Every production agent needs a control document, and most have none. The org chart made human accountability legible — every role has an owner, a scope, and a reporting line. The bill of materials and the data sheet made a physical part sourceable and auditable — every component traces to a supplier, a spec, a tolerance, and a test. Autonomous work running against production systems has no equivalent, and that absence is exactly why nine in ten enterprises have adopted AI while single-digit percentages have agents in production. An agent without a control document is an anonymous actor with production access. The document that fixes that is the agent card.
What separates a demo from a deployable capability
A pilot proves an agent can do the work once. A card is what makes the enterprise willing to let it do the work ten thousand times, against systems of record, with a CFO's name on the result. The difference is not model quality or prompt cleverness. It is whether the agent's owner, purpose, permissions, approval triggers, evidence, tests, and value claim are written down in a place that change management and audit can read — or whether they live in the head of the engineer who built it.
Tribal knowledge does not survive that engineer's next sprint, let alone an audit. Configuration does. The agent card is the configuration: the single record that turns a clever automation into a governed capability the enterprise can fund, audit, and scale.
The agent card's fields
The card records the same facts a bill of materials records about a part, adapted for autonomous work. Each field controls a specific failure mode.
| Field | What it controls |
|---|---|
| Owner | Accountability — a named human answers for the agent's behavior and its value claim |
| Purpose | Scope — the one job it does, so capability creep is visible and reviewable |
| Persona | The seat it serves (CFO, CIO, operator, builder), which sets the bar for outputs and review |
| Process | The value stream it acts in (L2C, S2P, F2F, P2P, R2R), so impact maps to a domain the business already manages |
| Provider / model | Model-agnostic routing — swap providers as the frontier moves without re-engineering the workflow |
| Tools | The exact actions it can take, and the ones it cannot — the boundary of its blast radius |
| Data products | The trusted inputs it reads, sourced and dated, not whatever it can reach |
| Risk tier | The control intensity, approval depth, and review cadence the agent is held to |
| Human-approval triggers | The actions that stop for a person before they commit — posting, payment, material change |
| Outputs | The artifacts it produces and where they land, so downstream consumers know what to trust |
| Eval pack | Golden cases, policy tests, grounding tests, adversarial cases, and regression — the proof it still works |
| Control pack | Approvals, segregation of duties, evidence capture, restricted actions, audit trail |
| Value card | Baseline, target, value lever, owner, and attribution method — the funding instrument |
The eval pack, control pack, and value card are themselves named artifacts in the harness, not adjectives. The card is where an agent declares which ones it carries.
Configuration, not tribal knowledge
The card is a file, versioned alongside the agent. Here is the manifest for a Month-End Closer running record-to-report:
agent_id: koko.r2r.month_end_closer
owner: controller@enterprise.com
persona: CFO
process: record_to_report
risk_tier: high # touches the ledger; posts journals
provider_options: # model-agnostic; route to cheapest that clears the bar
- anthropic/claude-sonnet
- openai/gpt-tier
tools:
- ledger.read
- subledger.reconcile
- journal.draft
- journal.post # gated below
data_products:
- gl.trial_balance
- subledger.ap_ar
- close.checklist
human_approval:
required_for:
- journal_posting
- material_adjustment
outputs:
- close.journal_entries
- close.reconciliation_evidence
- close.exception_report
value_levers:
productivity: { baseline: close_days, target: -2_days }
risk: { baseline: audit_adjustment_rate, target: down }
eval_pack: r2r.month_end.v4 # golden closes, policy tests, adversarial entries
Anyone can read who owns it, what it touches, what it cannot do without a human, and how its value is measured — without finding the engineer. The two human-approval triggers are the line between an agent that drafts the close and one that commits it. Drop the card and those triggers become a code comment nobody audits.
How a card moves from draft to retired
The card is the unit of lifecycle. An agent moves through states, and the card records which one it is in and what changed to get there:
- Draft — fields proposed, owner assigned, not yet executable.
- Demo — runs once in a sandbox to prove the task is possible.
- Beta — runs on real data under heavy supervision, eval pack forming.
- Enterprise pilot — runs in one business unit under full control pack, value card baselined.
- Production — runs at scale, approvals live, evidence flowing, value tracked against target.
- Retired — decommissioned, card archived as the audit record of what it did and why it stopped.
Every component is versioned independently — prompt, skill, model, tool, data product, policy, eval pack. A model swap, a tightened policy, or a new golden case is a version bump on the card, not a silent edit in production. Change management gets a diff; audit gets a history.
Why it is a control document, not documentation
Documentation describes a system after the fact. A control document governs it before the fact, and the agent card does four control jobs at once.
It fixes ownership: a named human answers for the agent, so there is no orphaned automation with production access. It delivers auditability: the control pack and outputs mean every consequential action leaves evidence a reviewer can trace. It enforces change management: versioned fields and gated transitions mean nothing reaches production without passing its eval pack and clearing its approvals. And it is the precondition for the value card — and therefore for scale funding. No card, no value card; no value card, no scale funding. That rule is what converts a pile of experiments into a managed portfolio a board can underwrite.
The enterprise question is no longer "Can an agent do this task?" It is "Can we let this agent change a production outcome, prove it stayed in bounds, and show what it was worth?" The card is the only place that answer can be written down — and the only thing that makes the next layer, value, fundable.
This is the second piece of The Harness Era, an eight-part series. The full-length analysis — the manifest in full, the field-by-field control rationale, and the lifecycle gates — is linked below. Next: Why CFOs Should Fund Agents Like Value Streams — how the value card on the agent card turns AI spend into an owned, compounding asset.