taskfloGuide / Security & risk
The AI Agent Approval Playbook
What your security review should ask before any AI agent reaches production.
14 pages · PDF · Updated October 2026
01 / Why it exists
Give the review an answer.
Security questionnaires were written for software that stores data. Agents are software that acts. This playbook gives your review a consistent, evidence-based way to reach a yes or a no.
What’s inside
- The three questions: where data goes, who can act and what you can prove, broken into 24 checks.
- 12 more checks for compliance, governance and reliability.
- What a good answer looks like, and the red flags that should stop a review.
- A 72-point scorecard with 23 gates.
- A 30-day review process that ends in a signed decision.
02 / Read an excerpt
How the scorecard decides.
| Result | Rule | Decision |
|---|---|---|
| Ready | Every Must scores 2; total 58+ | Approve for production agents handling sensitive data. |
| Conditional | No Must scores 0; total 43+ | Pilot on non-sensitive data with dated remediation. |
| Not ready | Any Must scores 0, or total below 43 | Do not approve. Re-review when gaps close. |
03 / Written for
CSOs and CISOsRisk and compliance leadersSecurity and enterprise architectsProcurement
Get the playbook.
Receive the PDF immediately after a successful request, plus a link by email. No newsletter.
Not legal advice. Confirm your obligations with qualified advisers.
'%20stroke-width='56'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M1250%20640%20C%201500%20470,%201650%20560,%201900%20380%20S%202250%20170,%202450%20220'%20fill='none'%20stroke='%23fff'%20stroke-opacity='.28'%20stroke-width='12'%20stroke-linecap='round'%20stroke-linejoin='round'%20transform='translate(0%20-11)'/%3e%3c/svg%3e)
One workflow. a clear next step.
Bring us the workflow your review rejected.
Tell us about the process, the systems and the people. Let’s work through what it would take to run it.