{"resourceId":"kent-ai-agent-governance-risks-dcost-20261021","versions":[{"version":"external-1bdf8a8c8e26f48119fef919b307b159de9807f3a3135d3d38663bbdf1c6bce9","resource":{"id":"kent-ai-agent-governance-risks-dcost-20261021","title":"University of Kent's AI team sets three governance tests for campus AI agent pilots: a named owner, a one-page data boundary and an agreed level of human oversight","organization":"University of Kent, AI@Kent team","sector":"Public university: AI platform engineering and governance guidance","geography":"Canterbury, England, United Kingdom","publishedAt":"21 October 2026 (AI@Kent blog)","publicationDate":"2026-10-21","eventDate":null,"sourceName":"AI@Kent (University of Kent blogs)","sourceLabel":"Institutional practitioner guidance","sourceUrl":"https://blogs.kent.ac.uk/aiteam/2026/10/21/three-risks-to-consider-before-using-ai-agents-in-education/","evidenceClass":"standards-guidance","outcomeClass":"cautionary","topics":["developers-agents","governance-procurement","data-security","operating-model"],"finding":"Kent's AI team names three governance risks for agent pilots. Accountability gaps: citing the Air Canada chatbot case, it says every agent needs a named accountable owner before launch. Data boundary breaches: each agent should have a one-page statement of what data is in scope, what is excluded, who can query it and what is retained. Autonomy creep: agree from the start whether a human is in the loop, on the loop or in command, and review it as the pilot changes. It proposes a D-COST review covering data, compliance, operations, strategy and technical build.","sledRelevance":"Concrete, low-cost controls that campuses opening agent building to staff can adopt now. Transferable to U.S. institutions, though written for a UK university context.","evidence":"Practitioner guidance from a university AI platform team, summarized from a webinar. No measured results. The page states the text was AI-generated from a transcript and human-checked.","architectureImplications":"Data boundary statements and oversight levels imply per-agent configuration of connectors, query permissions and retention.","governanceImplications":"Ownership before launch, a per-agent data boundary and a periodic oversight review form a minimal agent register entry.","securityPrivacyImplications":"Warns that connected systems let data move where it was never meant to reach; boundary statements are the proposed control.","caveats":"Guidance, not evidence of effectiveness. UK legal context. Blog views are not necessarily the university's official position.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: Kent's AI team offers a ready checklist for agent pilots, a named owner, a one-page data boundary and an agreed oversight level. Interpretation: institutions that have already opened agent building to staff can use this as a starting point for a governance engagement. Position help as applying such a checklist to existing agents. Do not present the framework as proven; Kent reports no outcomes.","engineering":"Engineering framing: each of Kent's controls maps to configuration. A data boundary statement should match actual connector scopes, query permissions and retention settings, and the oversight level should match whether the agent can act without approval. Proof of value means checking that documented boundaries equal technical ones on a sample of live agents. The source gives no technical implementation detail.","delivery":"Delivery framing: Kent's guidance translates into an agent register entry, owner, boundary, oversight level and review date, created before launch. Interpretation: run D-COST reviews during design and testing rather than at sign-off, and revisit oversight levels as pilots grow. Track how many agents have complete entries, and treat a missing owner as a launch blocker."},"roleDetails":{"sales":{"customerProblem":"Campuses piloting agents lack a simple, shared rule for who owns an agent, what data it sees and how much it may act alone.","stakeholders":["AI platform and engineering leads","Information governance and data protection officers","Pilot business owners","Student services leadership"],"discoveryQuestions":["Does every live agent have a named accountable owner?","Is there a written data boundary per agent?","Who decides the human oversight level and when is it reviewed?","How would the institution respond to an agent giving wrong policy guidance?"],"valueHypothesis":"Interpretation: applying a lightweight checklist to existing agents could expose ownership and data gaps early; no measured benefit is reported.","potentialEngagement":"A bounded agent governance baseline applying owner, boundary and oversight checks to a sample of live agents.","unsupportedClaims":["That the D-COST framework reduces incidents","That Kent has implemented it across all agents","Any legal conclusion beyond the cited Air Canada example","Guaranteed risk reduction"]},"engineering":{"fit":"Controls checklist applicable to any agent platform.","architectureIntegration":"Per-agent connector scopes, query permissions and retention must match the written data boundary.","prerequisites":["Agent inventory","Connector and permission listings","Retention settings per agent"],"constraints":["UK context","Guidance only, no reference implementation"],"security":"Data movement across connected systems is the stated risk; boundaries are the proposed control.","proofOfValue":["Compare documented boundaries with configured scopes on sampled agents","Verify agents marked human-in-the-loop cannot act without approval","Confirm retention matches the boundary statement"]},"delivery":{"work":"Create an agent register and embed D-COST review in the pilot lifecycle.","dependencies":["Platform admin access","Data protection review capacity","Pilot owners' time"],"ownership":"The AI platform team owns the register; each agent's business owner owns its boundary and oversight level.","skillsAdoption":"Pilot owners need short training on writing a data boundary and choosing an oversight level.","governanceCheckpoints":["Owner named before launch","Data boundary approved before connection to new systems","Oversight level reviewed at each pilot stage"],"acceptanceCriteria":["Proposed: 100% of live agents have owner, boundary and oversight fields completed","Proposed: zero agents launched without a named owner","Proposed: oversight review recorded at least each term"],"risks":["Paper boundaries diverging from real permissions","Autonomy expanding between reviews","Ownership lost when staff move"]}},"retrievedAt":"2026-10-21T21:52:17-05:00","enrichedAt":"2026-10-21T21:56:33-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Human-oversight levels clarify which staff remain accountable for agent output.","procurementImplications":"Limited direct relevance; the Air Canada example implies institutions bear liability for agent statements regardless of vendor.","operatingModelImplications":"Governance runs alongside design and testing rather than as a final approval gate.","sourceVerification":{"openedUrl":"https://blogs.kent.ac.uk/aiteam/2026/10/21/three-risks-to-consider-before-using-ai-agents-in-education/","referenceExcerpt":"every AI agent needs a named accountable owner before it launches.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}