# Agreed target for one agent

What this AI agent is allowed to do, agreed by the people responsible for it and for the data it uses.

How to use this file:
- Keep it next to the agent's configuration, in the same repository.
- Fill it in with the people named under Ownership. Or give it to your AI assistant together with the agent's configuration (infrastructure code, app settings, role assignments, tool list) and ask it to draft what it can find, then review every line together.
- Be specific. "Read invoices from this customer environment" is more useful than "Read business data."
- Review it when the agent's purpose, tools or access changes.

Agent:
Date agreed:
Review by:

## 1. Ownership and purpose

- Purpose, in one sentence:
- Business sponsor (answers for why the agent exists):
- Technical owner (can change the agent's tools and access, and disable it):
- Authority: [ ] acts for a signed-in user, inside that user's permissions / [ ] runs unattended under its own identity
- Identity it presents (one per agent, no shared keys):

## 2. Data it can read

One line per data set: what it is, who owns it, and the permitted scope (environment, container, table, fields).

- Data: | Owner: | Scope:
- Data: | Owner: | Scope:
- Data: | Owner: | Scope:

Not in scope:

May send data to (named destinations only; everything else is blocked):

## 3. Operations it can perform

Everything not listed here is denied.

- Operation: | System and scope:
- Operation: | System and scope:
- Operation: | System and scope:

Denied, named so nobody has to guess:

## 4. Actions that require human approval

- Action: | Who approves, and how:
- Action: | Who approves, and how:
- Action: | Who approves, and how:

## 5. Platform and security requirements

The baseline every agent has to meet.

- [ ] One identity per agent. No shared keys, client secrets or connection strings; managed identity or agent identity wherever the target supports it.
- [ ] Role assignments at the narrowest scope that works. Nothing subscription-wide.
- [ ] Private access for sensitive services. No public endpoint without a reason recorded under exceptions.
- [ ] Outbound connections limited to the destinations named under 2. Nothing else is reachable from the runtime.
- [ ] Diagnostics and logging on for every resource it touches, so the chain of caller, agent, tool, operation and result can be reconstructed.
- Other requirements from the platform or security team:

## 6. Temporary exceptions

Every exception has an owner and an expiry date.

- Exception, and why it is accepted: | Owner: | Expires:
- Exception, and why it is accepted: | Owner: | Expires:

## Agreed by

- Business sponsor:
- Data owner(s):
- Builder:
- Platform or security: