Most organisations approve AI agents once, at launch, and then never check whether the identities, permissions and safeguards they approved still match what the agents actually do. This health check is a recurring audit run sheet for an AI agent governance programme: twelve KPIs with formulas, thresholds, a cadence, a findings log and a remediation map. It is run by the identity or AI governance team each quarter, with a lighter monthly pass on the fastest moving numbers, and signed off by the accountable executive for AI risk. It assumes the programme already exists: the controls, roles and risk tiers themselves are explained in the Agent Governance and Risk Guide, and this page does not repeat them.
What this health check covers
The difference from the pre-launch AI Agent Deployment Checklist is time. The checklist asks whether one agent is ready to go live. This health check asks whether the whole population of agents in production is still governed: whether new agents have appeared outside the register, whether delegated scopes have grown, whether credentials have aged, whether the kill switch still works and whether retired agents still hold access. The questions practitioners type, such as how to audit AI agents, what AI agent governance KPIs to track and how to run an AI agent access review, are answered here as measurable tests rather than principles.
Key takeaways
- Measure the population, not the launch: every KPI is calculated across all agents found by discovery, not only those in the register, so shadow agents lower the score instead of hiding from it.
- Identity is the backbone: owner, own identity, credential age and residual access after decommissioning are the four numbers that make every other control enforceable.
- Test the safeguards, do not just record them: human approval coverage and kill switch tests are measured by evidence of the control firing, not by a policy statement.
- Scope drift is the main finding: delegated scope over policy and the tool permission review rate catch the slow growth of agent authority after go-live.
- Thresholds are a starting point: the green, amber and red values below are NHI Mgmt Group recommendations; set your own from your baseline and risk appetite and record why.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this AI Agent Governance Health Check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
Agent populations change faster than human workforces, so the cadence is tighter than a typical identity review. Keep every evidence file for at least the period your audit or regulatory regime requires.
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Discovery reconciliation (A1, A10) | Monthly | Identity operations | AI governance lead | Discovery exports, register snapshot, reconciliation sheet |
| Credential age and residual access (A7, A12) | Monthly | Identity operations | AI governance lead | Credential inventory export, decommission tickets |
| Full KPI run (A1 to A12) | Quarterly | AI governance lead | Accountable executive for AI risk | KPI workbook, findings log, sign-off record |
| Tool and scope review (A4, A5) | Quarterly, and after any tool or model change for high-risk agents | Agent owners | Security architecture | Permission matrix diff, owner attestations |
| Kill switch exercise (A9) | Quarterly sample; every high-risk agent at least yearly | Platform or SRE team | Head of security operations | Exercise log with timestamps, revocation evidence |
| Board or risk committee summary | Half-yearly | CISO | Risk committee | One page trend report, open red findings |
Metrics
All twelve metrics use the discovered population as the base unless stated. "High-risk agent" means the top tiers of your own risk tiering scheme (see the AI Use Case Risk Tiering Guide). NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| A1 | Agent inventory coverage | Agents in the register / agents found by all discovery sources | Agent register; IdP application and workload identity lists; OAuth grant inventories; API gateway and AI gateway logs | ≥ 98% | 90% to below 98% | < 90% |
| A2 | Agents with a named owner | Registered agents with a current, employed human owner / registered agents | Agent register joined to HR system of record | 100% | 95% to below 100% | < 95% |
| A3 | Agents with their own identity | Production agents authenticating as a dedicated agent or workload identity / production agents | IdP and cloud IAM identity inventories; agent runtime configuration | 100% | 90% to below 100% | < 90%, or any high-risk agent on human or shared credentials |
| A4 | Delegated scope over policy | Agents holding at least one scope, role or tool grant not in their approved permission matrix / registered agents | Effective permission exports from IdP, cloud IAM and SaaS admin consoles; approved permission matrix | ≤ 2% | Above 2% to 10% | > 10% |
| A5 | Tool permission review rate | Agents whose tool and scope list was attested by the owner in the last 90 days / registered agents | Review campaign records; owner attestations | ≥ 95% | 80% to below 95% | < 80% |
