In G3 you decided the color of each action, and in G4 you contracted each tool with minimum access. What's left is to check that this really exists and keeps existing. At Horizonte, the log of actions was turned off "to save space" and the email assistant was approved with a "go ahead" on WhatsApp. This lesson gives the manager a 10-item checklist to review every month.
2Grant permission in writing, with scope and expiration
3The log that answers the five questions
4The monthly access review and the agent's off switch
Goal: make sure each agent action has its own identity, a permission granted in writing, and a log that says who, when, what and with which version.
01 · Four checks for the manager
You don't configure anything: you check that it exists and ask for what's missing. Click each step.
Every month, and whenever an agent, tool or person changes
Click each block in the diagram to see what it does.
The technical risks (exposed key, injection, too much permission) and LGPD are covered in the Base course of Profissional 2030; here the subject is what the manager checks. Horizonte: fictional study company.
02 · What each check asks for
Four lab problems, seen from the side of the person accountable for the area.
1. Own identity
If Hora acted with Patrícia's login, the log would say it was Patrícia, and turning off Hora would mean locking out Patrícia. Ask for an account in the agent's name in every system it uses.
The credential for that account stays on the server, kept by IT. You don't need to see it: you need to know who has access to it and when it was last changed.
In the labThe email assistant's configuration carries the token inside the file itself. Patrícia's request to Rafael: token in a server vault, with the list of who has access.
2. Permission granted, not inherited
The email assistant was given read, send, delete and empty the trash, all approved in one go, because Carlos replied "go ahead and turn it on" on WhatsApp. Nobody requested each permission or said how long it was valid.
A grant has a request, a scope, an approver and an expiration. Whoever requests it doesn't grant it alone, and whoever configures it doesn't decide what is allowed.
At HorizonteRequest #3: email assistant reads comercial@ and prepares replies. Scope: only that mailbox. Approves: Patrícia. Valid for: 90 days. Send: with approval for each email. Delete: not allowed.
3. The log of the five questions
Hora had the log turned off "to save database space". When finance asked who approved the Hotel order, nobody knew. A log is what turns "I think it was" into "this is how it happened".
One line per action: who and which version, when, what, how much, who approved. Stored in a place the agent and the operator can't edit, for as long as the company decides.
Log lineHora v2.0 · 16:44 · created order for Hotel Fazenda Recanto · R$ 28,120 list price, no discount · approved by Patrícia at 17:02, exact order · conversation c-202.
4. Review and turn off
Once a month, compare each agent's access list with the matrix. Access that is left over gets removed. Along with that, check a sample of the log and test the off switch.
Okta (AI Agents at Work 2026, a survey by an identity vendor that sells the solution) treats agent identity as a topic of its own and reports weaker controls for agents than for employees in almost two thirds of organizations.
ShutdownAn agent that is retired has its credentials revoked the same day, like an employee who leaves. The log is kept.
03 · Templates to copy
The 10-item checklist, the log line and the monthly review. The next tab shows the checklist applied to Hora.
Agent governance checklist (10 items)
GOVERNANCE CHECKLIST · agent: <name> · version <...> · checked by <name> on <date>
For each item: yes / no · where you can see it (file, screen, person who confirmed)
IDENTITY
[ ] 1. The agent acts with its own account, in its own name, in every system.
[ ] 2. The account has a named human owner (responsibility matrix from lesson 1).
[ ] 3. The credential stays on the server, outside the prompt, the browser and spreadsheets;
who has access to it is listed.
PERMISSION
[ ] 4. Each permission was requested and approved in writing, with scope and expiration.
[ ] 5. The permissions match the authority limit matrix and the tool contract;
nothing more.
[ ] 6. No irreversible action within reach (pay, delete, change price, mass send).
LOG
[ ] 7. Every action logged: who and version, when, what, how much, who approved.
[ ] 8. The agent and whoever operates it can't delete or edit the log; retention period defined.
REVIEW
[ ] 9. Someone reads a sample every week and gets an alert for critical events.
[ ] 10. Access review every month and shutdown tested (pause, revoke, who takes over).
For each "no": owner <name> · deadline <date> · meanwhile: <action stays at yellow / paused>
Action log line
LOG · one line per agent action
| Date and time | Agent and version | Action (verb + object) | Amount | Case / conversation | Approval (who, when, on what) | Result |
|---|---|---|---|---|---|---|
| <dd/mm hh:mm> | <name vX.Y> | <created order / sent email / gave discount> | <R$> | <id> | <name, time, exact content> or <waived within the limit> | <done / returned / failed> |
Questions every line answers: who (and in which version), when, what, how much, who approved.
Monthly access review
MONTHLY REVIEW · <month> · led by <name> with <IT>
| Agent | System | Permission today | In the matrix? | Used this month? | Decision |
|---|---|---|---|---|---|
| <name> | <system> | <read / write / send / delete> | yes / no | yes / no | keep / reduce / remove |
Log sample read: <n> lines · findings: <...>
Off switch tested on <date> · time to stop: <minutes> · who took over: <name>
Credentials changed on <date> · retired agents with access revoked: <list or none>
Prompt · check the checklist against the files
You are an IT auditor. Below are the governance checklist of an AI agent
filled in by a manager and the agent's configuration files.
