What is an Agent Card?
An Agent Card is a job description for an AI agent. It defines who owns the agent, what it can access, what it can do, what triggers an escalation, and how it's performing. Without it, you're running autonomous software in production with no accountability framework.
The template
Every Agent Card covers five sections:
Identity: Agent name, owner (the human accountable), deployment date, status, next review date (every 90 days).
Scope: Read access (which systems, what data), write access (what it can modify), and prohibited access (explicitly listed).
Actions — four tiers: - Tier 1 (Autonomous): Routine actions the agent handles end-to-end - Tier 2 (Notify): Agent acts but notifies a human who can reverse - Tier 3 (Approval required): Agent recommends, human decides - Prohibited: Actions the agent must never take
Escalation triggers: Confidence below threshold, amount above threshold, anomaly detected, customer requests human. Each with a defined path and response SLA.
Performance (rolling 30 days): Volume processed, accuracy rate, escalation rate, average processing time, error count, cost per transaction.
Why this document matters
For the owner: It's the contract between the organization and the agent. If the agent does something outside its scope, the violation is visible and accountability is clear.
For the team: New team members can read the Agent Card and understand the agent's role in 5 minutes.
For auditors: When an auditor asks "what does this AI do and who's responsible?" — you hand them the Agent Card.
For the agent itself: The scope and action tiers define the agent's operating boundaries. The Agent Card isn't just documentation — it's the specification the agent runs against.
The 90-day review cycle
Every 90 days, the owner reviews:
- •Performance metrics — Is accuracy stable? Has escalation rate increased?
- •Scope creep — Has the agent been given access to systems not listed?
- •Tier evolution — Should any Tier 2 actions graduate to Tier 1?
- •Business changes — Have the underlying business rules changed?
- •Incidents — Were there errors that require scope adjustment?
If anything changed, update the card and log the change. If nothing changed, record "Reviewed — no changes." The review itself is the governance.
Start here
Pick one agent currently running in your organization. Write its Agent Card. It takes 15 minutes and will surface every governance gap you have.
If you can't fill in the Agent Card, you're not ready for production. If you can, you're already ahead of 90% of organizations deploying AI today.