependencies
What each tier requires
- Tier 1 Exploratory
The owner lists the systems the experiment calls.
- Tier 2 Operational
Every dependency on another agent or system is recorded in the catalog before release.
- Tier 3 Critical
Dependencies are declared in the agent's signed description and checked against what it actually calls.
- Tier 4 Strategic
The dependency map is reviewed by the owners of every agent on it before release.
- Evidence
- The declared dependencies in the catalog, and the result of comparing them with observed calls.
- Who may check it
- Internal audit and a partner.
PLN-06A complete agent catalog
Keep a registry of every agent the organization runs or relies on, with its owner, its tier and its status, so that no agent operates outside governance.
- Risk addressed
- Agents that governance does not know about
- Key metric
- Share of running agents found in the catalog
What each tier requires
- Tier 1 Exploratory
Experiments are registered, and are marked as sandbox only.
- Tier 2 Operational
Every production agent has a catalog entry with a named owner before it runs.
- Tier 3 Critical
The catalog entry is the source the run-time checks read, so an unregistered agent cannot run.
- Tier 4 Strategic
The catalog is reconciled with what is actually running each month, and the result is reported.
- Evidence
- The catalog, and the latest reconciliation between catalog entries and running agents.
- Who may check it
- Internal audit and an outside auditor.
PLN-07Retirement planning
Set the conditions under which an agent will be retired when it is first approved, so that old agents do not pile up.
- Risk addressed
- Old agents that nobody retires
- Key metric
- Share of agents with written retirement conditions
What each tier requires
- Tier 1 Exploratory
The experiment has an end date.
- Tier 2 Operational
The agent states the conditions that would end it.
- Tier 3 Critical
The retirement conditions are checked at every review date.
- Tier 4 Strategic
The retirement plan names who is affected and how they will be told.
- Evidence
- The retirement conditions in the agent's record, and the review records that checked them.
- Who may check it
- Internal audit.
PLN-08Strategic risk assessment
Assess the risks in the agent strategy itself, including dependence on one supplier, technology going out of date and whether the organization is ready.
- Risk addressed
- Unrecognized risks in the agent strategy
- Key metric
- Share of initiatives with a completed risk assessment
What each tier requires
- Tier 1 Exploratory
No separate assessment is needed for an experiment.
- Tier 2 Operational
The request notes any single supplier the agent would depend on.
- Tier 3 Critical
Risk reviews the initiative and records how each strategic risk will be handled.
- Tier 4 Strategic
The assessment goes to the executive sponsor and is repeated each year.
- Evidence
- The risk assessment, the decisions on each risk and who made them.
- Who may check it
- Internal audit and an outside auditor.