Governance, Audit Trails, and Compliance
What organizations need around agents: audit logs, accountability, data retention, regulatory considerations, and documentation that holds up.
Six months after you launch, someone asks a question you can't answer. A customer's lawyer wants to know why the agent denied a refund on March 3rd. An auditor asks who approved giving the agent access to the billing system. A new manager asks which agents the team runs, who owns each one, and how anyone knows they still work. "Let me check the logs" turns into "we kept traces for 14 days" and "the person who set that up left."
Governance is the set of records, roles, and routines that let an organization answer those questions with evidence. Most of it is engineering you'd want anyway: an audit trail you can trust, a named owner for every agent, a deliberate retention policy, and documentation that matches reality. This lesson shows you how to build each one and what regulators and standards are asking for in general terms.
The questions governance must answer
Start from the questions, not the regulations. Almost every governance requirement, internal or external, reduces to some version of these:
| Question | The evidence that answers it |
|---|---|
| What did the agent do, when, and for whom? | An audit trail of actions with timestamps and identities |
| Who approved that action, or was it automatic? | Approval records tied to a named person or a written policy |
| Which version of the agent was running? | An agent version on every record, tied to code in version control |
| Who is responsible for this agent? | An inventory with a named owner per agent |
| How do you know it works, and is safe? | Eval results, red-team findings, and monitoring over time |
| What data does it touch, and how long do you keep it? | A data map and a retention policy that's actually enforced |
| What happens when it goes wrong? | An incident process and a record of past incidents |
If you've worked through this course, you already have pieces of this: eval suites in CI, red-team findings, approval gates, and an autonomy policy. Governance mostly means keeping these as durable records and making sure someone owns them.