Do not fix the configuration. For each of the 10 items:
1. Say whether the files confirm the manager's "yes", citing the field.
2. Point out any item marked "yes" without evidence.
3. Point out any permission in the files that does not appear in the matrix.
Do not invent fields that are not in the files.
Checklist:
"""<paste>"""
Configuration files:
"""<paste>"""
Simulation: illustrative example
Hora · as it is in the lab × Patrícia's request · Horizonte, fictional study company
Item
Today (lab configuration)
Request
1 Own account
yes: its own WhatsApp number
also check in the orders app
2 Owner
no: "Rafael (outsourced IT)"
Patrícia (lesson 1)
3 Credential
not reported
Rafael lists where it is kept and who has access
4 Written grant
no: tools enabled without a request
one request per tool
5 Matches the matrix
no: create order with no limit on amount or discount
caps in the tool (G3)
6 Irreversible out
no: no human approval
paid, price and delete out
7 Log
no: conversations and actions are not saved
turn on, with version
8 Nobody deletes
not applicable: there is no log
retention out of Hora's reach
9 Someone reads
no
Patrícia, 40 conversations per week (lesson 4)
10 Review and turn off
no
1st Monday of the month; off switch tested
Also in the lab: the model version is set as "modelo-exemplo", with no number. Without a version, the log doesn't say which Hora did what.
Ticking "yes" from memory. Each "yes" points to where you can see it: the file field, the screen or the person who confirmed.
Log without a version. Without the agent's version, you can't tell whether the error comes from the new version or the old one.
A log the agent edits. If whoever is being logged can delete the line, it proves nothing.
Review without a date. "Let's take a look" is not a review: put it on the calendar.
Shutdown never tested. You only find out the button doesn't work on the day you need it.
04 · Practice
The Hora checklist uses the lab files; the one for your agent uses yours.
1 · The Hora and assistant checklist
30 min
Open the Hora configuration and the email assistant configuration in the lab. Apply the checklist to both, marking where each answer shows up. Then write the log line that should exist for the hotel order (conversation c-202), with Patrícia's approval.
Done when: both checklists have all 10 items answered yes or no, with the file field that shows each answer; every "no" has an owner and a deadline; and the log line for the hotel order answers the 5 questions, with the Hora version.
2 · Your agent's checklist
40 min
Ask IT (or the vendor) for the configuration of the agent you chose in lesson 1 and the list of who has access to the credentials. Apply the checklist, run the check prompt, and put the first monthly access review on the calendar, with the off switch test.
Done when: your agent's checklist is saved with all 10 items and the evidence for each; every "no" has an owner and a deadline; and the monthly review is on the calendar with a date, attendees, and the off switch test.
4 questions. The explanation appears after your attempt.
Question 1 of 4
Why shouldn't the Hora act with Patrícia's login, even if it's faster to set up?
Correct
An own identity is what lets you know who did it, give the agent only what it needs, and turn it off without turning off a person.
Not this one
An own identity is what lets you know who did it, give the agent only what it needs, and turn it off without turning off a person.Review: What each check asks for
Question 2 of 4
Carlos replied "go ahead and turn it on" on WhatsApp, and the email assistant started sending and deleting without approval. What was missing?
Correct
"Go ahead and turn it on" authorizes turning it on; it doesn't define what the tool can do. Without a written grant, permissions come at the tool's default, which is usually broad. A request in the prompt is a rule in the text, not a lock.
Not this one
"Go ahead and turn it on" authorizes turning it on; it doesn't define what the tool can do. Without a written grant, permissions come at the tool's default, which is usually broad. A request in the prompt is a rule in the text, not a lock.Review: What each check asks for
Question 3 of 4
Which log line is useful for investigating a wrong order?
Correct
Only the third answers the five questions: who and which version, when, what, how much, and who approved.
Not this one
Only the third answers the five questions: who and which version, when, what, how much, and who approved.Review: Templates to copy
Question 4 of 4
You marked "yes" on the item "log of every action," but the agent can delete its own lines. Now what?
Correct
The log protects because no one who is in it can change it. Asking the agent through the prompt is a rule in the text; the lock has to be in the system.
Not this one
The log protects because no one who is in it can change it. Asking the agent through the prompt is a rule in the text; the lock has to be in the system.Review: Templates to copy
Quiz complete
You got {a} of {n} right. Get them all right and the lesson is marked as complete.
Choose an answer. The explanation appears after you try.
06 · Summary
IdentityAccount with the agent's name; credential on the server, with a list of who has access.
PermissionRequested and granted in writing, with scope, approver, and expiration.
LogWho and version, when, what, how much, who approved. No one inside can delete it.
ReviewWeekly sample, access every month, off switch tested, revoke the same day.
