Completed example: Internal contract review agent

AGENT NAME

The display name used in the agent registry, admin center, or internal inventory.

Contract Clause Review Agent (registry display name: LEGALOPS-CLAUSE-REVIEW-01)

BUSINESS PURPOSE

One to three sentences explaining the problem this agent solves and the workflow it supports.

Reviews inbound third-party contracts against the organization's standard clause library and flags non-standard indemnity, limitation of liability, termination, and data protection provisions for attorney review. Reduces first-pass review time on high-volume vendor agreements. The agent recommends. It does not approve, reject, or communicate with counterparties.

AUTHORIZED ACTIONS

List each action the agent is permitted to take, using precise language tied to specific systems or workflows.

Read contracts placed in the Legal Intake document library. Compare clause text against the approved standard clause library. Produce a flagged-clause summary and attach it to the intake record. Notify the assigned attorney in the legal operations channel when a summary is ready.

EXPLICIT PROHIBITIONS

List what the agent must not do. If this field is blank, the authorization record is incomplete.

Must not send communication of any kind to a counterparty or any external address. Must not modify, redline, or delete contract text. Must not mark a contract approved, rejected, or executed. Must not access the executed contracts archive, the litigation hold library, or any matter under privilege designation. Must not process a contract flagged as containing personal data of EU data subjects until the DPA review path is added to this record.

DATA ACCESS SCOPE

Name the systems, libraries, sites, datasets, or applications the agent can read from and write to.

Read from the Legal Intake document library and the Standard Clause Library. Write only to the flagged-clause summary field on the intake record. No access to finance, HR, customer, or executed-contract systems.

BUSINESS SPONSOR

Full name and title of the named human the organization maps from the Sponsor role in Microsoft Entra Agent ID. The platform Sponsor can be a user or supported group accountable for purpose, lifecycle decisions, and access reviews; this record requires one named accountable human for the business authorization decision.

Priya Raman, Director of Legal Operations. Named individual mapped from the Sponsor role in Microsoft Entra Agent ID. Accountable for whether this agent should exist, what it is authorized to accomplish, and whether it is renewed or retired.

TECHNICAL OWNER

Full name and title of the administrator responsible for this agent's operational management, permissions, and identity configuration. Maps to the Owner role in Microsoft Entra Agent ID. Not the approving authority.

Daniel Osei, Senior Administrator, Collaboration Platforms. Maps to the Owner role in Microsoft Entra Agent ID. Responsible for permissions, identity configuration, and operational management. Not the approving authority.

REVIEW TRIGGER CONDITIONS

Describe the events that require re-authorization, such as a change in purpose, data access, ownership, regulation, or an incident.

Any change to the standard clause library. Any expansion of the document libraries the agent can read. Departure or role change of the Business Sponsor or Technical Owner. Any change to the organization's data protection obligations. Any incident in which a flagged-clause summary is found to have missed a non-standard provision that reached signature.

NEXT SCHEDULED REVIEW DATE

Set the date when the organization will confirm the record is still accurate and complete.

February 2, 2027. Six months from authorization, aligned to the legal operations control review cycle.

AUTHORIZATION SIGNATURE

Capture the approving person's name, title, and date. This should be the accountable business owner, not only the developer or IT administrator.

Priya Raman, Director of Legal Operations, August 4, 2026. Signed as Business Sponsor before first execution. Record stored in the legal operations governance repository with version history enabled and creation timestamp preserved.

TRIGGER DEFINITION

The timer, schedule, or external event that starts an unattended run, recorded in the form the platform stores it, together with the action it starts.

Recurrence schedule, daily at 02:00 local, configured in the agent's automation settings. Starts an unattended pass over every contract added to the Legal Intake library in the preceding twenty-four hours and produces a flagged-clause summary for each.

CONSEQUENCE OWNER

Full name and title of the person accountable for what the unattended runs cause. Distinct from the Technical Owner who configured the trigger and from the Business Sponsor who approved the agent.

Priya Raman, Director of Legal Operations. Accountable for what the unattended overnight runs produce, including a summary that misses a non-standard clause on a contract that proceeds to signature the following morning. Distinct from Daniel Osei, who configured the schedule.

ACTIVATION JUSTIFICATION

One sentence stating why this run must occur without a person present, and what fails if it does not.

Attorneys begin review at the start of business and the summary must already exist. Running the pass only when an attorney opens the file would move the wait time into the review window and remove the benefit.

TRIGGER REVIEW DATE

The date the organization will confirm the run still needs to exist. Separate from the agent's Next Scheduled Review Date, because an agent can remain justified while a schedule attached to it no longer is.

November 3, 2026. Set earlier than the agent's own review date because the overnight window is the part of this deployment operating without a person present.

TWO OPERATING RULES AS APPLIED

If Priya Raman leaves the organization, the 02:00 schedule is treated as an unauthorized deployment from her departure date and is suspended until a new Consequence Owner signs. Reassigning the agent to a new owner does not carry the schedule. Her offboarding checklist names this trigger explicitly and requires reassignment before final-day access is removed.