This isn't a technical checklist. There are plenty of those — model selection, API configuration, testing environments. Those matter, but they're not what determines whether your first agentic deployment goes well.
What determines it is whether the governance was in place before the first real transaction ran. These five questions are the ones that expose the gap — and they need executive-level answers, not engineering answers.
The five questions
- What is this agent authorised to do — exactly? Not in broad terms. Specifically: what actions can it take, on what conditions, up to what value or volume, and in what timeframe? If the answer is vague, the permission is vague — and the risk is real.
- What triggers an escalation to a human? Every agentic process needs a clear, tested escalation path. Who gets the handoff? In what format? Within what timeframe? If escalation is too slow or too unclear, the agent either stalls or proceeds when it shouldn't.
- What does the audit trail look like — and who reads it? Every agent action should be logged, timestamped, and attributable. But logging is pointless if nobody reviews it. Who is responsible for reading the trail, and how often?
- What happens if the agent makes an error? Not a theoretical error — a real one. What's the rollback procedure? Who has authority to halt the process? How does the affected party (customer, supplier, regulator) get notified?
- Who owns this agent after it goes live? Pilots have project owners. Production systems need operating owners — someone accountable for performance, compliance, and ongoing adjustment as conditions change. If that's not named before launch, it defaults to nobody.
"If you can't answer all five before launch, you're not ready. That's not a criticism — it's the checklist doing its job."
What to do if you can't answer them
Stop. Not permanently — but until the answers exist. The right response to an unanswered governance question isn't to proceed cautiously. It's to get the answer before you proceed at all.
In practice, most organisations find that two or three of these questions are easy to answer (the technical team has thought about escalation and logging) and one or two are genuinely unresolved (nobody has named the operating owner, or the error response is vague). Those are the ones that matter — and they're the ones the Chief Agentic Officer role exists to resolve before the agent runs.