---
name: agent-roll-call
description: Builds a living register of every AI agent, copilot, automation with an LLM step, and AI feature switched on inside vendor software, assigns a named human owner to each, scores risk, and runs a trace-back test on the riskiest decisions. Use whenever a founder or operator mentions agent inventory, agent sprawl, AI governance, the Stop Rogue AI Act, AI insurance exclusions, human in the loop, AI audit trails, or asks "what AI is running in my business?"
---

# Agent roll call

## Purpose
Help a founder produce an accurate, plain-language inventory of the AI acting inside their company, and prove they can explain what it does and why.

## Step 1: Discover
Ask the user to list everything in these buckets. Prompt them bucket by bucket and do not move on until each is answered or marked "none."
- Agents the team built: Claude Projects, custom GPTs, code-based agents, n8n, Zapier or Make flows with an LLM step
- AI assistant seats: Claude, ChatGPT, Microsoft 365 Copilot, Gemini
- AI features turned on inside existing vendors: ERP, CRM, help desk, HR, accounting, email
- Coding agents with repo, CI or deploy access
- Anything that can send messages, move money, change records or talk to customers

## Step 2: Onboard each agent like a hire
For every item, capture:
- Agent ID (AGT-001, AGT-002...)
- Plain-English job description in one sentence
- Human owner: a named person, never a team or vendor
- Systems it can read
- Systems it can write to or act in
- Data it touches: customer personal data, financial, health, source code, or none
- Decision rights: suggest only, act with approval, or act alone
- Where its activity is logged, or "no log"
- Date onboarded and next review date

## Step 3: Score risk
Start at 0 and add:
- +2 if it can act alone on anything external (customers, money, production systems)
- +2 if there is no activity log
- +1 if it touches regulated or sensitive data
- +1 if the owner is missing or is a team
- +1 if it is a vendor-embedded AI feature nobody has reviewed
Tiers: 0 to 1 = Low, 2 to 3 = Watch, 4 or more = High.

## Step 4: Trace-back test
For each High agent, pick its most consequential recent action and answer:
1. What did it decide or do?
2. What inputs, sources or data did it use?
3. What instructions or prompts drove it?
4. Who approved it, or who should have?
5. Could you show this chain to a customer, insurer or judge today?
Any "don't know" is a FAIL. Write the specific fix next to it.

## Step 5: Output, in this order
1. A short summary with counts by tier
2. The register as a Markdown table with all Step 2 fields plus score and tier
3. Trace-back results for every High agent
4. Top five fixes, ranked by risk removed per hour of effort
5. A one-line reminder of the next 30-day review date

## Rules
- "The agent decided" is never an acceptable trace-back answer.
- Never assign ownership to "the team," "IT" or "the vendor."
- Flag unknowns instead of guessing.
- Write for a reader who might be a board member, an insurer or counsel.
- This is an operational checklist, not legal advice. Recommend counsel for regulatory questions.