| A6 | Human approval coverage for high-risk actions | High-risk actions executed with a recorded human approval / high-risk actions executed | Agent action logs; approval workflow records | 100% | 98% to below 100% | < 98% |
| A7 | Agent credential age | Agent credentials older than the rotation policy, or static where short-lived tokens are available / agent credentials | Secrets manager inventory; IdP credential and key metadata; cloud access key reports | ≤ 2% | Above 2% to 10% | > 10% |
| A8 | Prompt and action log coverage | Production agents whose prompts, tool calls and resulting actions reach central logging with the agent identity attached / production agents | SIEM or log platform source inventory; agent runtime trace stores | ≥ 98% | 90% to below 98% | < 90% |
| A9 | Kill switch test rate | High-risk agents whose stop and revoke procedure was exercised and met the target time in the last 12 months / high-risk agents | Exercise logs; IdP revocation events; platform audit logs | 100% | 75% to below 100% | < 75%, or any failed test unresolved |
| A10 | Shadow agent discoveries | Count of agents found by discovery this period that were not in the register at the start of the period (trend, plus share of those touching sensitive data) | Discovery exports compared with the previous register snapshot | Falling, none touching sensitive data | Flat | Rising, or any with sensitive data access |
| A11 | Agent incident count and closure | Agent-related incidents opened this period; and incidents closed within target / incidents closed | Incident management records tagged with agent identity | All closed within target | One overdue | Two or more overdue, or any repeat root cause |
| A12 | Decommissioned agent residual access | Agents marked retired that still have an enabled identity, live credential, OAuth grant or tool binding / agents retired in the period | Register retirement records joined to IdP, OAuth and secrets inventories | 0% | Any, removed within 7 days | Any older than 7 days |
Notes on the formulas
- A1 and A10 work as a pair: A1 tells you how complete the register is today, A10 tells you whether the intake process is being bypassed. A high A1 with a rising A10 means discovery is catching up after the fact. The Shadow AI Discovery Guide covers the discovery sources.
- A4 needs an approved baseline: without a permission matrix per agent there is nothing to compare against, so record "not measurable" as a red finding rather than leaving the cell blank. The AI Agent Permission Matrix Template gives a format.
- A6 counts actions, not agents: one agent that executes 500 high-risk actions with 490 approvals is 98%, which is amber. Define "high-risk action" once (payments, deletion, permission changes, external sends of sensitive data) and keep the list stable between quarters so trends mean something.
- A9 measures time as well as success: record the time from decision to stop to the moment the agent's last credential is revoked and its sessions end. A test that stops the process but leaves tokens valid is a failure.
- A12 is the agent equivalent of a leaver check: it looks for the identity, credentials, grants and tool bindings that outlive the agent.
How to collect the data
- Freeze the register: take a dated snapshot of the agent register (agent ID, owner, risk tier, identity used, approved permission matrix reference, status) at the start of the review.
- Pull discovery from every source type: IdP application and service principal lists, workload identity and cloud IAM role inventories, OAuth consent and grant inventories from major SaaS platforms, API gateway and AI gateway logs showing model and tool calls, and secrets manager entries tagged or named as agents. Normalise to one list keyed on identity, then reconcile against the register for A1 and A10.
- Join to the HR system of record: match each owner to an active employee record for A2. Owners who have left or moved team count as missing.
- Export effective permissions: collect the scopes, roles, group memberships and tool bindings each agent identity actually holds, including inherited and group-based grants, and diff them against the approved matrix for A4. The Agent Permission Drift guide explains why effective, not assigned, permissions matter.
- Read credential metadata, never secret values: creation and last rotation dates, expiry, type (static key, certificate, short-lived token) from the secrets manager and identity platforms for A7.
- Check log source inventories: confirm each production agent appears as a source in central logging and that sampled events carry the agent identity and the delegating human where there is one, for A8.
- Pull workflow evidence: approval records (A6), review attestations (A5), exercise logs (A9), incident tickets (A11) and retirement tickets (A12) from the ticketing and workflow systems.
- Sample and verify: for each metric, pick five records at random and trace them end to end. A metric that cannot be traced is reported amber at best.
Red flags that need action now
- Any high-risk agent running on a named human's credentials or a shared service account (A3).
- An agent with administrative, wildcard or tenant-wide scopes that are not in its approved matrix (A4).
