AI Agent Governance Checklist

AGAI GOVERNANCE

AI agent governance checklist

Review whether an AI agent has a named owner and sponsor, a defined purpose, understood data sources, scoped permissions, an identifiable sign-in, usable audit visibility, human approval for consequential changes and a retirement plan.

This checklist runs in your browser. It does not connect to a tenant, send or store your answers, or collect names, prompts, credentials or agent configuration. Confirm each item using your own evidence; this checklist does not certify compliance.

AccountabilityA responsible owner and sponsor are named

Reference: Microsoft, AI agent shared responsibility guidance (read 6 November 2026).

Purpose and scopePurpose, users and out-of-scope tasks are documented

Reference: Microsoft, AI agent shared responsibility guidance (read 6 November 2026).

Data and toolsData sources, connectors and tool actions are reviewed

References: Microsoft Copilot Studio, Add tools to custom agents; Microsoft Foundry, agent identity concepts (both read 6 November 2026).

PermissionsIdentity and permissions are scoped to the approved purpose

References: Microsoft Security, identity and access least-privilege guidance; Microsoft Foundry role-based access control (both read 6 November 2026).

Identity and sign-inAuthentication method and sign-in identity are understood

References: Microsoft Foundry agent identity concepts and Microsoft Copilot Studio end-user authentication (read 6 November 2026).

AuditAvailable audit events, access and retention are reviewed

References: Microsoft 365 Copilot auditing and data protection overview; Microsoft Purview audit activities for Copilot (read 6 November 2026). These cover their named services, not every agent.

Human approvalA human approval step exists before consequential changes

No Microsoft-specific retirement-date requirement was confirmed in the sources checked; choosing a review date is a local governance prompt, not a product requirement.

RetirementA retirement or review date is planned

This is an operational prompt, not a Microsoft-mandated date or retention period.

Mark items from your evidence, then copy or print the checklist.

How it works

Choose a status for each governance prompt. “Not checked” is never treated as confirmed. The summary counts confirmed, open and not-applicable items; it is not a risk score, audit result or compliance certification. Confirm platform-specific controls in the linked Microsoft documentation and your own tenant configuration.

Frequently asked questions

Does the checklist inspect an agent? No. It only organizes the review you perform.

Does Microsoft require a retirement date? This page makes no such claim. A review or retirement date is a local governance prompt.

Does a confirmed item prove compliance? No. Keep the evidence and assess your organization's policies and applicable requirements.

Microsoft documentation

Microsoft Azure AI Agent Service, AI agent shared responsibility guidance (read 6 November 2026): AI agent shared responsibility.
Microsoft Security, identity and access least-privilege guidance (read 6 November 2026): AI least privilege.
Microsoft Foundry, agent identity concepts and role-based access control (read 6 November 2026): Agent identity and Foundry RBAC.
Microsoft Copilot Studio, add tools to custom agents (read 6 November 2026): Add tools to agents.
Microsoft Copilot Studio, configure end-user authentication (read 6 November 2026): Authentication options.
Microsoft 365 Copilot, data protection, auditing and governance overview (read 6 November 2026): Copilot auditing and data protection; Microsoft Purview, audit activities for Copilot.

Microsoft audit coverage and identity features are product-specific and depend on configuration and licensing; these sources do not establish audit coverage for every third-party agent.

Limitations

Answers are not saved. Copy or print only what your organization's handling rules allow. Do not put secrets or personal data in this checklist. Verify current Microsoft documentation before making a platform or permission decision.

AI agent governance checklist