# Agent Governance Audit-Evidence Checklist

Version 1.0 — 22 July 2026  
Vikram Jha — Defensible AI — https://vikramjha.work

Use this against one material historical agent action. A policy statement or verbal explanation is not evidence; link the record that proves what happened and why it was permitted.

| # | Control | Evidence required | Status | Owner | Due |
|---|---|---|---|---|---|
| 1 | System boundary | Approved inventory naming owner, purpose, action classes, tools, models and environments |  |  |  |
| 2 | Human authority | Grant record linked to agent and action class |  |  |  |
| 3 | Delegation chain | Trace from accountable principal through services to executing agent |  |  |  |
| 4 | Scope | Enforceable resource, value, rate, classification and jurisdiction limits |  |  |  |
| 5 | Expiry | Validity window and re-approval evidence |  |  |  |
| 6 | Policy decision | Policy identifier, version, inputs and allow/deny result |  |  |  |
| 7 | Enforcement | Test proving the action can be refused before effect |  |  |  |
| 8 | Source of truth | Authoritative lookup used for a material commitment |  |  |  |
| 9 | Action record | Immutable event with resource, timestamp, outcome and correlation ID |  |  |  |
| 10 | Inputs | Reconstructible material inputs, retrieval results and hashes |  |  |  |
| 11 | Versions | Model, prompt, tool and configuration identifiers |  |  |  |
| 12 | Human oversight | Presented context, reviewer, decision and timestamp |  |  |  |
| 13 | Validation | Independent results covering authority, tools, containment and impact |  |  |  |
| 14 | Change triggers | Revalidation matrix for model, prompt, tool, data and policy changes |  |  |  |
| 15 | Monitoring | Risk-linked metrics, thresholds, alerts and dispositions |  |  |  |
| 16 | Containment | Tested circuit breaker and kill path |  |  |  |
| 17 | Third parties | Audit rights, version notice, cease-use and tested exit evidence |  |  |  |
| 18 | Incident response | Runbook, ownership, evidence preservation and exercise result |  |  |  |
| 19 | Retention | Evidence-class schedule mapped to systems and legal holds |  |  |  |
| 20 | Reconstruction | Independent reviewer reproduces why the selected action was permitted |  |  |  |

## Closure rule

An item closes only when the linked evidence exists, is readable by the reviewer, covers the selected action and survives the required retention period. “Designed,” “planned,” “normally,” and “the team knows” are not closure evidence.