Template 05 of 8
Policy starter language: authorization, monitoring, retirement
Sample clauses to adapt. Replace bracketed text and review with counsel.
Authorization
- No AI agent may access [restricted] institutional data or take actions in a system of record without registration and approval at the tier assigned under [policy name].
- Each agent must have a named owner who is accountable for its behavior, scope, and retirement.
- Agents must operate under their own credentials with the least privilege needed. Shared or personal credentials are not permitted.
Monitoring
- Owners of agents at [T3] and above must log agent actions sufficient to reconstruct any decision or action.
- Agents at [T4] and above must have a documented human-review process and a tested means of immediate suspension.
- Owners of high-stakes agents must report equity impacts at least [each term].
Retirement
- Each agent must have written sunset criteria at approval.
- An agent that fails its criteria, loses its owner, or is not reviewed within [12 months] will be suspended pending review.
- On retirement, owners must notify users, revoke credentials, and dispose of data according to [retention schedule].