{"description":"Each monthly or release-triggered instance runs against the existing Control item for AI guardrail configuration and agent permission review (framework aiuc-1 + iso-42001 + eu-ai-act; frequency monthly and per release; control_owner AI Platform Security Lead) — the run enriches that Control's execution history and is its evidence of operation, never a duplicate. The decision-aware cycle confirms the in-scope agent population and baseline; reviews input defenses and endpoint limits, tool allow-lists, permissions and sandboxing, output filters and grounding, misuse refusals, secrets redaction, and secure-code-generation defaults; decides on agent permission scope and on guardrail drift with a remediation branch for each; and consolidates the results into a signed guardrail attestation with cycle metrics and owned actions, booking every residual gap as an Issue (source: management_identified) linked to the anchor Control. In scope: every production AI agent and inference endpoint, its guardrail configuration, tool-call and detection logs, and configuration artifacts. Out of scope: model development, pre-deployment evaluation, and vendor AI due diligence, which have their own workflows. The cycle hands off only to its next instance through the carry-forward Issues that the guardrail attestation step links to the anchor Control.","edges":[{"id":"e-decide-agent-permission-scope-decide-guardrail-drift-and-coverage","label":"Within scope","source":"decide-agent-permission-scope","target":"decide-guardrail-drift-and-coverage","whenValue":"within_authorized_scope"},{"id":"e-decide-agent-permission-scope-remediate-over-permissioned-agents","label":"Over-permissioned","source":"decide-agent-permission-scope","target":"remediate-over-permissioned-agents","whenValue":"over_permissioned_agents_found"},{"id":"e-remediate-over-permissioned-agents-decide-guardrail-drift-and-coverage","source":"remediate-over-permissioned-agents","target":"decide-guardrail-drift-and-coverage"},{"id":"e-decide-guardrail-drift-and-coverage-compile-guardrail-attestation-and-actions","label":"No drift","source":"decide-guardrail-drift-and-coverage","target":"compile-guardrail-attestation-and-actions","whenValue":"no_drift_or_gaps"},{"id":"e-decide-guardrail-drift-and-coverage-remediate-guardrail-drift-and-retest","label":"Drift found","source":"decide-guardrail-drift-and-coverage","target":"remediate-guardrail-drift-and-retest","whenValue":"drift_or_gaps_found"},{"id":"e-remediate-guardrail-drift-and-retest-compile-guardrail-attestation-and-actions","source":"remediate-guardrail-drift-and-retest","target":"compile-guardrail-attestation-and-actions"}],"isPublic":true,"metadata":{"capabilities":[],"controlVerbs":{},"controls":["UC-AI-18","UC-AI-19","UC-AI-20","UC-AI-22","UC-AI-23","UC-AI-25"],"department":"ai-governance","domains":["controls"],"library":{"aliases":[],"canonicalUrl":"https://workflow-library.com/all/?w=controls-ai-guardrail-configuration-agent-permission-review","contentDigest":"sha256:b02741cf77f111c9d5a16e847a45acf672e5b25cbe8a0511ebdabe8a4cf69f61","prerequisites":{"status":"undeclared"},"provenance":[],"releaseId":"sha256:b02741cf77f111c9d5a16e847a45acf672e5b25cbe8a0511ebdabe8a4cf69f61","schemaVersion":1,"sourceTemplateId":"workflow-library:controls-ai-guardrail-configuration-agent-permission-review"},"lineOfDefense":"operate","mappingStatus":"mapped","risks":[],"slug":"controls-ai-guardrail-configuration-agent-permission-review","source":"coworkcanvas-gallery","standards":["nist-ai-agent-identity","aiuc-1","iso-42001","eu-ai-act"],"teams":["ai-governance","it"]},"name":"AI Guardrail Configuration & Agent Permission Review","nodes":[{"data":{"controls":["UC-AI-18","UC-AI-19"],"decisionField":"agent_permission_scope","description":"Judge input-defense adequacy and authorize each agent's tool, permission, approval-gate and sandbox scope from the combined baseline review.","formData":{"fields":[{"key":"agent_permission_scope","label":"Agent permission scope","options":[{"label":"Within authorized scope","value":"within_authorized_scope"},{"label":"Over-permissioned agents found","value":"over_permissioned_agents_found"}],"required":true,"type":"select"}],"resultType":"form","submittedAt":null,"values":{}},"instructions":"**Objective** — Judge input-defense adequacy and authorize each agent's tool, permission, approval-gate and sandbox scope from the combined baseline review.