An AI agent intake form should ask ten questions: what it is for, who owns it, which tools it calls, what data it reads, which credentials it holds, which actions need approval, what is logged, what happens on failure, how to stop it, and when it will be reviewed. Keep it to one page so teams actually fill it in.
The form
| # | Question | What a reviewer looks for |
|---|---|---|
| 1 | What does the agent do, in two sentences? | A clear, narrow purpose |
| 2 | Who owns it, and who is the backup? | Named people |
| 3 | Which tools and servers does it call? | A complete list, with any shell or web fetch flagged |
| 4 | What data can it read or write? | Classification of the most sensitive item |
| 5 | Which credentials does it hold? | Own identity, narrow scope, expiry |
| 6 | Which actions need human approval? | Deletes, outbound messages, spending, production changes |
| 7 | What is logged and where? | Tool, input, identity, outcome |
| 8 | What happens if a check or service fails? | A chosen behaviour, not an accident |
| 9 | How do we stop it? | Steps and who can do them |
| 10 | When will this be reviewed? | A date, not "later" |
Why these questions
They follow the root causes OWASP gives for excessive agency: too much functionality, too many permissions, too much autonomy. Questions 3 and 4 expose functionality, 5 exposes permissions, and 6 exposes autonomy. Questions 7 to 10 are about recovery, because OWASP notes that logging and monitoring limit damage even when they do not prevent it.
Make the answers checkable
A form full of free text is hard to review. Where you can, give choices.
- Credentials: shared account, personal token, own service identity
- Data: public, internal, confidential, regulated
- Write access: none, limited to one system, broad
Anything that lands on the risky end of a choice sends the request to a closer review. Everything else can be approved by the owner's manager and a security reviewer within a few days.
Set a response time
Teams skip the form when it takes weeks. Promise an answer within five working days for low-risk requests, and publish the number. A fast yes for low risk buys the goodwill to be slow on the high-risk ones.
Keep the answers
File each approved form next to the agent's inventory entry. When the agent changes, such as a new tool or a new data source, the owner updates the form. A change in tool list is a change in risk. The MCP tools specification includes a notification for tool list changes for this reason, and your process should mirror it.
Review dates
Put a review in the calendar for each approved agent. At the review, ask whether it is still used. Retire anything that is not.
Quick check
Do coding assistants need the form too?
Yes, once per tool and team rather than per developer. The questions about tools, data and approvals apply directly.
Who approves?
The owner's manager approves business need, and a security reviewer approves the access and controls.
Safeguard's agent identity, asset discovery and policy features can hold the inventory and rules the form feeds, and the free scan is a quick first look at a repository.
Sources
Last reviewed: 19 October 2026.
