# Agent Registration / Agent Card

> Companion artifact 1 of 7 — *Agentic AI Governance: Standards and Guardrails*
> R2 Digital LLC · https://ravikrali.github.io/Agentic-AI-Governance/
>
> One page per agent. Written so a non-engineer can read it. This is the record the
> registry holds (AS-01) and the artifact a reviewer, auditor or incident responder
> reads first. Keep it in the agent's repository so it versions with the code.

---

## 1. Identity

| Field | Value |
|---|---|
| Agent name | |
| Agent ID (registry key) | |
| Workload / platform identity | *e.g. Entra Agent ID object ID, managed identity, service principal* |
| Version | |
| Environment(s) | dev / test / prod |
| Created | |
| Review due | |
| **Expiry date** | *required — the agent is disabled automatically on this date unless re-certified* |

## 2. Accountability

| Field | Value |
|---|---|
| **Accountable owner** (named person) | |
| Owner's role and business unit | |
| Delegate / deputy owner | |
| Engineering team | |
| Operations owner (holds the kill switch) | |
| Risk & compliance partner | |
| Data steward for the sources used | |

> If the accountable owner leaves or changes role, the registry raises an orphan alert and
> the agent is suspended until a new owner accepts it.

## 3. Purpose and scope

**What it does (2–3 sentences, plain language):**

**What it explicitly does not do:**

**Business process it supports:**

**Who it acts on behalf of:** *end user / named service account / itself*

**Stop conditions:** *what makes it halt and hand back to a human*

## 4. Autonomy and risk

| Field | Value |
|---|---|
| Autonomy tier | R0 / R1 / R2 / R3 / R4 |
| Highest action risk class in scope | A1 / A2 / A3 / A4 |
| Regulatory overlay | *EU AI Act high-risk? sector rules? none* |
| Provider or deployer role (EU AI Act) | |
| Data sensitivity (highest class touched) | public / internal / confidential / personal / special category |
| Affected-person impact | none / low / material / significant |
| Reversibility of worst-case action | fully reversible / compensable / irreversible |
| Blast radius | single record / single tenant / cross-tenant / enterprise |
| Date of last risk assessment | |

*See companion artifact 2 for the scoring worksheet.*

## 5. Capabilities

### Tools

| Tool | Read / Write | Risk class | Value or rate limit | Owner | Approval required |
|---|---|---|---|---|---|
| | | | | | |

### Data and knowledge sources

| Source | Classification | Access model | Steward |
|---|---|---|---|
| | | *user-delegated / agent-scoped* | |

### Memory

| Field | Value |
|---|---|
| Working memory scope | task / session |
| Durable memory used? | yes / no |
| Durable memory scope | user / tenant / global |
| Retention period | |
| Deletion path | *how a memory entry is corrected or removed* |

### Models

| Step | Model | Version pinned | Gateway route | Fallback |
|---|---|---|---|---|
| | | | | |

### Peers (A2A)

| Peer agent | Owner org | Trust basis | Scope propagated |
|---|---|---|---|
| | | | |

## 6. Controls in force

- [ ] Registered identity issued and bound (AS-01)
- [ ] Delegated user scope propagated on every call (AS-04)
- [ ] Short-lived, audience-restricted credentials only (AS-03)
- [ ] Deterministic hard limits configured: tool allow-list, parameter allow-list, value cap, tenant boundary, egress policy (AS-15)
- [ ] Step / token / spend / wall-clock budget bound at task start (AS-07)
- [ ] Writes idempotent with a documented compensating action (AS-06)
- [ ] Input and output screening enabled (AS-08)
- [ ] Evidence written before action, append-only (AS-11)
- [ ] Kill switch tested — date: ______ (AS-14)
- [ ] Human approval required above: *state the threshold*

## 7. Evaluation

| Field | Value |
|---|---|
| Golden set location | |
| Golden set size and composition | |
| Release thresholds (agreed with the business) | |
| Last eval run / result | |
| Adversarial / red-team date and outcome | |
| Production sampling rate | |
| Judge-model calibration date and human agreement rate | |
| Cost per successful task | |
| p95 latency | |

## 8. Operations

| Field | Value |
|---|---|
| Runbook link | |
| Dashboard link | |
| Alert routing | |
| Kill switch procedure | |
| Rollback procedure and last rehearsal | |
| Known limitations | |
| Open risks accepted (by whom, when) | |

## 9. Change history

| Date | Version | Change | Approved by |
|---|---|---|---|
| | | | |

## 10. Retirement plan

| Field | Value |
|---|---|
| Trigger for retirement | |
| Replacement (if any) | |
| Who is notified | |
| Permission revocation steps | |
| Evidence archive location and retention | |

---

*Adapt to your organization's risk appetite and regulatory position. The tier boundaries,
thresholds and periods in the source article are illustrative starting points, not standards.*