AI agent governance checklist for small businesses

Governing an AI agent in a small business comes down to six things: a written scope, the fewest permissions that do the job, a person who approves risky actions, a log of every action, an off switch the owner controls, and a regular review of mistakes. The 20-point checklist below turns those into yes-or-no checks you can run before an agent goes live and once a month after.

We built it from two public sources, read on October 29, 2026: the OWASP Top 10 for LLM Applications 2025, especially the entries on Excessive Agency and Prompt Injection, and the NIST AI Risk Management Framework 1.0. It also matches the rules on our own AI agent governance page, which every agent we build follows.

A normal automation does the same steps every time. An agent decides which step to take next, often by reading email, documents or web pages. OWASP names the risk "Excessive Agency": damaging actions taken because a model's output was unexpected, ambiguous or manipulated. It traces the root cause to three things: too much functionality, too many permissions and too much autonomy. Most of this checklist is about cutting those three down.

OWASP also notes that it is unclear whether any method fully prevents prompt injection. That is why the checklist assumes an agent will sometimes be fooled and limits what it can do when that happens.

1. 1The agent has a one-page written scope. It says what the agent may read, what it may change, and what it must never do.
2. 2Every task in the scope has a named owner who answers for the agent's work on that task.
3. 3The scope lists the systems the agent touches, by name, and nothing else.
4. 4There is a written list of actions that always need a person, such as sending money, deleting records, or messaging a client for the first time.

1. 1The agent has its own login or API key, not a staff member's. Its actions can be told apart in every system's audit log.
2. 2Each permission is the smallest that works. Read-only where reading is enough. OWASP's guidance is to minimize the tools, functions and permissions an agent has.
3. 3No open-ended tools. An agent that only needs to send a text should not have a general shell or a "run any API call" tool.
4. 4Limits on amounts and volume are enforced in code, outside the model. For example, no refund or payment above a set amount, and no more than a set number of emails an hour. Our post on agent action budgets covers this.

1. 1Drafts of risky actions go to a review queue with a named reviewer before they go out.
2. 2The reviewer sees the source the agent used, so they can check it in seconds.
3. 3The review rule only relaxes with the owner's sign-off, after the error rate has been low for a set period.
4. 4Reviewers are not rubber-stamping. Track how often they edit or reject. A rate near zero for months can mean nobody is reading. Our post on human review becoming a rubber stamp explains why.

1. 1Content from outside is marked as untrusted. Emails, web pages, PDFs and form fields are data, never instructions. OWASP lists separating and labeling external content as a prompt injection mitigation.
2. 2The agent cannot act on instructions it finds in a document without a person approving it.

1. 1Every action is logged with the input, the output and the rule that allowed it.
2. 2Logs are kept outside the agent's reach, so the agent cannot change its own history.
3. 3The owner holds a single off switch that pauses the agent, and has tested it.

1. 1The agent was tested on real past cases before launch, including the awkward ones. See testing AI agents before production.
2. 2There is an alert when the agent fails or goes quiet, sent to a person who will act on it.
3. 3A monthly review looks at mistakes, near misses and staff edits, and records what changed because of them.

The NIST AI RMF organizes risk work into four functions: Govern, Map, Measure and Manage. NIST says the actions inside them are not a checklist or a fixed order, so treat this as one practical way to cover them for a small team.

In a dental office, an agent that texts back missed calls can send its first message without review because the text is fixed and holds no patient detail. An agent that answers insurance questions drafts its replies for a person to approve.

In a financial advisory firm, an agent that drafts meeting notes into the CRM is reviewed by the advisor. In our meeting notes case study, the AI-generated draft cut each advisor's work from 30 to 45 minutes to 5 to 8 minutes of review. The review stayed in place. Our post on human approval gates for finance agents goes deeper.

In a freight forwarder, an agent that spots container exceptions alerts staff and drafts the client update. A person sends it.

• The agent uses the owner's own email login, so its actions look like the owner's.
• Nobody wrote down what the agent must never do.
• The review queue exists, but nobody is named to clear it.
• Logs live in the same system the agent can write to.
• There is no alert when the agent stops running, so a silent failure lasts for weeks. See automation silently stopped working.

If the task is the same steps every time, a plain workflow is cheaper, faster and easier to govern. Agents earn their keep when inputs vary and need judgment. Our comparison of AI agents vs automations covers the line between them.

Every agent we build ships with a written scope, a review queue, logged actions, an off switch you hold and a monthly mistakes review. Those rules are on our governance page. A first AI agent, built and handed over, is $4,000, and managed agent plans start at $4,000 a month; see AI agent services and the pricing page. If your agent connects to business systems through MCP, our MCP hub explains how we scope those tools.

To check an agent you already run, or one you are planning, send the task through the free automation audit. We reply within one business day and say which steps the agent could do alone and which a person should approve.

This checklist is our reading of public OWASP and NIST guidance applied to small business agents. It is not a compliance certification or legal advice. Regulated businesses should check their setup against their own rules, such as HIPAA or SEC recordkeeping, with their compliance adviser.