Operating standard · Scoping engagement · Start with one agent

Every AI agent needs an owner's manual

An AI agent operating model — who owns the agent, what it is authorized to do, and how a human stops it.

Most companies are still asking one question: can we make the agent work? That is necessary. It is not enough. Once an agent becomes part of a real business process, a second set of questions decides whether you actually own it.

Start with one agent See how we work

A practical operating standard for companies putting AI agents into real business processes

The question most projects skip

If the person who built this left tomorrow…

  • Could someone else safely operate it?
  • Could someone else change it?
  • Could someone else disable it?
  • Could someone else retire it?
If the answer is no, the organization may have access to the automation without truly owning it.
Definition

What an AI agent operating model is.

An AI agent operating model is the written answer to three questions about a production agent: who owns it, what it is authorized to do, and how a human stops it. Everything else — the registry, the authority matrix, the escalation path, the change log, the shutdown procedure — exists to keep those three answers true as the agent changes.

It is not a governance framework and not a compliance document. A governance framework describes how an organization makes decisions about AI in general. An operating model describes how one specific agent runs in production, in language an on-call engineer and a CFO can both act on. The unit is the agent, not the company.

It is also distinct from two neighboring practices. An AI agent readiness assessment asks whether your systems can support an agent at all, before you build. AI agent workflow design specifies the work the agent will do. The operating model covers what happens after both: the agent is live, it is doing real work, and someone has to answer for it on a Tuesday.

The Agent Owner’s Manual is our name for the artifact that carries it — one living document per agent, fifteen fields, readable by a person who did not build it.

The gap

AI agents are moving from experiments into everyday work.

They qualify leads, update CRM records, prepare reports, answer customers, classify invoices, draft communications, call APIs, trigger workflows and increasingly coordinate with other systems and agents.

Once an agent becomes part of a real business process, the organization needs to answer a second set of questions.

01Why does this agent exist?
02Who owns the business outcome?
03Who owns the technical system?
04What exactly is it authorized to do?
05What data and systems can it access?
06What can it change?
07Which actions can happen autonomously?
08Which actions require human approval?
09What happens when it is uncertain?
10Who steps in when something goes wrong?
11What changed since the last version?
12How do we disable it?
13What if the person or vendor who built it disappears?
A production AI agent should not be a mysterious automation that happens to work.

It should be an identifiable business system with a clear purpose, named owner, explicit mandate, known dependencies, defined authority, human-control rules and a shutdown procedure. That is the purpose of an Agent Owner's Manual.

Why it is missed

The problem is not documentation alone.

Most agent projects follow a familiar path. Operating the agent requires a second layer that no build pipeline produces.

Figure 1 · Two layers, one usually missing

Building an agent and operating an agent are different disciplines

What most projects build
ModelPromptToolsOrchestrationDeployment
What operating it requires
OwnershipPurposeAuthorityPermissionsSupervisionExceptionsAccountabilityChangeRetirement
The gap stays invisible while there are one or two agents and the original builder is close to the project. It becomes visible later.

Finance has two agents. Sales has three. Marketing has several agentic tools. Operations has automated reporting. IT runs an internal assistant. An external agency built a customer-service workflow. An employee created something useful in n8n and later moved to another company.

Suddenly the organization has a portfolio of agentic systems, but much of the knowledge needed to operate them is scattered across prompts, automation tools, SaaS configuration, API permissions, vendor documentation, internal messages, individual employees, and people's memory.

That creates more than documentation debt. It creates ownership debt.

What ownership debt costs

The cost is rarely visible as one budget line. It appears across operations.

Business continuity

If the original builder leaves, can someone else safely operate, modify and eventually retire the agent? If not, the company may have access to the automation without truly owning it.

Decision risk

An agent may technically have permission to perform more actions than the business intended. Without an explicit mandate, the boundary between "can do" and "is authorized to do" remains unclear.

Operational ambiguity

Employees may not know when to trust the agent, when to verify its work, when to intervene, when to escalate, or what to do after an exception.

Vendor dependency

A third party may understand the architecture, permissions and failure modes better than the company paying for the system.

Change risk

The model changes. The workflow changes. A new tool is connected. Permissions expand. The internal understanding does not change with it — and the organization keeps operating against an outdated picture of the agent.

Portfolio blindness

At five agents, memory may be enough. At fifty, someone eventually has to answer a harder set of questions about the whole estate.

The questions a portfolio eventually forces

Which agents are in production?
Which can communicate with customers?
Which can write into critical systems?
Which use sensitive information?
Which have broad permissions?
Which have no clear owner?
Which have not been reviewed?
Which depend on one vendor?
Which have no shutdown procedure?

