AI-agent audit-readiness self-assessment

Answer twenty questions. No / unknown scores 0, partly documented scores 1, and documented and tested scores 2. Score = points ÷ 40 × 100. Every question has equal weight. This planning aid is not a certification or a legal compliance determination.

1. Is an accountable owner named for every agent?2. Is the intended use documented?3. Are prohibited actions explicitly defined?4. Are high-impact actions gated by human approval?5. Are agent permissions limited to the required scope?6. Are credentials held outside prompts and logs?7. Are inputs classified for sensitivity?8. Are retention and deletion rules documented?9. Are data sources and their permissions recorded?10. Are model and prompt versions recorded?11. Are actions logged with timestamps and request IDs?12. Can logs be checked for tampering?13. Can a decision be traced to its input and rule?14. Are failures and exceptions captured?15. Are human overrides recorded?16. Are evaluations run before releases?17. Are drift and incident signals monitored?18. Is a tested rollback or stop procedure available?19. Is incident response ownership documented?20. Can you export a representative evidence bundle?

AI-agent audit-readiness self-assessment

Your evidence readiness