\n\n**Inputs**\n- The anchor Control item for AI guardrail configuration and agent permission review (framework aiuc-1 + iso-42001 + eu-ai-act; frequency monthly and per release; control_owner AI Platform Security Lead) this instance runs against, plus the governing Control items UC-AI-18, UC-AI-19, UC-AI-20, UC-AI-22, UC-AI-23, and UC-AI-25.\n- The AI agent and model inventory, queried live from the external registry — no native AI Agent item type exists, so the snapshot is retained on this step as point-in-time evidence.\n- The approved guardrail baseline per agent: input-filter policy version, tool allow-list and permission scope, output-filter taxonomy version, secrets-scanning policy, misuse refusal classifier version, secure-code guidance version, and endpoint limits.\n- The period's release log and the open carry-forward Issues the prior instance linked to the anchor Control.\n- Each agent's input-filter configuration across the four channels: prompts, uploaded content, retrieved data, and tool results.\n- The period's detection logs and adversarial-input campaign alerts from the filtering layer.\n- Endpoint configuration and traffic logs: authentication mode, rate limits, quotas, and abuse monitoring.\n- Evaluation and red-team findings from the period that should have driven detection tuning.\n- The approved tool allow-list and permission scope per agent, from the scope memo and baseline.\n- The effective allow-list and granted permissions from the agent platform and connected systems.\n- The period's tool-call log with each call's authorization decision: allowed, denied, or escalated.\n- The agent configuration artifacts — hooks, skills, rules, system prompts — with change history.\n- The sandbox configuration for agent-generated code execution.\n\n**Procedure**\n_This checkpoint absorbs “Review input defenses and endpoint limits”. The agent runs the preparation, evidence assembly and record updates below; the named owners retain the substantive decisions and approvals stated in the procedure._\n1. Review input defenses and endpoint limits: Query the inventory (coach-query-data) for every production agent and inference endpoint; flag any agent deployed since the last cycle with no approved baseline and any baseline whose owner or version is stale.\n2. Pull the release log and mark each agent whose model, tools, connectors, or guardrail settings changed — those agents get a per-release review on top of the monthly checks.\n3. Query the open carry-forward Issues and map each to its agent, so this and the later reviewing steps re-test the prior gap instead of rediscovering it.\n4. Draft the scope memo — agent, owner, baseline version, trigger, open carry-forwards — and attach it (coach-document-upload). Every later step compares observed configuration to the baseline fixed here.\n5. Query each agent's input-filter configuration and diff it against baseline; confirm screening runs before content reaches the model or triggers an action on all four channels — a filter that covers prompts but not retrieved data or tool results is a coverage gap, not a partial pass.\n6. Pull the detection logs and campaign alerts; confirm each alert reached a responder, and sample blocked and allowed inputs to check the detections fire. An empty log on a busy endpoint is itself a finding.\n7. Verify every endpoint is authenticated, rate-limited, and monitored for scraping, model-extraction query patterns, and resource exhaustion; record any endpoint outside the limit baseline.\n8. Trace each evaluation finding to a detection or filter change; list findings with no tuning response.\n9. Draft the input-defense review — per-agent channel coverage, detection activity, endpoint limits, and every gap with a proposed owner — and attach it with the retained filter configurations and detection logs. The AI Platform Security Lead judges whether the layered defenses match baseline, naming any gap they will not accept as tuned.\n10. Decide agent permission scope: Query the effective allow-list and permissions per agent (coach-query-data) and diff against baseline; record every tool, connector, or action present but unauthorized, and every permission wider than the task, user, and context it serves.\n11. Confirm human approval is required for irreversible, high-value, and out-of-policy actions and pull evidence the gate fired in the period; a gate never invoked on an agent that performs such actions needs an explanation.\n12. Confirm agent-generated code executes only in isolated sandboxes; record any path that reaches production systems or credentials.