Use your browser's Print function to save as PDF — File → Print → Save as PDF.

← Back to post

Northlight Advisory Services

bynorthlight.ca

AI Agent Deployment Go/No-Go

Complete before giving any agent autonomous access

Section 1 Identity & Permissions

Agent has its own identity, separate from any human developer
Agent permissions are explicitly defined and documented
Agent is operating at the appropriate autonomy level (1–4) for the task
High-stakes actions require explicit human approval before execution

Section 2 Boundaries & Containment

Network access is restricted — agent cannot reach untrusted external domains
Agent cannot write directly to protected branches or production systems
Agent has been told its boundaries explicitly (not just blocked silently)
A "controlled failure" path exists — blocked actions are logged and surfaced, not just dropped

Section 3 Auditability

Every agent action is logged with full attribution
Compliance team can audit agent actions with the same rigour as human actions
Security team has been briefed and signed off
An incident response plan exists if the agent behaves unexpectedly

Section 4 Readiness

Agent has been given structured context upfront — not starting cold
A pilot has been run with a low-risk use case first
Success metrics are defined before deployment, not after