taskfloGUIDE / SECURITY & RISK
The AI Agent Approval Playbook
What your security review should ask before any AI agent reaches production.
14 pages · PDF · Updated October 2026
01 / WHY IT EXISTS
Give the review an answer.
Security questionnaires were written for software that stores data. Agents are software that acts. This playbook gives your review a consistent, evidence-based way to reach a yes or a no.
What’s inside
- The three questions: where data goes, who can act and what you can prove, broken into 24 checks.
- 12 more checks for compliance, governance and reliability.
- What a good answer looks like, and the red flags that should stop a review.
- A 72-point scorecard with 23 gates.
- A 30-day review process that ends in a signed decision.
02 / READ AN EXCERPT
How the scorecard decides.
| Result | Rule | Decision |
|---|---|---|
| Ready | Every Must scores 2; total 58+ | Approve for production agents handling sensitive data. |
| Conditional | No Must scores 0; total 43+ | Pilot on non-sensitive data with dated remediation. |
| Not ready | Any Must scores 0, or total below 43 | Do not approve. Re-review when gaps close. |
03 / WRITTEN FOR
CSOs and CISOsRisk and compliance leadersSecurity and enterprise architectsProcurement
Get the playbook.
Receive the PDF immediately after a successful request, plus a link by email. No newsletter.
Not legal advice. Confirm your obligations with qualified advisers.
ONE WORKFLOW. A CLEAR NEXT STEP.
Bring us the workflow your review rejected.
Tell us about the process, the systems and the people. Let’s work through what it would take to run it.