\n13. Scan hooks, skills, rules, and system prompts for injected instructions and reconcile their change history to approved changes.\n14. Classify every denied and escalated tool call as expected enforcement, a misconfigured allow-list, or an attempted out-of-scope action, and build the tool-call authorization dashboard (coach-dashboard-create).\n15. Draft the permission review — per-agent allow-list drift, permission over-reach, gate evidence, sandbox status, artifact scan results — and attach it (coach-document-upload).\n16. Join the allow-list diff, permission assessment, gate evidence, sandbox status, and artifact scan results into one summary row per agent with its verdict and evidence reference.\n17. Rank flagged agents by blast radius: write access to production systems, financial or customer-data reach, and external communication capability first.\n18. Draft the rationale, attach the summary, and pre-fill the decision form for the owner's review (coach-form-fill).\n\n**Decision criteria**\n- Select `within_authorized_scope` when every agent's effective allow-list matches baseline, no permission exceeds its task, user, and context, approval gates for irreversible and high-value actions are configured with evidence of firing where such actions occurred, generated code runs only in sandboxes, and the configuration-artifact scan found no injected instructions. Expected denials in the tool-call log are enforcement working, not a defect.\n- Select `over_permissioned_agents_found` when any agent holds an unauthorized tool, connector, or action, a permission wider than its scope, a missing or bypassed approval gate, a code-execution path outside the sandbox, or an injected instruction in its hooks, skills, rules, or system prompts. Name each agent and its specific over-reach in the rationale; the remediation step works from that list.\n\n**Record in AssureSwarm**\n- Step document — the scope memo with the inventory snapshot, and the input-defense review with retained filter configurations and detection log extracts.\n- Step evidence — the inventory, carry-forward, configuration-diff, and endpoint-limit query results retained on this step.\n- Step form — submit `agent_permission_scope` (SELECT) only; put rationale in the step result and the decision owner in the native approval record.\n- Dashboard — tool calls by authorization decision, denied and escalated calls by agent, over-permissioned agents.\n- Step document — the permission review with the allow-list diff, artifact scan output, and tool-call log extracts, plus the permission-scope summary, one row per agent with its verdict and evidence reference.\n\n**Exit criteria**\n- Every in-scope agent has a named owner and an approved baseline version or is flagged unbaselined; release-triggered agents are marked; every carry-forward Issue is mapped to an agent. Every agent shows screening on all four input channels and every endpoint shows authentication, rate limits, and abuse monitoring, or the gap is named with a proposed owner; detection tuning traces to evaluation findings. Feeds the guardrail-drift decision.\n- Every agent has an allow-list diff, permission assessment, approval-gate evidence, sandbox status, and a clean or flagged artifact scan; every denied and escalated call is classified. The routing selector is submitted and the step result contains a rationale that disposes every agent, and the unused branch is prunable. `within_authorized_scope` proceeds to the output-filter review; `over_permissioned_agents_found` routes through remediation first.","kind":"decision","label":"Decide agent permission scope","performedBy":{"primitives":["coach-query-data","coach-document-upload","coach-form-fill","coach-dashboard-create"]}},"id":"decide-agent-permission-scope"},{"data":{"controls":["UC-AI-19"],"description":"Agent books an Issue per over-permissioned agent, drives the allow-list and permission corrections, and re-pulls the effective configuration to prove them; human verifies each agent is back within scope","instructions":"**Objective** — Bring every agent named in the permission decision back within its authorized scope, with the correction proven by a re-pull of the effective configuration rather than by a closed ticket (AIUC-1 B006, D003; UC-AI-19).\n\n**Inputs**\n- The permission-scope summary and rationale naming each over-permissioned agent and its over-reach.\n- The approved baseline allow-list and permission scope per agent.\n- Agent owners and platform administrators for each affected agent.