{"resourceId":"columbia-county-or-draft-ai-policy-agent-controls-2026-11-02","versions":[{"version":"external-044b957efa8bae5a218342f47eddea50928c5a2e1cfcf14d3b33dc672e53750c","resource":{"id":"columbia-county-or-draft-ai-policy-agent-controls-2026-11-02","title":"Columbia County, Oregon: draft county-wide AI policy requires approved, logged AI agents with human confirmation before actions and vendor terms allowing the county to suspend use","organization":"Columbia County, Oregon (Board of Commissioners memo)","sector":"Local government (county)","geography":"Columbia County, Oregon, U.S.","publishedAt":"2026-11-02","publicationDate":"2026-11-02","eventDate":"2026-11-04","sourceName":"Columbia County Board of Commissioners agenda materials","sourceLabel":"Local government memo","sourceUrl":"https://www.columbiacountyor.gov/media/Board/BOCC-meeting-agendas/11-4-26/Memo%20to%20Board%20-%20AI%20Policy%20Draft%20highlights.pdf","evidenceClass":"government-evaluation","outcomeClass":"emerging","topics":["governance-procurement","developers-agents","data-security"],"finding":"A Nov. 2, 2026 staff memo for the Nov. 4 Board of Commissioners meeting summarizes a draft county-wide AI policy, built after reviewing nine policies (eight local, one state) from an Oregon government IT association and Oregon state guidance. AI agents must be specifically approved, have limited access and a named county owner, keep activity logs, and get human confirmation immediately before actions such as sending, deleting, changing access or initiating a transaction. Agent logs may be public records. Vendors must disclose AI functions, sub-processors and material changes, and contracts must address the county's ability to suspend or end use. It is a draft, not an adopted policy, and is not linked to any vendor.","sledRelevance":"Direct: a current county-level example of the controls agencies are writing into AI policy, which is the buyer-side context for CrowdStrike's Nov. 3 agent controls. Transferability is limited to one small county's draft, though it was built from nine peer policies.","evidence":"Primary local government document; a policy draft summary, not an evaluation of outcomes.","architectureImplications":"Human confirmation before each consequential action implies agent workflows must pause for approval, not just be stoppable after the fact.","governanceImplications":"Named owners, approved-use inventory, records retention for agent logs, and a governance body for higher-risk uses.","securityPrivacyImplications":"Confidential data only under narrow written exceptions; personal and unapproved consumer AI tools prohibited.","caveats":"Draft summary only; final policy text and adoption status not confirmed; one county.","streamIds":["crowdstrike"],"roles":{"sales":"Buyer requirements are the framing point. This county draft shows what local governments are starting to demand of AI agents: named owners, activity logs, human confirmation before actions, and contract terms letting the county suspend use. Interpretation: these map closely to agent kill-switch and observability features, so sellers can ask customers which requirements they must evidence. The memo names no vendor and describes a draft, so it cannot support claims that any product satisfies the policy.","engineering":"Control mapping is the framing point. The draft requires approval, least access, logs, and human confirmation immediately before consequential actions. Interpretation: pre-sales should note that a kill switch stops an agent after the fact, while this policy also requires pre-action approval, which is a workflow design issue rather than a security product feature. Proof of value should show both: logged pre-action confirmation in the agent workflow and a working suspend capability.","delivery":"Records and ownership are the framing point. The draft treats agent logs as possible public records retained in county systems and requires a named owner for every agent. Interpretation: delivery should confirm log storage location and retention before deploying agent tooling, and register each agent in the approved-use inventory. Proposed acceptance criteria include an owner and log retention set for every agent. Risks include logs held only in vendor clouds and approvals that are too generic."},"roleDetails":{"sales":{"customerProblem":"Counties adopting AI policies need tools and contracts that let them prove agent oversight, logging and the ability to suspend use.","stakeholders":["County IT director","Board of commissioners","Risk management committee","Records officer"],"discoveryQuestions":["Has your board adopted or drafted an AI policy?","Does it require human confirmation before agent actions?","Do your contracts let you suspend AI features?"],"valueHypothesis":"Agent controls that produce logs and a suspend capability may help counties meet policy requirements; the memo provides no evidence for any product.","potentialEngagement":"A policy-to-control mapping session against the county's draft AI policy.","unsupportedClaims":["Any product meets this policy","The policy has been adopted","Requirements are typical of all counties"]},"engineering":{"fit":"Counties and similar agencies drafting AI policies that cover agents.","architectureIntegration":"Agent workflows need pre-action confirmation steps plus logging and suspend controls retained in county-controlled systems.","prerequisites":["Approved-use inventory","Named agent owners","County-controlled log storage"],"constraints":["Draft policy may change","Public-records retention applies to agent logs","Small IT staff"],"security":"Restricts confidential data to approved systems and bans unapproved consumer AI tools.","proofOfValue":["Demonstrate logged human confirmation before an agent sends or deletes","Demonstrate suspending an agent and retaining its logs in county systems"]},"delivery":{"work":"Register agents, assign owners, configure logging and retention, and set up suspend procedures.","dependencies":["Final policy adoption","Records retention schedules","Vendor contract terms"],"ownership":"County IT, with departments accountable for their uses and the Risk Management Committee's security subcommittee for higher-risk uses.","skillsAdoption":"Staff learn to confirm specific agent actions rather than approve generically.","governanceCheckpoints":["Board policy adoption","Higher-risk use review by the governance body"],"acceptanceCriteria":["Proposed: every agent has a named owner and inventory entry","Proposed: agent logs retained in county systems per schedule"],"risks":["Logs held only in vendor systems","Approval fatigue","Policy text changing before adoption"]}},"retrievedAt":"2026-11-03T22:08:17-06:00","enrichedAt":"2026-11-03T22:10:51-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Notes AI can improve accessibility; requires qualified personnel to review outputs.","procurementImplications":"Vendors must disclose AI functions, data use, sub-processors and material changes; contracts must address suspension or termination of use.","operatingModelImplications":"IT-maintained approved-use inventory, departmental accountability, and a governance body for non-standard uses.","sourceVerification":{"openedUrl":"https://www.columbiacountyor.gov/media/Board/BOCC-meeting-agendas/11-4-26/Memo%20to%20Board%20-%20AI%20Policy%20Draft%20highlights.pdf","referenceExcerpt":"Agents must be specifically approved, have limited access and a named County owner, maintain activity logs, and obtain human confirmation immediately before every action","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}