The problem is no longer one agent. It is the operating model around the portfolio.

The artifact

The Agent Owner's Manual

A living, human-readable operating description of an AI agent. It explains what the agent does, why it exists, who owns it, what it can access, what it can change, what authority has been delegated to it, what it can do autonomously, what requires approval, what it must never do, how humans supervise it, what happens when something goes wrong, how changes are tracked, and how the agent can be disabled or retired.

What it is not

Not just a system prompt. Not just an architecture diagram. Not just technical documentation. Not just an AI policy.

It connects the business view, operator view and technical view into one operating record the organization can actually use.

One source of truth. Different views for different people.

The CFO does not need the same information as an operator. The operator does not need the same information as IT. The underlying information should therefore be structured once and presented differently.

Executive / Owner

One page, nine answers

  • What does the agent do?
  • Why do we use it?
  • Who owns it?
  • What does it cost?
  • What business value should it create?
  • What important decisions can it make?
  • What are the main risks?
  • When was it last reviewed?
  • How do we disable it?
Operator

How to work with it

  • When to use it
  • What to expect
  • What they must verify
  • What they should never delegate
  • What warnings mean
  • When to intervene
  • When to override
  • Who to escalate to
Technical

What IT, security and vendors need

  • Model, environment, instructions
  • Tools, MCP servers, APIs
  • Identities, permissions, secrets
  • Knowledge sources
  • Logs and guardrails
  • Tests and dependencies
  • Rollback and shutdown

The goal is not more paperwork. The goal is a shared operating truth.

The centrepiece

The Agent Mandate

A technical permission answers: what can the system physically do? A mandate answers: what has the business actually authorized the agent to do? Those two things are not always the same.

Consider an agent with CRM write access. Technically, its credential may allow it to change dozens of fields. The business may only want it to update Lead Status and Qualification Note. That creates three layers.

Layer 1 · Widest

Technical capability

What can the agent physically do, given its credentials and connected tools?

Layer 2 · The mandate

Assigned authority

What does the business permit the agent to do — stated explicitly, action by action?

Layer 3 · Reality

Runtime enforcement

What does the implementation actually prevent, rather than merely request?

The distinction that decides your risk

A prompt saying "only update qualification information" is not the same as a tool that only exposes the approved fields. The closer technical enforcement matches business authority, the clearer and safer the operating model becomes.

Define authority action by action

Avoid vague descriptions such as semi-autonomous. Define authority for specific actions instead.

ActionAgent authority
Read CRMAutonomous
Research accountAutonomous
Update qualification noteAutonomous
Draft customer emailAutonomous
Send customer emailHuman approval
Change commercial termsHuman only
Offer discount above defined limitProhibited
Delete customer recordProhibited

This is much easier for business owners to understand than a generic autonomy score. It is also much easier for technical teams to implement.

Supervision

Human control is more than a kill switch.

A company does not have meaningful human oversight merely because someone can disable the agent. We look at five forms of control.

01

Observe

Can a person understand what the agent is doing?

02

Interrupt

Can an active workflow be stopped?

03

Approve

Which consequential actions pause before execution?

04

Override

Can a human replace or correct the agent's decision?

05

Disable

Can the entire agent be taken out of operation?

The shutdown procedure matters. But meaningful control starts earlier, with visibility, authority boundaries, approval points and escalation paths.

The happy path is not enough

Many agent descriptions explain what should happen when everything goes right. Operations depend just as much on what happens when it does not. For example:

ExceptionCustomer identifier is missing
ExceptionCRM records conflict
ExceptionA connected tool is unavailable
ExceptionPermissions are insufficient
ExceptionConfidence is low
ExceptionA customer disputes the result
ExceptionA policy conflict appears
ExceptionPossible fraud is detected
ExceptionSensitive information appears unexpectedly

For each important exception, the organization should know whether the agent should retry, stop, ask a human, route the case, use a fallback, log the event, or refuse to continue.

This is where an AI agent becomes part of an operating process instead of a black box.

Worked example

An Accounts Receivable Follow-Up Agent

It reads ERP invoices, identifies overdue accounts, checks CRM context, drafts follow-up, categorises risk, sends simple approved reminders, escalates sensitive cases and records activity. The value is easy to understand. So should be the operating boundary.

Operating record · abbreviated

Purpose

Reduce manual accounts-receivable follow-up while maintaining human control over sensitive customer situations.

