AI Agent Policy: Autonomy, Memory and Permissions

How to use this document

• What it is for. This is a base policy for governing AI agents: systems that do more than generate text and take actions (send emails, query or change systems, make purchases, answer customers, chain tools together) with some degree of autonomy. It sets autonomy levels, permissions, memory, human checkpoints, activity logging and an emergency stop.
• Who should own it. The AI lead, with approval from the AI committee, with information security and IT as technical owners and with input from the data protection officer (or the country's equivalent role), legal and the owners of the systems that use agents. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Before adopting it, decide the level (basic, standard or reinforced) and the modules you keep ("Module selection"), the maximum autonomy level the organization will allow (section 5), which actions are always reserved for a person (section 6.3), who approves each agent (section 4), how long logs and memory are kept (sections 8 and 9) and who may trigger the emergency stop (section 11).
• Fields to complete. Replace the bracketed text, such as [ORGANIZATION NAME], [AI COMMITTEE], [AI GOVERNANCE EMAIL], [REVIEW FREQUENCY] and [COMPLETE]. Keep clauses marked [OPTIONAL] only if they apply, and delete the marker when you keep them.
• Country variants. This document has no country variants. The "Related regulatory references" section shows the linked laws and guidance, including the Spanish data protection authority (AEPD) guidance on agentic AI, which has been used as a good-practice reference also outside Spain.
• Related documents. This policy keeps no inventory of its own: agents are recorded in the "AI System Inventory." It uses the organization's single risk scale and relies on the documents in aid H. If you do not have them, adapt the cross-references.
• Review. Have your legal counsel and your data protection lead review the adapted version, especially the legal basis for the processing that agents carry out, vendor contracts and any case where an agent may make decisions that affect people.
• Approval and publication. Have the appropriate body approve it, record the approval in "Version history" and communicate it to everyone who designs, configures, approves or uses agents.

Module selection

Profile or level	What to keep
P5: agents that act in systems (core of this policy)	The whole unmarked document
P3: the model behind the agent is hosted on own or rented infrastructure, including open-weight models	Section 13.3
Basic level	Core and content marked [BASIC LEVEL]; delete content marked [REINFORCED LEVEL]
Standard level	Core; delete content marked [BASIC LEVEL] and [REINFORCED LEVEL]
Reinforced level (required if any agent is High risk or at autonomy level 3 or 4)	Core and content marked [REINFORCED LEVEL]

Delete the sections, rows and paragraphs that do not apply, together with their markers.

AI Agent Policy: Autonomy, Memory and Permissions

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Policy owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose

[ORGANIZATION NAME] adopts this policy so that the AI agents it uses or builds act within known limits, with the minimum permissions needed, under human oversight proportionate to the risk, and leaving enough of a trail to reconstruct what they did and why.

An agent can produce real effects without a person reviewing each step. This policy therefore rests on three rules: an agent may not do anything it has not been expressly allowed to do; every relevant action must be attributable, explainable and reversible or containable; and there is always an accountable person and a way to stop it.

2. Scope

2.1. This policy applies to every AI agent that operates on behalf of [ORGANIZATION NAME] or with its systems, data or credentials, regardless of whether:

• the organization builds it, configures it on a third-party platform or receives it as a feature of a purchased product;
• it acts internally (internal systems, staff) or externally (customers, suppliers, government bodies, websites);
• it runs continuously, on a schedule or at a person's request.

2.2. It applies to all staff, contractors and vendors who design, configure, approve, operate or oversee agents.

2.3. It does not cover assistants that only generate text or suggestions that a person copies and uses on their own, without access to tools or the ability to act. Those uses are governed by the "Responsible AI Use Policy (Including Generative AI)." Coding assistants with an agent mode (able to run commands, change repositories or deploy) are covered and are also governed by the "AI Coding Assistant Policy."