The Agent Deployment Addendum

Before the detail — Artifact: the addendum, accepted when all eight rows are evidenced. Status of what follows: guidance (CISA and partners, April 2026); no US mandate.

Prompt first: draft the addendum, leave every cell empty

Meridian is proposing MU-AI-011, a crew-dispatch agent: it reads the
feeder outage predictor's ranking (MU-AI-002), drafts crew
pre-positioning work orders in the work-management system, and can
send the dispatch notice. No owner assigned yet.

Draft the AGENT DEPLOYMENT ADDENDUM from this checklist - one row per
item, columns: item / what would count as evidence / where that
evidence lives today / owner:
  1. register entry with an accountable owner
  2. its own identity; the credential's lifetime
  3. tool policy enforced outside the prompt - where the policy lives
  4. egress declared as an allowlist
  5. every action traceable to a session and a principal - a log line
  6. human approval for irreversible actions, enforced by the runtime
  7. halt procedure: tested date; proof the next action was denied
  8. attempt curve for indirect injection, safeguards on (Lesson 4.2)

Write NEEDS-OWNER in every evidence cell and every owner cell. Do not
invent a credential lifetime, a log format, a policy location, or a
tested date. Do not recommend whether to deploy.

The agent supplies the shape and the “what would count” column, which is public practice. It cannot know where Meridian’s gateway policy lives or when the halt was last rehearsed, and a plausible guess in either cell is worse than a blank one — a reviewer will read it as evidence.

The question the addendum answers

The record’s evidence table has a row that reads Agent deployment addendum (4.3) — n/a for non-agents. This lesson is that row. It answers one assurance question: may this agent be deployed at all? It does not answer what the agent may do per action — the capability envelope, parameter limits, expiring approvals, compensation and rollback of an action already taken, kill-switch mechanics, and action receipts belong to the next training in this series, Guarded Automation. The addendum asks only whether each exists and is evidenced, and stops there.

The maps from Lesson 4.1 say why the question stands alone: OWASP (the community that publishes application-security top-ten lists) ranks Excessive Agency third in its 2026 LLM Top 10, and its Top 10 for Agentic Applications (December 2025) gives ten categories that only make sense for a system with tools. The cost case is blunter: a one-page “not yet” is cheaper than a cancellation after the integration is built.

The checklist, and what counts as evidence

Each row distinguishes evidence from a description of a mechanism. A reviewer opens evidence; a description is a claim.

Rows 3 and 4 carry the incidents that named them: a zero-click exfiltration through an enterprise assistant’s document ingestion showed that untrusted content plus open egress is the path out, and a CI action leaked secrets when untrusted input, secrets, and egress met in one run. Row 6 carries a subtler one: a vendor’s 2026 containment write-up reported that roughly 93% of permission prompts were approved and fatigue appeared within weeks, so its evidence is not that a prompt appears but that the irreversible set is small and named, with HITL (a human approves before the action happens) recorded per approval.

The halt is a field, not a sentence

Row 7 is the one most organizations cannot fill — 1.1’s survey counted how few can say how fast they could halt a system at all. The record therefore carries the halt as a condition row with one tested date and the evidence that, on that test, the next attempted action was denied.

The wording matters. The addendum does not ask for a slogan about how fast revocation happens; it asks for a declared revocation objective, proven by showing the next attempted action is denied. How the halt is built — kill switch, credential revocation, gateway rule — is the next training’s. Whether it has been rehearsed, and when, is this one’s.

The seam: registries and gateways, then the federal guide

The commercial starting practice is an agent registry with a named owner per agent and a gateway that enforces the tool policy outside the agent’s code, with per-agent logs — rows 1, 3, and 5 come straight from it. The federal delta is the guide “Careful Adoption of Agentic AI Services” (April 30 2026) from CISA (the US cyber defense agency) and its Five Eyes (the five-nation intelligence alliance) partners: per-agent cryptographic identity, short-lived credentials, allowlisted verified tools, and human approval for high-stakes actions — rows 2, 3, and 6, stated as expectations. The handoff artifact is the addendum itself, attached to the record.

What is not equivalent: the federal guide names verifiable agent identity and human checkpoints; no US mandate requires them. It is guidance, and Meridian’s federal seat inherits it only where the contracting officer wrote it into the task order — a question for the contract, not the reviewer. Treating the guide as the floor anyway is a choice with a cost — identity and runtime-approval engineering are funded work — and it buys an addendum that reads the same to a commercial auditor and a federal assessor.

Stop and escalate when row 3, 6, or 7 has no evidence — a tool policy that lives only in the prompt, an irreversible action nobody approves at the runtime, or a halt nobody has rehearsed. The answer is “not yet,” and it is the release owner’s to give; a reviewer who fills the cell with a mechanism description has signed for something that does not exist.

Practice status — among organizations deploying tool-using agents, commercial and federal

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

The addendum is decision-ready when eight things exist and each is evidenced by something a reviewer can open — it feeds the release gate; it does not by itself authorize deployment: a registered owner, a credential lifetime you can read, a tool policy outside the prompt, an egress allowlist, a log line per action, runtime-enforced approval for a small named set of irreversible actions, a halt rehearsed on a date with the next action shown denied, and an attempt curve with safeguards on. Building the envelope, the receipts, and the kill switch is the next training’s work; this page asks only whether they exist. Module 5 opens with the impact assessment the record was missing — the people at the other end of every system on the register.

LEADERSHIP DECISION   no agent deploys without the eight-row
                      addendum attached to its record; "not yet"
                      is a valid answer and costs one page
PRACTITIONER ACTION   locate the evidence for each row - a
                      location, a log line, a date - and write
                      NEEDS-OWNER where it does not exist
SUCCESS MEASURE       every deployed agent's halt rehearsed with
                      a tested date on the record within the
                      quarter - calendar time