It can
  • read outstanding invoices
  • read CRM history
  • prepare reminders
  • send a defined first reminder
  • record follow-up activity
It cannot
  • modify invoice data
  • change bank details
  • negotiate payment terms
  • initiate legal action
  • contact accounts marked as under formal dispute
It must escalate when
  • invoice value exceeds a defined limit
  • the customer disputes the amount
  • payment terms conflict
  • the account is strategic
  • legal language appears
Business ownerFinance Operations
Technical ownerIT / Automation
ShutdownA documented disable procedure owned by the organization

Nothing here is exotic. That is the point. A clear operating manual makes a useful agent understandable outside the team that built it.

Diagnostics

Two useful tests

Both take minutes. Both tend to produce uncomfortable answers in organizations that believe they are further along than they are.

Test one

The bus-factor test

If the person or agency that built this agent disappeared tomorrow, could our organization safely operate, change, disable and retire it?

If the answer is no, the organization may not truly own the agent yet.

Test two

The explain-it test

Ask five people separately — the business owner, the operator, IT, security and an executive — one question: What exactly is this agent allowed to do?

If the answers are materially different, you have found an Agent Operability gap.

The minimum viable version

Start smaller than a governance program.

You do not need to redesign the organization before improving one production agent. A practical minimum Owner's Manual contains only fifteen things.

01Agent name
02Purpose
03Business owner
04Technical owner
05Trigger
06Users
07Data sources
08Connected systems
09What it can read
10What it can change
11Autonomous actions
12Approval-required actions
13Prohibited actions
14Escalation path
15Shutdown procedure

For many organizations, simply documenting these properly exposes the most important gaps.

The technical sibling

If your agents run inside a workspace, the machine-readable half of this already has a convention: AGENTS.md, the file coding agents read to learn how work is done in a project. The Owner's Manual is the business-layer companion — same four questions, addressed to people rather than to the agent.

Worth knowing before you write either: research from ETH Zurich found that agents follow these files literally, including where doing so is counterproductive — a tool merely named in a context file was invoked 1.6 times per task against fewer than 0.01 when it was not mentioned. Every line you write is a lever the agent will pull.

When one agent becomes a portfolio

The next step is an Agent Registry. Your first registry does not need to be a new platform. It can start in Excel, Notion, SharePoint, Airtable, Markdown or an existing internal system.

The important thing is that the organization can see which agents exist, their status, purpose, business owner, technical owner, authority level, connected systems and data sensitivity — whether they can write, whether they can communicate externally, whether human approval is required, when they were last reviewed, where their manual lives, and how they are disabled.

The technology used to store this information matters less than establishing ownership.

The operating standard, compressed

Four simple production rules

A practical operating standard can begin with four rules. They are deliberately simple.

No owner → no production.

No mandate → no autonomy.

No visibility → no trust.

No shutdown procedure → no deployment.

The goal is not to slow down AI adoption. The goal is to make successful deployments easier to own, easier to hand over and easier to scale.

How we work

You do not need to buy a transformation program to begin.

We work in a simple progression. Each step produces a useful result on its own, and each one is optional.

Start with the idea

Use this framework internally, or invite auxfirst to present the Agent Owner's Manual framework online or onsite. The purpose is to establish a common language across business, operations, IT, security and AI teams.

You should leave with a clearer answer to one question: do we have an agent ownership problem worth solving?

Scope the Agent Owner's Manual Roadmap

If the concept is relevant, the next step is a focused scoping engagement. We review a selected group of current or planned agents and map:

  • purpose
  • ownership
  • authority
  • connected systems
  • data and knowledge
  • human-control points
  • exceptions
  • existing documentation
  • vendor dependencies
  • change and shutdown practices

The purpose is not to create documentation for everything. It is to identify what your organization actually needs. The outcome is a prioritized Agent Owner's Manual Roadmap showing which agents should be addressed first, what minimum standard they need, where ownership is unclear, where authority is too broad or too vague, where human intervention is missing, whether a registry is needed, and what should become a reusable organization-wide standard.

This is the natural first engagement because it produces a useful result without requiring a large transformation commitment.

Implement the missing operating layer

Once the roadmap is clear, auxfirst can help implement the pieces that matter. Depending on the organization, this can include:

  • Agent Mandates
  • Agent Operating Records
  • Executive / Owner Views
  • Operator Manuals
  • Technical Views
  • Agent Registry
  • Authority Matrix
  • Human Control Matrix
  • Exception & Escalation Matrix
  • Production Acceptance Standard
  • Vendor Handover Standard
  • Change Review Standard
  • Retirement Checklist

A common approach is to implement the complete operating package for one important production agent first. That gives the organization a working standard before scaling it across more agents.