\n\n**Procedure**\n1. Create one Issue per over-permissioned agent (coach-item-create) — issue_type: exception, severity by blast radius, source: management_identified, target_remediation_date per the guardrail policy SLA — and link it to the anchor Control (coach-items-link), naming the agent in the description.\n2. Notify each agent owner (coach-notify) of the specific correction: remove the unauthorized tool, connector, or action; narrow the permission to task, user, and context; restore the human-approval gate; move code execution into the sandbox; strip the injected instruction and rotate any credential it could have reached.\n3. Where an owner asks to keep the wider scope, require a business case, risk acceptance by the risk owner, and an expiry date — an exception on record, never a silent retention.\n4. Re-query the effective allow-list, permissions, gate configuration, and artifact contents for each remediated agent (coach-query-data) and compare line by line to baseline; send any residual over-reach back to the owner.\n5. Update each Issue (coach-item-update) with actual_remediation_date and verified_date on passing re-verification, and attach the before-and-after evidence (coach-document-upload).\n\n**Record in AssureSwarm**\n- Item create — one Issue per over-permissioned agent (coach-item-create): issue_type: exception, severity by blast radius, source: management_identified, target_remediation_date per SLA.\n- Item relationship — each Issue linked to the anchor Control (coach-items-link).\n- Item field update — actual_remediation_date and verified_date set on verified correction (coach-item-update).\n- Step document — before-and-after configuration evidence and any approved exception with its expiry (coach-document-upload).\n\n**Exit criteria** — Every named agent is re-verified within scope from a fresh configuration pull, or carries an approved exception with an expiry date; every Issue is updated with its verification. Proceeds to the output-filter review.","label":"Remediate over-permissioned agents","performedBy":{"primitives":["coach-item-create","coach-items-link","coach-notify","coach-query-data","coach-item-update","coach-document-upload"]}},"id":"remediate-over-permissioned-agents"},{"data":{"controls":["UC-AI-20","UC-AI-23","UC-AI-22","UC-AI-25","UC-AI-18"],"decisionField":"guardrail_drift_disposition","description":"Judge guardrail drift across output filtering, grounding, misuse refusals, secrets and generated-code protections against the approved baseline.","formData":{"fields":[{"key":"guardrail_drift_disposition","label":"Guardrail drift disposition","options":[{"label":"No drift or coverage gaps","value":"no_drift_or_gaps"},{"label":"Drift or coverage gaps found","value":"drift_or_gaps_found"}],"required":true,"type":"select"}],"resultType":"form","submittedAt":null,"values":{}},"instructions":"**Objective** — Judge guardrail drift across output filtering, grounding, misuse refusals, secrets and generated-code protections against the approved baseline.\n\n**Inputs**\n- Output-filter configuration per agent: taxonomy version, scope boundaries, severity routing, downstream sanitization.\n- The period's block logs, output review samples, and filter-effectiveness metrics.\n- Grounding and citation configuration with hallucination-verification results.\n- Misuse refusal policies and classifier versions, misuse-pattern alerts, and the escalation log for confirmed attempts.\n- The secrets-scanning configuration per agent: pattern and entropy rules and the warn, block, or redact action for each channel.\n- The secrets-detection log and a sample of stored prompts, logs, and generated code.\n- The secret-manager inventory for user-supplied credentials.\n- Each code-generating system's secure-code guidance, dependency policy, change log, and latest vulnerability benchmark result.\n\n**Procedure**\n_This checkpoint absorbs “Review output filters, grounding and misuse refusals”, “Review secrets redaction and secure-code defaults”. The agent runs the preparation, evidence assembly and record updates below; the named owners retain the substantive decisions and approvals stated in the procedure._\n1. Review output filters, grounding and misuse refusals: Query each agent's output-filter configuration (coach-query-data) and diff against baseline; confirm blocked and transformed outputs match the taxonomy and high-risk agent outputs routed to the defined response for their severity.