# Agent Governance & Security > Agents that act on real systems need the same controls as any system that touches money, customers or data. Twistag sets up the guardrails, tests and audit… Guardrails, evaluation and monitoring for live agents. Agents that act on real systems need the same controls as any system that touches money, customers or data. Twistag sets up the guardrails, tests and audit trail that let leadership, risk and IT sign off, and keep signing off. Works with Any agent Built by Twistag, another vendor or in-house Ready for EU AI Act Risk class, controls and evidence per use case Evidence Every decision Traced to input, model version, prompt and tool call A pilot is approved once. An agent in daily use has to stay approved every day after. - 01 An audit no one can answer. Which model made the decision, on what data, approved by whom. - 02 Agents built by different teams, with different rules. No single view of what is running or what it may do. - 03 A regulator, client or board asking for evidence. And the evidence lives in chat logs and memory. ## Controls that run inside every agent. Governance is built into the agents at runtime and into the release process, so every action is checked, logged and reversible. - 01 Agent registry Every agent in use, its owner, its permissions and its risk class. - 02 Runtime guardrails Tool allow-lists and output schemas enforced on every call. - 03 Evaluation on every change No prompt or model change ships without passing the test set. - 04 Tracing and audit logs Each decision traced to input, model version, prompt and tool call. - 05 Human oversight Review queues, confidence thresholds and a way to stop any agent. - 06 Regulatory mapping EU AI Act classification and SOC 2 evidence, kept current. ### Every agent, its owner and its risk Agent Owner Risk class Actions Status Invoice agent Finance Minimal 6 Live Email triage Service Limited 4 Live Contract review Legal Limited 3 Review Forecast agent Operations Minimal 2 Live CV screening People High—Paused Vendor chatbot Marketing Limited 5 Live 6 agents, 2 from vendors 1 paused for review ## Four to eight weeks, set by the agents in scope. Existing agents keep running while the controls go in. The set-up closes with a review with risk and IT. ## Keep it running, extend it or hand it over. One place to watch, review and improve every agent in the company. New agents start inside the same guardrails, tests and registry. Registry, dashboards and runbooks handed over to the risk and IT teams. ## Agents leadership can sign off. ## About agent governance. Does the EU AI Act apply to the company’s agents? Can it cover agents Twistag did not build? Which tools does it use? Does governance slow the agents down? Who owns the logs and data? What does it cost? ## Other AI & Agents services. ## Let’s talk. Tell us about the company and what it needs. A senior lead takes it from there. A senior lead replies within one working day. --- Source: https://twistag.com/ai-and-agents/agent-governance