DevUp Icon

What should your AI agent be allowed to do?

Agree on its access, responsibilities and boundaries before they become something everyone has to guess.

This one-page template helps the people responsible for an agent write down what it should be able to do—and gives the team something to work from when that needs to change.

Download as Markdown

What's included

  • Ownership and the agent's purpose
  • Data it can read, including the permitted scope
  • Specific operations it can perform
  • Actions that require human approval
  • Platform and security requirements
  • Temporary exceptions, with an owner and expiry date
  • Where it can connect, and what data may leave
# Agreed target for one agent

What this AI agent is allowed to do, agreed by the people responsible for it and for the data it uses.

How to use this file:
- Keep it next to the agent's configuration, in the same repository.
- Fill it in with the people named under Ownership. Or give it to your AI assistant together with the agent's configuration (infrastructure code, app settings, role assignments, tool list) and ask it to draft what it can find, then review every line together.
- Be specific. "Read invoices from this customer environment" is more useful than "Read business data."
- Review it when the agent's purpose, tools or access changes.

Agent:
Date agreed:
Review by:

## 1. Ownership and purpose

- Purpose, in one sentence:
- Business sponsor (answers for why the agent exists):
- Technical owner (can change the agent's tools and access, and disable it):
- Authority: [ ] acts for a signed-in user, inside that user's permissions / [ ] runs unattended under its own identity
- Identity it presents (one per agent, no shared keys):

## 2. Data it can read

One line per data set: what it is, who owns it, and the permitted scope (environment, container, table, fields).

- Data: | Owner: | Scope:
- Data: | Owner: | Scope:
- Data: | Owner: | Scope:

Not in scope:

May send data to (named destinations only; everything else is blocked):

## 3. Operations it can perform

Everything not listed here is denied.

- Operation: | System and scope:
- Operation: | System and scope:
- Operation: | System and scope:

Denied, named so nobody has to guess:

## 4. Actions that require human approval

- Action: | Who approves, and how:
- Action: | Who approves, and how:
- Action: | Who approves, and how:

## 5. Platform and security requirements

The baseline every agent has to meet.

- [ ] One identity per agent. No shared keys, client secrets or connection strings; managed identity or agent identity wherever the target supports it.
- [ ] Role assignments at the narrowest scope that works. Nothing subscription-wide.
- [ ] Private access for sensitive services. No public endpoint without a reason recorded under exceptions.
- [ ] Outbound connections limited to the destinations named under 2. Nothing else is reachable from the runtime.
- [ ] Diagnostics and logging on for every resource it touches, so the chain of caller, agent, tool, operation and result can be reconstructed.
- Other requirements from the platform or security team:

## 6. Temporary exceptions

Every exception has an owner and an expiry date.

- Exception, and why it is accepted: | Owner: | Expires:
- Exception, and why it is accepted: | Owner: | Expires:

## Agreed by

- Business sponsor:
- Data owner(s):
- Builder:
- Platform or security:

Start with one agent

Fill it in with the people responsible for the agent and the data it uses. Be specific: "Read invoices from this customer environment" is more useful than "Read business data."

Keep the agreement alongside the agent's configuration. Review it when its purpose, tools or access changes.

Or let your AI assistant do the first draft. Give it the template together with the agent's configuration (infrastructure code, app settings, role assignments, tool list) and ask it to fill in what it can find. Then review every line with the owners. The gaps it leaves are the decisions nobody has made yet.

See a completed example

An example invoice-processing agent shows the level of detail to aim for.

Read the story behind it

Who Decides What the Agent Can Access?21 Oct 2026Every AI Agent Needs an Identity, and an Owner1 Oct 2026