\n2. Sample released outputs for scope drift, factual claims without cited sources, and over-exposure of system prompts or internal data; compute filter effectiveness from blocks against sampled misses.\n3. Confirm outputs consumed by downstream systems are sanitized so they cannot carry executable or injected payloads.\n4. Verify refusal policies and classifiers are current for each model's capability level; review misuse-pattern alerts and confirm every confirmed attempt was escalated and reported.\n5. Build the output-guardrail dashboard (coach-dashboard-create) and draft the output and misuse review naming every gap with a proposed owner; attach it (coach-document-upload).\n6. Review secrets redaction and secure-code defaults: Query the secrets-scanning configuration (coach-query-data) and diff against baseline; confirm pattern- and entropy-based detection covers prompts, pasted content, retrieved data, and generated code, and that detected secrets are blocked or redacted before model processing, logging, and storage.\n7. Sample stored prompts, logs, and generated code for tokens, private keys, and connection strings that escaped detection; confirm user-supplied credentials live only in the dedicated secret manager encrypted at rest.\n8. Confirm generated code references secret managers and environment variables rather than hardcoding credentials.\n9. Verify the secure-code guidance still enforces parameterized queries and safe frameworks, established authentication and authorization libraries, secure session and cookie settings, input validation and safe error handling, and logging that excludes secrets.\n10. Confirm dependency specifications in generated code are pinned and verified, sampling for hallucinated or typosquatted packages, and check that every guidance change was re-tested against the vulnerability benchmark.\n11. Draft the secrets and secure-code review naming each gap with a proposed owner and attach it (coach-document-upload).\n12. Decide guardrail drift and coverage: Join the input-defense review, the output and misuse review, and the secrets and secure-code review into one drift register row per agent and guardrail (coach-query-data), marking each as matches baseline, approved change, unapproved drift, or coverage gap.\n13. Rank drift and gaps by exposure: internet-facing endpoints, agents with write access, and code-generating systems feeding production first.\n14. Draft the rationale, attach the drift register (coach-document-upload), and pre-fill the decision form for the owner's review (coach-form-fill).\n\n**Decision criteria**\n- Select `no_drift_or_gaps` when every agent's input filters, endpoint limits, output filters, grounding controls, secrets redaction, misuse refusals, and secure-code guidance match baseline; every channel and endpoint is covered; detection tuning traces to evaluation findings; and every carry-forward gap from the prior cycle is re-tested closed.\n- Select `drift_or_gaps_found` when any configuration differs from baseline without an approved change, any input channel, endpoint, output path, or code-generation path lacks its guardrail, any escaped secret or unrefused misuse attempt was found in sampling, or a prior-cycle carry-forward remains open. Name each agent, the drifted or missing guardrail, and the requirement it fails in the rationale; the remediation step works from that list.\n\n**Record in AssureSwarm**\n- Dashboard — blocks by taxonomy category, severity-routed outputs, hallucination rate, misuse alerts and escalations by agent (coach-dashboard-create).\n- Step document — the output and misuse review with retained configurations, block logs, and review samples (coach-document-upload).\n- Step document — the secrets and secure-code review with retained scanning configurations, detection log extracts, and benchmark results (coach-document-upload).\n- Step form — submit `guardrail_drift_disposition` (SELECT) only; put rationale in the step result and the decision owner in the native approval record.\n- Step document — the drift register with one row per agent and guardrail (coach-document-upload).\n\n**Exit criteria**\n- Every agent's output filters, grounding controls, over-exposure protections, downstream sanitization, and misuse refusals are confirmed against baseline or flagged with a named gap; every confirmed misuse attempt shows its escalation. Feeds the guardrail-drift decision.