Do you keep a list of the AI agent tools employees use?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Can an employee connect an AI agent to a company system (code, chat, CRM, databases) without IT or security approving it?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

How do agents sign in to those systems?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Can an agent change or delete data (merge code, send messages, write to a database) without a person approving that action?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Could you show, for last month, which agent did what and on whose behalf?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Can agents reach systems that hold personal data about customers or employees, and is that documented?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Do you review MCP servers and AI plugins before people use them?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Are the AI vendors and MCP providers that receive company data covered by contracts?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Is there a written AI acceptable-use policy that employees have acknowledged?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

If an agent's credentials leaked today, could you cut off its access everywhere within an hour?

Answer for your organization. “Don’t know” is a fair answer.

Select an answer to continue. You can always go back.

Your answers are ready. Take a final look.

This report will reflect the answers you’ve shared. You can change any answer before grading.

1. 1
   Do you keep a list of the AI agent tools employees use?
2. 2
   Can an employee connect an AI agent to a company system (code, chat, CRM, databases) without IT or security approving it?
3. 3
   How do agents sign in to those systems?
4. 4
   Can an agent change or delete data (merge code, send messages, write to a database) without a person approving that action?
5. 5
   Could you show, for last month, which agent did what and on whose behalf?
6. 6
   Can agents reach systems that hold personal data about customers or employees, and is that documented?
7. 7
   Do you review MCP servers and AI plugins before people use them?
8. 8
   Are the AI vendors and MCP providers that receive company data covered by contracts?
9. 9
   Is there a written AI acceptable-use policy that employees have acknowledged?
10. 10
    If an agent's credentials leaked today, could you cut off its access everywhere within an hour?