Building & Governing AI Agents
A working map for taking an AI agent from idea to something safe enough to run in production. It mixes what we build — the open AgentAz standard and free tools — with the external references that actually matter, so it's a starting point you can trust rather than a wall of our own links.
The short answer
An AI agent's safety is a function of its autonomy: what it can do without a human. The AgentAz Trust Levels name that on a scale — ADV (advisory, can't change anything), A0, A3 (every consequential action human-approved), A4 (bounded autonomy), A5 (full autonomy). You declare it in an agentaz.json, verify it with the scanner, and enforce it in CI with the GitHub Action. It's framework-independent — the same file describes an agent built in LangGraph, CrewAI, or n8n. A standard, not a runtime.
Starter files (download & drop into your repo)
Adopting the standard is a one-file step. Grab a template, fill it in, and — if you want enforcement — add the CI workflow. These carry the governance vocabulary into your own project, not just ours.
- agentaz.starter.json — an annotated starter spec with a real
tool_boundary; rename toagentaz.jsonand fill in. - agentaz-v1.0.schema.json — the JSON Schema (draft-07) to validate your spec in an editor.
- agentaz.yml — a ready-to-paste GitHub Action workflow that computes the Trust Level in CI and can fail on policy violations.
- agentaz-governance-checklist.md — a short pre-production review checklist for your
/docs.
How do you classify an AI agent’s autonomy?
AgentAz is an open specification for declaring an agent's authority — its worst-case action, Trust Level (ADV→A5), approval gates, and tool boundaries — so a team, or an LLM, can reason about its risk before deploying.
- AgentAz Specification — Trust Levels, gates, and the schema.
- Regulatory crosswalk — how AgentAz maps to NIST AI RMF, ISO 42001, and the OWASP Agentic Top 10.
- Open standard repository — rationale, RFCs, and the reference validator.
Free tools
- Compliance Scanner — grade any agent's system prompt or
agentaz.json; deterministic, no login. - Agent Watch — track an agent's Trust Level over time and catch governance drift.
- Drift Auditor — diff two versions of an agent and get a deterministic governance verdict with evidence.
- Compare Blueprints — put two agent blueprints side by side on Trust Level, gated vs. auto tools, and setup.
- agentaz-validate GitHub Action — enforce a risk policy in CI on every push or PR.
- Tier Badge — a verifiable Trust Level badge from any spec.
- Risk Assessment and Predict the Break — classify autonomy, and sharpen your instinct for how agents fail.
- State of Agent Governance — live aggregate data on how safe real agents are.
Reference blueprints
Sixty-two governed agent blueprints across thirty categories, each with a declared Trust Level and worst-case action. Useful as starting points or as examples of what a well-specified agent looks like.
- Browse all blueprints — filter by domain and framework.
- Incident Responder, Refund & Returns Resolver, Code Review Assistant — worked examples of gated, consequential agents.
Guides
What standards and frameworks apply to AI agents?
The references enterprises and security teams actually use. Worth knowing regardless of which standard you adopt.
- OWASP Agentic Security Initiative — Top 10 — The community reference for agentic threats (excessive agency, tool misuse, memory poisoning) and mitigations.
- NIST AI Risk Management Framework — The govern/map/measure/manage framework enterprises anchor AI risk programs to.
- ISO/IEC 42001 — The management-system standard for AI — increasingly the bar for enterprise procurement.
External canon: agent frameworks
- LangGraph — Graph-based agent orchestration with first-class interrupts for human-in-the-loop.
- CrewAI — Role-based multi-agent orchestration.
- Model Context Protocol (MCP) — The open standard for connecting agents to tools and data sources.
- OpenAI Agents — OpenAI's agent tooling and patterns.
Missing something you rely on? Suggest a resource — this map improves with real use.
From the Artifipedia network
AgentKits is part of Artifipedia, a sourced encyclopedia of AI concepts, models, and terms. If you are trying to understand the wider AI landscape behind agents — the models, techniques, and vocabulary — it is a good place to start.
- Artifipedia — the sourced AI knowledge encyclopedia.
- AI Knowledge Map — an explorable map of how AI concepts connect.