How to write an AI agent policy your employees will read

Adoption is ahead of the rules

The gap in ISACA's numbers is wide. The 2026 poll, with more than 3,400 respondents worldwide, found 38% of organizations with a formal, comprehensive AI policy, up from 28% a year earlier. Another 30% have a limited policy, and 25% have none.

Agents make that gap more expensive than it was with chat assistants. A chat answer is read by one person before anything happens. An agent with access to the CRM, the inbox, and the file share can act before anyone reads anything. Employees are making decisions about what to connect and what to let it do, and without a policy, each of them decides alone.

Long policies fail without anyone noticing

A 15-page acceptable-use document can be correct in every line and still change nothing. People skim it once during onboarding, sign, and go back to work. When a real question comes up, such as whether to let an agent send a reply without reading it, nobody goes back to page 11.

Plain writing helps. The UK government's guidance for GOV.UK cites research in which "80% of people preferred sentences written in clear English," with the preference growing as the subject gets more complex. Its practical rules are short paragraphs and sentences under 25 words. An agent policy is a complex subject read by busy people, which makes it a good candidate for the same rules.

Five things belong on the page

A policy people use answers the questions that come up while they work. In our experience that comes down to five:

1. Which agents and tools are approved, and where to request a new one.
2. What data may go into an agent, and what may not.
3. What an agent may do without asking, what needs a person's approval first, and what is off limits.
4. Who is responsible for what an agent produces.
5. How to report a mistake or a suspected problem, and what happens next.

Each answer should come with an example. "Customer personal data may not be shared with unapproved tools" is correct but hard to apply. "Do not paste a customer's support history into a personal ChatGPT account; use the company assistant, which is connected to Zendesk" is a rule someone can follow on a Tuesday afternoon.

A one-page example

Here is a starting draft you can adapt. Replace the bracketed parts with your tools and contacts.

AI agent policy  (owner: [name], reviewed: [date])

1. What you can use
   Approved agents and tools are listed at [link]. To request a new one,
   use [form]. Do not connect company accounts to unapproved tools.

2. What you can share
   Agents may use company data your role already gives you access to.
   Do not put customer personal data, credentials, or legal documents
   into any tool that is not on the approved list.

3. What agents may do
   Without asking: read, search, summarize, and draft.
   With your approval first: send messages outside the company,
   change customer records, issue refunds, change anyone's access.
   Never: delete data, move money, or grant themselves access.

4. Who is responsible
   You are responsible for anything an agent sends or changes on your
   behalf, the same as if you had done it yourself. Check before you approve.

5. If something goes wrong
   Report it in [channel] or to [contact] within the same day.
   Reporting a mistake will not get you in trouble. Hiding one might.

The third section follows the impact-and-reversibility model from our post on agent approvals. The fourth section depends on knowing whose behalf an agent is acting on, which the permissions post covers.

Regulation now expects some of this

Two frameworks point in the same direction. The EU AI Act's Article 4 on AI literacy has applied since 2 February 2025. It was amended by Regulation (EU) 2026/1744 in July 2026, and now asks providers and deployers to "take measures to support the development of AI literacy of their staff," while stating that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual." ISO/IEC 42001, the AI management system standard, requires top management to establish a documented AI policy and communicate it within the organization (clause 5.2).

A one-page policy that people read is a reasonable part of meeting both. It is not legal advice, and your counsel should confirm what applies to you. But a short policy that people have read is easier to defend than a long one nobody has.

A policy works better when the tools enforce it

Writing "agents may not delete data" helps. Making sure no agent has a delete permission helps more. The closer the policy sits to what the tools allow, the less it depends on memory.

That is the part Metorial handles. Approved integrations sit behind one Magic MCP connection instead of being wired up by each employee. Access control uses the people and groups from your identity provider and can narrow each agent by tool, provider, or action, so section three of the policy becomes a setting that agents cannot ignore. Tracing records which agent did what and on whose behalf, which is what section five needs when someone reports a problem.

Review it every quarter

Agents, tools, and the people using them change faster than most policies. Put a named owner and a review date at the top of the page, and check it every quarter against two things: the incidents and questions reported since the last review, and the list of tools people have asked for. If people keep asking the same question, the answer belongs on the page.

Sources

1. ISACA, "AI Use Accelerates While Governance and ROI Lag, Says New ISACA Research" (AI Pulse Poll 2026, published 2026-05-05; accessed 2026-11-02)
2. GOV.UK, Writing to GOV.UK standards: Use clear language (accessed 2026-11-02)
3. EU AI Act, Article 4: AI literacy (consolidated text; accessed 2026-11-02)
4. Regulation (EU) 2026/1744 (Digital Omnibus on AI) (amends Article 4; accessed 2026-11-02)
5. Presencis, ISO/IEC 42001 clause 5.2: AI policy (summary of the clause; accessed 2026-11-02)