- A high-risk action, such as a payment, bulk deletion or permission change, executed without a recorded approval (A6).
- A kill switch test where the process stopped but tokens or API keys stayed valid (A9).
- Shadow agents found with access to regulated or customer data (A10).
- Retired agents with live credentials or OAuth grants older than seven days (A12).
- Agent credentials, such as long-lived API keys, found in prompts, transcripts or traces. See How to Find Secrets in AI Agent Transcripts and Traces.
- Production agents with no prompt or action logging, which leaves any incident without a timeline (A8).
- Owners who have left the organisation for agents still in production (A2). The Ownership for Orphaned and Abandoned AI Agents guide covers reassignment.
Findings log
Log one row per finding, not per agent: group agents that share a root cause. Severity follows the red, amber or green status of the metric that raised it unless the risk tier of the agents involved raises it further.
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-AGT-01 | [Number] agents found by OAuth grant inventory not in the register | A1, A10 | [High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-AGT-02 | [Number] agents hold scopes outside their approved matrix | A4 | [Severity] | [Role] | [Date] | [Status] |
| HC-AGT-03 | Kill switch exercise for [agent ID] left [credential type] valid for [minutes] | A9 | [Severity] | [Role] | [Date] | [Status] |
| HC-AGT-04 | [Number] retired agents with residual credentials | A12 | [Severity] | [Role] | [Date] | [Status] |
| HC-AGT-05 | [Finding] | [Metric] | [Severity] | [Role] | [Date] | [Status] |
Risk accepted findings need an expiry date and the approver's name; re-open them at the next quarterly run.
Remediation map
| Finding type | Metrics | Where the fix is explained |
|---|---|---|
| Unregistered or shadow agents | A1, A10 | Shadow AI Discovery Guide; register format in the AI Register and AI Inventory Template |
| Missing or departed owners | A2 | Ownership for Orphaned and Abandoned AI Agents |
| Agents on human or shared credentials | A3 | Agentic AI Identity Guide; Shared credentials between AI agents |
| Scope and tool drift | A4, A5 | Agent Permission Drift; Delegation Chains and Attenuated Authority for AI Agents; AI Agent Tool and Plugin Security Guide |
| Unapproved high-risk actions | A6 | Human-in-the-Loop for AI Agents Guide |
| Aged or static credentials | A7 | AI Agent Credential Lifecycle and Rotation Guide; Credential Vaulting for AI Agents Guide |
| Logging gaps | A8 | AI Agent Observability and Incident Response Guide |
| Failed or untested kill switch | A9 | AI Agent Kill Switch and Containment Guide |
| Incidents overdue or repeating | A11 | AI Agent Incident Response Playbook |
| Residual access after retirement | A12 | Agent Governance and Risk Guide (lifecycle and decommissioning) |
Related guides
- Agent Governance and Risk Guide: the programme this health check audits.
- Agentic AI Identity Maturity Model: use the KPI results to place the programme on a maturity level.
- Identity Security Metrics Guide: how agent KPIs sit beside human and NHI identity metrics.
- AI Agent Deployment Checklist: the pre-launch gate that feeds the register.
- AI Agent Incident Response Playbook: what to do when a red flag turns out to be an incident.
References
Framework anchors for the metrics: NIST AI RMF GOVERN 1.6 (inventory of AI systems), GOVERN 1.7 (safe decommissioning), MEASURE 2.4 (production monitoring) and MANAGE 4.1 (post-deployment monitoring plans); NIST SP 800-53 AC-2 (Account Management), AC-6 (Least Privilege), AC-6(7) (Review of User Privileges), IA-5 (Authenticator Management), AU-12 (Audit Record Generation) and IR-4 (Incident Handling); NIST CSF 2.0 PR.AA-01, PR.AA-05 and ID.AM.
- NIST: AI Risk Management Framework (AI RMF 1.0)
- NIST: AI RMF Playbook
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- OWASP: Top 10 for Agentic Applications 2026
- CIS: Control 5 Account Management
Related NHI Mgmt Group resources: Agent Governance and Risk Guide, Agentic AI Identity Maturity Model, AI Agent Kill Switch and Containment Guide, Human-in-the-Loop for AI Agents Guide.