AI agent governance is now a sales asset: the buyer’s 12-question checklist.
In 2026, governance stopped being a compliance chore and became a reason to buy. With the FTC looking at agents and always-on agents arriving in every app, the vendors who can answer hard questions are the ones getting signed.
- Twelve questions cover access, approvals, logs, data and accountability.
- Good answers are specific, written and testable.
- Vague answers are a warning, however good the demo.
The 12 questions
| # | Ask | A good answer sounds like |
|---|---|---|
| 1 | What can the agent access? | A written list of systems and permissions |
| 2 | What can it change? | Read-only by default, named write actions |
| 3 | What needs human approval? | Money, customer messages, regulated steps |
| 4 | Can we see every action? | Yes, a log with inputs, outputs and approver |
| 5 | How is accuracy measured? | A test set from our cases, scored weekly |
| 6 | What happens when it drifts? | Alerts, then a fix within an agreed time |
| 7 | Where is our data stored? | In our environment or a named region |
| 8 | Is our data used for training? | No, in writing |
| 9 | Can we delete everything? | Yes, with a deletion record |
| 10 | Who can pause it? | Named owners, one step |
| 11 | Who owns the build? | We do: code, prompts and evaluations |
| 12 | Who is accountable for results? | The vendor, against a written target |
If a vendor can’t answer the twelve questions, the demo doesn’t matter.Intelligent AI World
Red flags
How to run the checklist in a vendor call
| Answer quality | What you hear | What it means |
|---|---|---|
| Strong | Specific, written, shows a screen | They’ve built this before |
| Weak | “It’s secure”, “the model handles it” | Governance is an afterthought |
| Red flag | “We can’t share that” | You will not be able to defend it either |
Frequently asked questions
Why does governance matter for buying AI?
Because agents now act, not just answer. Buyers need to know what an agent can do, who approves it, and how to prove what happened.
What is the most important question?
Who is accountable when the agent is wrong, and what happens next.
Does IAW answer all twelve?
Yes. Every build ships with scoped access, approvals, logs, weekly evaluation and a named owner.
Should governance slow down AI adoption?
No. Clear limits make approval faster, because legal, security and leadership can say yes with confidence.
What logs should an AI agent keep?
Inputs, outputs, the tools it used, the action it took, who approved it and when.
Every IAW agent answers all twelve in writing. Start on the start page, or see IAW vs ChatGPT, Claude, Cowork, Manus, Kimi and Genspark.
Sources: SecurityWeek; Mean CEO, AI trends October 2026.