Business case, governance and compliance for agent programs

0:00 From pilot to program

A successful pilot feels great. But one pilot isn't a program. To scale agents across a team or a company, you need a business case leaders believe, governance that keeps risk proportionate, and compliance with the rules in every market you work in. In this lesson you'll get a template for each.

0:23 The business case

Start the business case with your own measurements. Time real staff doing the task to get a manual baseline. Add up agent costs: tokens, browser infrastructure and engineering upkeep. Then measure human oversight, the minutes spent reviewing, approving and fixing. Net time saved is baseline minus oversight. Add the quality impact, errors caught or avoided. List your top risks and controls. Present ranges, state assumptions, include the cost of doing nothing, and an exit plan if a vendor changes terms.

0:58 Why it matters

Why does this matter? Because pilots are easy to start and hard to scale. Without a credible business case, budget dries up. Without governance, one incident can shut the whole program down. And without compliance work, legal or IT teams will stop projects late, when changes are expensive. Doing this work lightly but properly is what turns a promising experiment into a lasting capability.

1:26 Ten branches, one kitchen standard

Here's an analogy. Scaling agents without governance is like a restaurant opening ten new branches without recipes, hygiene rules or a manager on shift. The first branch worked because the founder was there every night. The next nine drift. Governance is the recipe book, the hygiene checklist and the shift manager: light enough that people follow it, strong enough that quality holds everywhere.

1:53 Simple example (illustrative)

A simple example of an honest business case, with illustrative numbers. Campaign QA takes a coordinator about four hours a week today. The agent version needs about forty-five minutes of review. Net saving: roughly three hours a week, or about twelve a month. Agent costs, including tokens, browser infrastructure and upkeep, work out to a few hours' equivalent a month. And it caught two expired offers last month. That's a small, credible case. Now repeat it with your own measured numbers.

2:28 The agent register

Next, governance, and it can be light. Keep an agent register with one entry per workflow: the owner, the purpose, the risk tier, systems and data accessed, the pinned model version, the approvals required, the evaluation gate, log retention, the last review date, and the kill switch. If you can't fill an entry in, that workflow isn't ready for production.

2:54 Governance rules

Some rules make governance work. Let risk tiers drive controls: read-only work needs an owner and logs, money movement needs security review, approvals and limits. Any change to the prompt, model, harness or permissions re-runs the golden set. Every workflow can be stopped in one step. Define what counts as an incident and who gets called. And review higher-risk workflows every quarter. If your organization needs formal alignment, the NIST AI Risk Management Framework and ISO 42001 give you a shared vocabulary.

3:30 Compliance, part 1

Now compliance. This is general information, not legal advice. Screenshots and extracted data can contain personal data, so GDPR and UK GDPR principles apply: lawful basis, minimization, retention limits, and an impact assessment for higher-risk processing. Saudi Arabia's PDPL and the UAE's data protection law raise similar questions, including cross-border transfers to your model provider. Check your vendors' retention and training terms. Respect site terms and never bypass authentication or bot defenses.

4:01 Compliance, part 2

Keep going. Agents that publish, send messages or change prices can create misleading claims, so keep humans approving customer-facing output. The EU AI Act's transparency obligations under Article 50 apply from the second of August 2026, including telling people when they're interacting with an AI system in certain situations and marking synthetic content. Check whether your agents reach people in the EU, and follow later guidance. And in some countries, automating or monitoring staff work needs consultation.

4:34 Worked example: 1 to 12 workflows

Here's scaling in practice. An agency with offices in Lahore and Dubai grew from one QA pilot to twelve workflows in six months. Each had a one-page business case from timed baselines. All lived in a shared register. Every change passed the golden set. Accounts were per client, screenshots were kept thirty days, and client data went through zero-retention API settings. Two workflows were retired because oversight cost more than they saved, and the register made that obvious.

5:08 Make the right way easy

Governance only works if people actually follow it, so make the right way the easy way. Provide a template repository with the harness, the logging and the approval gate already wired in. Provide pre-approved sandbox environments. Keep the register in a simple shared table. When starting a new workflow properly takes an afternoon, people do it properly. When it takes a month of forms, they quietly run agents in personal browsers instead.

5:39 Incident readiness

Plan for the day something goes wrong. Define what counts as an agent incident: an unapproved external action, exposure of personal data, a spend above limits, or a client-visible error. Decide who gets alerted and who can pull the kill switch. Write down how you'll notify affected clients or individuals, and when regulators might need to be told under data protection law. Then hold a short blameless review and feed the lessons into your golden set.

6:12 Three mistakes

Three common mistakes. First, business cases built on vendor marketing claims rather than your own measurements. Second, governance so heavy that teams go around it with personal accounts and consumer tools. Third, forgetting retention, so screenshots full of personal data pile up for years. Avoid those, and your program can grow without nasty surprises.

6:35 Try this now

Try this now. Take your best agent use case and write two things. First, a one-page business case with your measured baseline, the agent's cost, the human oversight time, the net saving as a range, the quality impact, the top risks and an exit plan. Second, an agent register entry with the owner, purpose, risk tier, systems and data accessed, model version, approvals, evaluation gate, retention and kill switch. Share both with one person from legal, IT or finance and ask what's missing.

7:11 Recap

Recap. Build business cases from measured baselines and net savings. Keep an agent register with an owner, tier and kill switch for every workflow. Tie controls to risk, gate changes on your golden set, and check data protection, vendor terms, site terms and AI rules. Your next step: write a one-page business case and register entry for your best use case. Next up, the capstone: building a safe website-audit agent.