Real or Paper? The AI Agent Governance Scorecard
AI Agent Governance Scorecard: Real or Paper? | Dr. Seba
Ungoverned · Board Tool from Issue 92
Two companies can look alike on paper. Score any institution that runs AI agents, including your own, on eight pairs. Use it in board meetings, due diligence, and management calls. Each pair maps to the Seba 12 Ps of Responsible AI Oversight.
How to score: 0 = paper only: written, never shown to work. 1 = partly real: in place but untested, or only for some agents. 2 = real: in place for every agent and tested in the last 12 months, with evidence.
The eight pairs
1. A rule is paper; a technical control is real.
PROTECTIONS
Evidence to ask for: What can each agent never submit, move, or contact? Show the block, not the policy.
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
2. A log is paper; an audit trail the agent cannot edit is real.
PROVENANCE
Evidence to ask for: Who can alter agent records? Show a tamper-proof trail.
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
3. A pledge is paper; accountability with consequences is real.
POLICY
Evidence to ask for: What happens, and to whom, when an agent breaks a rule?
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
4. A safety prompt is paper; testing against hard cases is real.
PROCESS · PROBLEMS
Evidence to ask for: Show tests with users who push back, and after every vendor update.
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
5. An inventory spreadsheet is paper; a live register of what each agent can do is real.
PURPOSE
Evidence to ask for: Which agents can act without human approval, and where?
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
6. “The vendor handles it” is paper; a named operator is real.
PRODUCT OWNERSHIP
Evidence to ask for: Who, by name, operates each agent? Not a team. Not the vendor.
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
7. An incident plan is paper; a measured reporting clock is real.
PREPAREDNESS
Evidence to ask for: Hours to detect, and hours to tell regulators, affected people, and the board. Tested when?
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
8. A coverage assumption is paper; confirmed insurance and a remediation budget are real.
PROFITS
Evidence to ask for: Does the policy respond to an AI agent loss, or exclude it? Who pays to fix it?
☐ 0 Paper ☐ 1 Partly ☐ 2 Real
Read your total score (0–16)
0–5 · Paper governance
Policies exist; protection does not. Ask for an inventory, named operators, and a reporting clock before anything else.
6–11 · In transition
Some controls are real. Close the gaps on the lowest-scoring pairs, and test them within 90 days.
12–16 · Real governance
Controls are tested and owned. Keep score after every vendor update and every incident.
Why this matters now
- An AI model meant to use a practice form reached the State Department’s real one and submitted visa applications. None were processed.
- The White House calls AI incident reporting “not optional,” but has not yet defined an incident, deadline, or penalty.
- A proposed Senate bill targets anyone who knowingly operates an AI agent that recklessly causes hacking damage. It is not law.
- Insurers are debating AI exclusions; banks are paying to fix flaws AI models find.
Score one company this week: one you fund, or one you oversee from the boardroom.
A free board tool built on Ungoverned: A Practical Guide to AI Minimum Viable Governance (May 2026). Pair it with the AI Agent Incident-Response Checklist and the Seba 12 Ps Reference Card. Get the weekly briefing · LinkedIn: @freddiesebaprofile
For informational purposes only. Provided free of charge. Not legal, financial, or investment advice; not intended for trading; not an offer, solicitation, or recommendation to buy or sell any security. Scores are a governance prompt, not a rating or valuation. Provided “as is,” with no guarantee of accuracy, completeness, or usefulness. Use is subject to the Terms of Use. Summaries reflect public reporting as of October 2026. Disclosure. AI tools, including Anthropic’s Claude, OpenAI’s ChatGPT, and Google’s Gemini, support research, verification, drafting, and layout; output may carry AI watermarks. AI tools can make mistakes; I check claims against sources and correct errors openly. The frameworks, analysis, and editorial judgment are mine. © 2026 Freddie Seba. All rights reserved. May be shared internally by boards, leadership teams, and investment teams with attribution; no other reproduction without permission.