Sagentix Cyber & AI · AI Agent Workspace Readiness Check
Your AI agents need rules
before they need more access.
Your teams are starting to ask artificial intelligence (AI) agents to read company systems, draft work and take actions. Before an agent touches customer or employee data, your board, your auditor or your largest customer will ask two questions. What can the agent see, and who approves what it does?
The Readiness Check answers both, in writing, for every use you plan. It takes up to six weeks and two 90-minute workshops of your time.
Why now: rules with dates on them
Five dated rules can reach a Canadian company that uses AI, depending on where it operates and whom it serves. Each line links to the official text.
Quebec Law 25 — s. 12.1 of the private-sector privacy act
Companies subject to Quebec’s private-sector privacy act
In force
Tell a person when a decision about them is based exclusively on automated processing of their personal information, no later than when you inform them of it, and let them present observations to a staff member who can review it.
Source: Commission d’accès à l’information du QuébecOntario Employment Standards Act, 2000 — s. 8.4
Ontario employers with 25 or more employees (O. Reg. 476/24)
Since 1 January 2026
A publicly advertised job posting must state that the employer uses artificial intelligence to screen, assess or select applicants.
Source: Ontario e-LawsEuropean Union (EU) AI Act — Article 50(2), machine-readable marking
Companies whose AI products reach people in the EU
2 December 2026
Providers of systems that generate text, image, audio or video, placed on the market before 2 August 2026, must mark that output as artificially generated.
Source: Regulation (EU) 2026/1744, EUR-LexOffice of the Superintendent of Financial Institutions (OSFI) — Guideline E-23, Model Risk Management
Federally regulated banks, insurers and trust companies
1 May 2027
The definition of a model includes artificial intelligence and machine-learning methods, so AI agents that produce results come under model risk management.
Source: OSFIEU AI Act — high-risk uses listed in Annex III (hiring, credit, education and others)
Companies whose AI is used in the EU for these purposes
2 December 2027
Risk management, data governance, logging and human oversight duties apply to these systems from this date, moved from 2 August 2026.
Source: Regulation (EU) 2026/1744, EUR-LexOn 1 May 2026 the Canadian Centre for Cyber Security and five allied agencies published Careful adoption of agentic AI services. It is guidance, not law. It asks for least privilege, human approval before an agent takes a high-impact action, and no agent write access to logs. It also says the system designers or operators decide when approval is required, never the agent.
What the Readiness Check covers
Five steps, one fixed scope. You receive a written result at each step.
1. Use register
Every intended use, with its owner, the systems it connects to and the sensitivity of the data it reads.
2. Rule triage
For each use, which of the rules above apply and what each one asks of you. A use that touches hiring or a decision about a person is tagged here.
3. Data zones
Which data may reach which agent, and which uses wait for stronger controls.
4. Five board questions
Inventory, accountability, risk appetite, vendor terms and staff use, each answered or flagged.
5. Go/no-go memo
The uses that can start now (read-only, low-sensitivity data) and the conditions on the rest.
Price
A fixed price, stated on the call before any work starts. It is credited in full against the Governance Pack if you go on to it. How this practice is priced
What comes next, if you want it
The Governance Pack writes the rules your platform enforces, for up to five connected systems.
- An AI-use policy and a one-page staff card
- An approval rulebook: what each agent may read and change, and who approves
- A logs and records schedule, with a named reader for every log
- A crosswalk to the rules above, ISO/IEC 42001 and the NIST AI Risk Management Framework, ready for an auditor or a customer questionnaire
A Quarterly Review then re-reads the approval rules and samples the logs, so access widens only when the evidence shows the controls work.
We tested the controls ourselves
Before writing this offer we ran an open-source agent workspace on our own systems. The agent’s code changes waited behind an approval step. A scheduled task it created stayed switched off until a person turned it on. Every step listed what the agent read, and the model cost showed live: about US$0.05 for both test runs.
Controls like these exist on most agent platforms. They protect nothing until someone writes the rules behind them, and that is the job.
We govern the platform you chose; we do not choose it for you. We map rules and write controls; legal interpretation stays with your counsel.
Which of your AI uses can start on Monday?
Thirty minutes. Bring the list of uses your teams want. We say which rules touch them and what the Readiness Check would cover.