What the first engagement should give you

The Agent Owner's Manual Roadmap should leave you with a concrete answer to:

The purpose is clarity. Not another abstract AI governance deck.

Fit

Who this is for

This work is particularly relevant if several of these are true.

When it is not useful

It is less useful if you are still experimenting with a single disposable prototype that does not touch meaningful business processes. The framework becomes valuable when the agent becomes something the company expects to rely on.

The outcome

For every important production agent, you should know:

01What is it?
02Why do we have it?
03Who owns it?
04What is it allowed to do?
05What can it technically do?
06What systems and data does it touch?
07Where do humans intervene?
08What happens when it fails?
09What changed?
10How do we stop it?

That is the operating foundation behind an Agent Owner's Manual. And when the organization can answer those questions consistently across its agent portfolio, it is moving toward Agent Operability — the subject of our free field guide, The Agent-Operable Enterprise.

Questions

Before you ask

What is an AI agent operating model?

An AI agent operating model is the written answer to three questions about a production agent: who owns it, what it is authorized to do, and how a human stops it. Everything else — the registry, the authority matrix, the escalation path, the change log, the shutdown procedure — exists to keep those three answers true as the agent changes. The unit is the agent, not the company.

How is an operating model different from AI governance?

A governance framework describes how an organization makes decisions about AI in general: who sits on the council, which policies apply, how risk is classified. An operating model describes how one specific agent runs in production, in language an on-call engineer and a CFO can both act on. You can have a complete governance framework and still be unable to answer who turns off the invoicing agent at 2am.

Who should own a production AI agent?

One named person in the business function the agent serves, not the team that built it. Build teams change, and an agent owned by a project is orphaned the day the project closes. The owner does not need to understand the model; they need the authority to change what the agent is allowed to do and to stop it without asking permission.

Is this an AI governance program?

No. You do not need to redesign the organization before improving one production agent. A practical minimum Owner's Manual contains fifteen things, and for many organizations simply documenting those properly exposes the most important gaps.

How is a mandate different from a permission?

A technical permission answers what the system can physically do. A mandate answers what the business has actually authorized the agent to do. Those two things are not always the same, and the gap between them is where operating risk lives.

Do we need a registry?

Only once one agent becomes a portfolio. Your first registry does not need to be a new platform — it can start in Excel, Notion, SharePoint, Airtable, Markdown or an existing internal system. The technology used to store the information matters less than establishing ownership.

When is this not useful?

It is less useful if you are still experimenting with a single disposable prototype that does not touch meaningful business processes. The framework becomes valuable when the agent becomes something the company expects to rely on.

Next step

Do not begin with a large governance project. Start with one agent.

We can review it together and determine whether your organization needs a minimum Owner's Manual, a complete Agent Operating Record, an Agent Owner's Manual Roadmap, or a broader Agent Operability standard.

Start with one agent See the Operability Audit

Start with the document or presentation. Scope what is actually missing. Then implement only what your organization needs.

Where this sits in the auxfirst canon

Closest engagements
The Agent Operability Audit — whether an agent can actually work one specific workflow, fixed price The Agent Experience Audit — the experience layer, for agents you expose to others Process Brains — turning a workflow into a defensible agentic service
Free frameworks that go deeper
The Agent-Operable Enterprise — the field guide, with a scored 42-item self-assessment Crossing the Chasm to the Agentic Organization — why pilots stall between demo and adoption Five Steps to Becoming an Agentic Organization — the pillar playbook The 10 AUX Heuristics — the working principles, including the trust boundary
The machine-readable half
AGENTS.md for teams that don't write code — the file agents actually read, and why short beats complete Prompt injection in .md context files — why an unowned instruction file is a liability The context file checker — twelve structural checks, in the browser
Reference
The auxfirst knowledge base — every AUX concept, defined and cross-linked AI info page — how machines should read auxfirst

Method · The Agent Owner's Manual is auxfirst's own operating standard, developed through client work rather than derived from a published specification — we state that plainly rather than implying a standard exists. The worked example is illustrative, not a case study; auxfirst does not publish named client results. The instruction-following figures cited above are quoted from Gloaguen et al., Evaluating AGENTS.md (arXiv:2602.11988, February 2026, revised June 2026), read from the paper directly rather than from coverage of it.

Emil Krzemiński is the founder of auxfirst, the agentic experience design agency — helping product, developer and business teams design AI systems that remember, adapt, and earn the right to act. Start with the Agent Operability Audit, the free field guide The Agent-Operable Enterprise, or a conversation. For how machines read auxfirst, see the AI info page. Subscribe to the auxfirst Substack for what's next.