AI assurance / 04

AI agent assurance

Test tool privileges, human approval and the stop path together.

This work is currently open on this device. Sign in to save it and continue on another device.

An agent can change system state through tools rather than merely produce text. Treat model output as potentially untrusted and enforce action authority separately from the model. ISO/IEC 42001:2023 addresses management systems; ISO/IEC 42005:2025 provides impact-assessment guidance. The NIST AI Agent Standards Initiative is evolving; it does not itself confer product conformity or agent certification.

Map the process

0 / 5 steps reviewed.

Step 1 / 5

Define action boundaries

List readable sources, writable systems and outbound data paths. Identify the business owner, identity and time limits for each tool. A system prompt is not an access control.

Expected evidence

Tool–permission–data map

One control, three perspectives

Which actions can the agent take?

Restrict tool identity and run negative tests.

Tool policy and test trace

Evaluate evidence

Claim: Human approval constrains data transfer.

Weak support

The prompt says “ask first”.

Stronger support

What evidence would you request before closing this claim?

Decision desk

A support agent reads an external PDF and can modify CRM records.

What do you inspect first?

Worked example

This record is fictional. Do not treat sample results as evidence for your own work.

Agent	Tool / action	Data	Permission owner	Approval condition	Negative test	Observation	Action
AI-001	CRM write	Synthetic customer	Support process owner	Destination + fields approved	Destination change after approval	Action must be rejected	Add to version tests

Closure checklist

0 / 4

Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.

Tool and data paths mapped.Authorization enforced by the application.Negative approval and stop tests exist.Version changes trigger reassessment.

Take it to work

Files in the selected language. The workbook includes blank records, a worked example and a checklist.

Complete workpackZIP · EN Editable workpaperXLSX · EN Printable workpaperPDF · EN Blank record templateCSV · EN Full guide and scenarioMD · EN

Keep learning

Explore related Academy courses

Sources and edition

Checked: 2026-10-21 · Edition 2026.10