CASE STUDY 4 Personal assistant – governance considerations Agent characteristics 1. Function 3. Predictability 4. Autonomy 5. AuthorityAssists users by organizing schedules, managing communication and coordinating Deterministic Non-deterministic2. Role Specialist Generalist Low High Low HighOperational context 6. Use case It operates in the personal productivity domain, managing tasks, communications and information across a user’s digital environment to support daily coordination and decision-making. 7. Environment Simple ComplexAgent characteristics Personal assistant – governance considerations Governance focuses on scaling oversight in line with the personal assistant’s autonomy, authority and environmental complexity. Unlike narrow task agents, a personal assistant operates across multiple platforms such as email, calendars, messaging and enterprise tools, raising questions about the extent of information it can access, interpret and act upon on behalf of the user. As integration deepens and authority expands (e.g. from drafting messages to sending them, or booking travel) governance mechanisms must increase.Key governance risks include data overreach, privacy violations, prompt manipulation and unauthorized actions such as unintended communication. Mitigation measures include least-privilege access, consent- based data sharing, input and output filtering, audit logging, and human approval for sensitive actions. Adaptive controls should reduce permissions upon detecting anomalies or policy breaches, supported by continuous monitoring and incident reporting. AI Agents in Action: Foundations for Evaluation and Governance 25

AI Agents in Action Foundations for Evaluation and Governance 2025