What it does

1. Register

One row per agent: its name, its owner, the practice it belongs to, where it is in its lifecycle, the class of data it may see, what it may do, how it starts and how many times it has run. The thing most organisations cannot produce — a list of their agents with a name against each one.

2. Classify

Each dataset already carries its class, set by its owner. An agent's class is the highest class among the datasets it was granted, and its permitted tools follow from that class. You declare what it touches; you never declare what it may do.

The step from class to permission is a versioned matrix: for each class and each tool's approval level, every action from reading to an irreversible change is allowed, held for a person or refused. With the starting matrix an agent holding restricted data may read and draft, needs a person for every change, and may send nothing outside. Publishing a new matrix recomputes every agent and records which ones changed.

in development Classification of what an agent produces: each output labelled at least as high as its inputs, raised when records are combined, never lowered without a named person, and carrying a record of the inputs that set its label. That label will decide where the output may go, including to another organisation under the ceiling written in a data-sharing agreement.

3. Govern the lifecycle

Seven stages, each with a gate. Two matter most: measures and a baseline recorded before the agent is built, and an approval by someone other than the builder. A change to the model, the tools or the rules returns the agent to the stage that checked them.

4. Run

Triggers on a clock, an event or a person, with limits on runs and spend, a sampling rate for review, an escalation route and a stop control. A schedule cannot start an agent the lifecycle has not released.

5. Review

A sample of ordinary work, everything a person rejected and everything the agent escalated, judged by a human. No automatic measure can tell you whether the work was right.

6. Report

The same measures on every agent, so a practice is the sum of its agents and the organisation is the sum of its practices — with heat maps, trends, and a maturity level computed from evidence rather than a questionnaire.