\n- Secrets detection covers every channel with block or redact before processing, logging, and storage; user-supplied credentials sit in the secret manager; secure-code guidance and pinned-dependency rules match baseline with a current benchmark result, or each gap is named with an owner. Feeds the guardrail-drift decision.\n- The routing selector is submitted and the step result contains a rationale that disposes every agent and guardrail, and the unused branch is prunable. `no_drift_or_gaps` proceeds straight to attestation; `drift_or_gaps_found` routes through remediation and retest first.","kind":"decision","label":"Decide guardrail drift and coverage","performedBy":{"primitives":["coach-query-data","coach-dashboard-create","coach-document-upload","coach-form-fill"]}},"id":"decide-guardrail-drift-and-coverage"},{"data":{"controls":["UC-AI-18","UC-AI-20","UC-AI-22","UC-AI-23","UC-AI-25"],"description":"Agent books an Issue per drifted or missing guardrail, drives the configuration back to baseline or through an approved change, and retests each fix; human verifies every guardrail holds before attestation","instructions":"**Objective** — Return every drifted or missing guardrail to its approved baseline, or through an approved baseline change, and prove it with a retest against the same check that found the gap (AIUC-1 A008, B002, B004, B005, B009, B010, C003, C004, C005, C006, D001, F001, F002).\n\n**Inputs**\n- The drift register and rationale naming each agent, guardrail, and failed requirement.\n- The approved baseline and the change-approval record for any intentional drift.\n- Guardrail owners: input filtering, output filtering, secrets scanning, misuse classifiers, and secure-code guidance.\n\n**Procedure**\n1. Create one Issue per drifted or missing guardrail (coach-item-create) — issue_type: deficiency, severity by exposure, source: management_identified, issue_owner, target_remediation_date — naming the agent and guardrail, and link it to the anchor Control (coach-items-link).\n2. Notify each guardrail owner (coach-notify) with the exact target state: the baseline configuration to restore, the channel or endpoint to bring under coverage, the classifier to update for current capability, or the dependency rule to re-enable.\n3. Where the drift is a legitimate improvement, route it through baseline change approval instead of reverting; unapproved drift is reverted first and argued second.\n4. Retest each fix with the same probe that found it: replay the injection sample, the secret string, the misuse prompt, or the hallucinated-package request, and re-diff the configuration (coach-query-data).\n5. Update each Issue (coach-item-update) with actual_remediation_date and verified_date on a passing retest; attach the retest evidence and any baseline change approvals (coach-document-upload).\n\n**Record in AssureSwarm**\n- Item create — one Issue per drifted or missing guardrail (coach-item-create): issue_type: deficiency, severity by exposure, source: management_identified, issue_owner, target_remediation_date.\n- Item relationship — each Issue linked to the anchor Control (coach-items-link).\n- Item field update — actual_remediation_date and verified_date set on passing retest (coach-item-update).\n- Step document — retest evidence, configuration re-diffs, and baseline change approvals (coach-document-upload).\n\n**Exit criteria** — Every drift register row is retested closed against baseline or covered by an approved baseline change; fixes still in flight carry an owner and date and reach the attestation as open exceptions. Proceeds to attestation.","label":"Remediate guardrail drift and retest","performedBy":{"primitives":["coach-item-create","coach-items-link","coach-notify","coach-query-data","coach-item-update","coach-document-upload"]}},"id":"remediate-guardrail-drift-and-retest"},{"data":{"controls":["UC-AI-18","UC-AI-19","UC-AI-20","UC-AI-22","UC-AI-23","UC-AI-25"],"description":"Agent assembles the cycle metrics, the attestation covering every agent and guardrail, and the owned action list, then archives the record and seeds the next monthly or release-triggered cycle; human signs the attestation, and that signature closes the cycle","instructions":"**Objective** — Consolidate the cycle into a signed guardrail attestation — per agent, each guardrail confirmed against baseline, the metrics that show it operating, and every residual gap converted into an owned, dated action — and close the cycle on that signature (AIUC-1 A008, B002, B004, B005, B006, B009, B010, C003, C004, C005, C006, D001, D003, F001, F002; UC-AI-18, UC-AI-19, UC-AI-20, UC-AI-22, UC-AI-23, UC-AI-25).