# AI agent policy template

A free template from MINERVA Studio (https://minerva.studio/templates), version 1, 26 October 2026.
Fill one copy per AI agent. Delete the guidance lines in italics once filled. A plain-language
template, not legal advice; your institution's own model risk policy governs.

Guide: https://minerva.studio/agentic-ai-governance · Policy as code: https://minerva.studio/policy-as-code

---

## 1. The agent

| Field | Value |
|---|---|
| Agent name and id | |
| Purpose (one sentence) | |
| Business owner | |
| Developer (builds and changes the agent) | |
| Policy approver (must not be the developer) | |
| Kill-switch holder (can suspend the agent at once) | |
| Models it uses (and their inventory ids) | |
| Suppliers it depends on (B-10 arrangements) | |
| Identity (directory or service identity the agent runs as; never a person's login) | |
| Risk rating (your E-23 rating scale) | |
| Policy version and date decided | |

## 2. What the agent may do (deny by default)

*Anything not permitted below is refused. List each tool the agent may call and the data it may touch.*

| Effect | Tools (actions) | Data (resources) | Notes |
|---|---|---|---|
| permit | | | |
| permit | | | |
| forbid | | | *e.g. all web access, all external email* |

## 3. Calls that wait for a person

*High-risk calls (payments, customer decisions, record changes) are held until a named role releases them. The developer may never release a held call.*

| Tools (actions) | Released by (role) | How long a held call may wait before escalation |
|---|---|---|
| | | |

## 4. Limits

| Tool or scope | Limit (per call, per session, per day) |
|---|---|
| | |

## 5. Monitoring and escalation

| Event | Escalated to | Within |
|---|---|---|
| Drift from the approved policy | Kill-switch holder, owner | |
| Repeated refusals | Owner, model risk | |
| Held call waiting too long | Releasing role, owner | |
| Supplier incident | Owner, third-party risk | |

## 6. Suspension (kill switch)

- Who may suspend: 
- How the suspension is recorded: 
- Who may lift it, and on what evidence: 

## 7. Records kept

*Every decision on every call (permitted, refused, held, released and by whom), every policy change and who decided it, kept for: ______*

## 8. Approval

| Role | Name | Date |
|---|---|---|
| Developer (proposes) | | |
| Approver (decides; not the developer) | | |
| Model risk (second line) | | |

---

## Appendix: the same policy as code (illustrative)

```json
{
  "agent": "mortgage-assistant",
  "statements": [
    { "effect": "permit",   "actions": ["documents.read"],    "resources": ["mortgage-files/*"] },
    { "effect": "permit",   "actions": ["payments.transfer"], "resources": ["accounts/*"] },
    { "effect": "hold",     "actions": ["payments.transfer"], "approvers": ["credit_officer"] },
    { "effect": "forbid",   "actions": ["web.*"] },
    { "effect": "limit",    "actions": ["payments.transfer"], "max_per_session": 20000 },
    { "effect": "escalate", "on": "drift", "to": ["kill_switch", "owner"] }
  ]
}
```

MINERVA Studio keeps this policy as code, checks it before every tool call through your gateway or
runtime, holds high-risk calls for a person and records every decision: https://minerva.studio/contact