Agent identity, ownership and organisation
Agentic governance starts with a stable identity. An agent name or job title is not an identity and does not grant authority. The Agent Register, Identity & Ownership and Organisation Chart establish who or what the agent is, who is accountable and where escalation goes.
Agent Register
Section titled “Agent Register”Create one record for each independently governed agent boundary. Record purpose, owner, operating status, runtime, model, environment, data access, tools, autonomy, criticality and review dates. Separate agents when they have materially different authority, owners, runtime identities or failure consequences.
An active register entry is necessary but not sufficient for execution. Tool Permissions, a ready connection, an active Runtime Access Policy and any required approval must also pass.
Identity & Ownership
Section titled “Identity & Ownership”Bind the governance record to the runtime identity used in authenticated requests. Record the business owner, technical owner and accountable executive or service owner as appropriate. Owners remain responsible for purpose, risk, access review, incidents and retirement; the agent cannot own its own risk acceptance.
Rotate or revoke runtime identity material through the approved service workflow. Never place raw credentials, service secrets or private keys in the Agent Register.
Organisation Chart
Section titled “Organisation Chart”The chart explains reporting, delegation and escalation. It can help determine who must be consulted or approve a high-impact action, but position in the chart does not create runtime permission. Gateway evaluates exact policy and request context.
Lifecycle controls
Section titled “Lifecycle controls”- Register the agent and owners.
- Complete risk tiering and ATF assessment.
- Configure least-privilege tools and governed connections.
- Validate simulations and approval paths.
- Activate only the authority required for the intended environment.
- Review after change, incident, expiry or owner transfer.
- Suspend identity and runtime authority before retirement.
Review checklist
Section titled “Review checklist”- Unique agent boundary and runtime identity.
- Named, current human owners.
- Purpose and prohibited purposes defined.
- Environment and data boundaries recorded.
- Escalation path is usable but not treated as permission.
- Dormant, duplicate and retired identities are disabled.