\n\n**Inputs**\n- The scope memo, input-defense review, permission review and decision, output and misuse review, secrets and secure-code review, drift register and decision, and remediation evidence from either branch.\n- Prior-cycle metrics for trending and the guardrail policy thresholds.\n- Open Issues from this cycle: over-permission exceptions, drift remediations in flight, and corrective actions.\n- The designated evidence repository, its retention controls, and the control execution log.\n- The release calendar for agents, models, tools, and guardrail changes expected before the next monthly run.\n\n**Procedure**\n_Items 1–4 are agent-run, item 5 is the human moment, and items 6–9 close the workflow (folded from the former \"Close and archive\" step); the signature recorded here is the closure._\n1. Compute the cycle metrics (coach-query-data): input-channel and endpoint coverage, adversarial-input detections, denied and escalated tool calls, over-permissioned agents found and remediated, output filter effectiveness and grounding rate, secrets redacted, misuse attempts refused and escalated, secure-code benchmark result, and drift items found, closed, and open.\n2. Build the attestation dashboard (coach-dashboard-create) showing each metric against threshold and prior cycles.\n3. Draft the attestation: one row per agent and guardrail with its status (confirmed, remediated, open exception), the evidence reference, and the AIUC-1 requirements it evidences; list open exceptions with their expiry dates.\n4. Create a corrective-action Issue (coach-item-create) for any metric outside threshold or any open item not already booked — issue_type: deficiency, source: management_identified, issue_owner, target_remediation_date — linked to its source Issue and the anchor Control (coach-items-link).\n5. Obtain the AI Platform Security Lead's signature on the attestation and attach it (coach-document-upload). That signature attests the guardrail stack operated as described and closes the cycle.\n6. Export the full operating record (coach-workflow-export) and archive it with the signed attestation in the designated evidence repository under retention controls; record the archive location and reference, and open the archived copy to confirm it is retrievable.\n7. Confirm every open Issue from this cycle is linked to the anchor Control so the next instance queries it as a carry-forward; create any not-yet-tracked follow-up, including a re-decision Issue for each approved exception due at its expiry. Do not re-create Issues already booked.\n8. Update the control execution log with the cycle result and key metrics for UC-AI-18, UC-AI-19, UC-AI-20, UC-AI-22, UC-AI-23, and UC-AI-25; confirm the next monthly review is scheduled and each expected release is flagged for its per-release review.\n9. Attach the closure record and notify the AI governance body and agent owners of the cycle result (coach-notify).\n\n**Record in AssureSwarm**\n- Dashboard — the attestation dashboard: each metric against threshold and trend.\n- Item create — one corrective-action Issue per out-of-threshold metric or unbooked open item; exception re-decisions and other untracked follow-ups created as Issues.\n- Item relationship — every Issue, including carry-forwards, linked to the anchor Control as the next cycle's input.\n- Step document — the signed attestation with per-agent, per-guardrail status and evidence references, and the closure record with archive location and reference.\n- Workflow instance — the operating record exported and archived; the completed instance against the anchor Control is the control execution record.\n\n**Exit criteria** — Every agent and guardrail has a status and an evidence reference; every metric is on the dashboard; every open exception and out-of-threshold metric has a named owner and due date; the attestation is signed, and that signature closes the cycle. The archived attestation and record are immutable and retrievable; no open thread lacks a tracked owner and date; the next cycle and per-release triggers are on the calendar.","label":"Compile guardrail attestation, metrics and actions","performedBy":{"primitives":["coach-query-data","coach-dashboard-create","coach-item-create","coach-items-link","coach-document-upload","coach-workflow-export","coach-notify"]}},"id":"compile-guardrail-attestation-and-actions"}],"sourceTemplateId":"workflow-library:controls-ai-guardrail-configuration-agent-permission-review"}