From the CrowdStrike edition of November 3, 2026
Columbia County, Oregon: draft county-wide AI policy requires approved, logged AI agents with human confirmation before actions and vendor terms allowing the county to suspend use
Columbia County, Oregon (Board of Commissioners memo) · Local government (county) · Columbia County, Oregon, U.S.
- Publisher
- Columbia County Board of Commissioners agenda materials
- Original publication
- 2026-11-02
- Source retrieved
- 2026-11-04
- Event date
- 2026-11-04
What happened
A Nov. 2, 2026 staff memo for the Nov. 4 Board of Commissioners meeting summarizes a draft county-wide AI policy, built after reviewing nine policies (eight local, one state) from an Oregon government IT association and Oregon state guidance. AI agents must be specifically approved, have limited access and a named county owner, keep activity logs, and get human confirmation immediately before actions such as sending, deleting, changing access or initiating a transaction. Agent logs may be public records. Vendors must disclose AI functions, sub-processors and material changes, and contracts must address the county's ability to suspend or end use. It is a draft, not an adopted policy, and is not linked to any vendor.
Why it matters
Direct: a current county-level example of the controls agencies are writing into AI policy, which is the buyer-side context for CrowdStrike's Nov. 3 agent controls. Transferability is limited to one small county's draft, though it was built from nine peer policies.
Evidence and measured results
Primary local government document; a policy draft summary, not an evaluation of outcomes.
Limitations and uncertainty
Draft summary only; final policy text and adoption status not confirmed; one county.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-03; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Counties adopting AI policies need tools and contracts that let them prove agent oversight, logging and the ability to suspend use.
- Stakeholders
- County IT director
- Board of commissioners
- Risk management committee
- Records officer
- Discovery questions
- Has your board adopted or drafted an AI policy?
- Does it require human confirmation before agent actions?
- Do your contracts let you suspend AI features?
- Value hypothesis
- Agent controls that produce logs and a suspend capability may help counties meet policy requirements; the memo provides no evidence for any product.
- Potential engagement
- A policy-to-control mapping session against the county's draft AI policy.
- Unsupported claims
- Any product meets this policy
- The policy has been adopted
- Requirements are typical of all counties
Pre-sales engineering
Role takeaway
- Fit
- Counties and similar agencies drafting AI policies that cover agents.
- Architecture and integration
- Agent workflows need pre-action confirmation steps plus logging and suspend controls retained in county-controlled systems.
- Prerequisites
- Approved-use inventory
- Named agent owners
- County-controlled log storage
- Constraints
- Draft policy may change
- Public-records retention applies to agent logs
- Small IT staff
- Security
- Restricts confidential data to approved systems and bans unapproved consumer AI tools.
- Proof of value
- Demonstrate logged human confirmation before an agent sends or deletes
- Demonstrate suspending an agent and retaining its logs in county systems
Delivery
Role takeaway
- Work
- Register agents, assign owners, configure logging and retention, and set up suspend procedures.
- Dependencies
- Final policy adoption
- Records retention schedules
- Vendor contract terms
- Ownership
- County IT, with departments accountable for their uses and the Risk Management Committee's security subcommittee for higher-risk uses.
- Skills and adoption
- Staff learn to confirm specific agent actions rather than approve generically.
- Governance checkpoints
- Board policy adoption
- Higher-risk use review by the governance body
- Acceptance criteria
- Proposed: every agent has a named owner and inventory entry
- Proposed: agent logs retained in county systems per schedule
- Risks
- Logs held only in vendor systems
- Approval fatigue
- Policy text changing before adoption
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Human confirmation before each consequential action implies agent workflows must pause for approval, not just be stoppable after the fact.
Governance
Who approves, reviews and stays accountable for outcomes?
Named owners, approved-use inventory, records retention for agent logs, and a governance body for higher-risk uses.
Security and privacy
What data, permissions and controls need testing?
Confidential data only under narrow written exceptions; personal and unapproved consumer AI tools prohibited.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Notes AI can improve accessibility; requires qualified personnel to review outputs.
Procurement
What should contracts, pricing and exit terms secure?
Vendors must disclose AI functions, data use, sub-processors and material changes; contracts must address suspension or termination of use.
Operating model
Which teams own the service once it runs?
IT-maintained approved-use inventory, departmental accountability, and a governance body for non-standard uses.
Publication history
- 2026-11-03CrowdStrike · Issue 064 resources
Stable resource ID: columbia-county-or-draft-ai-policy-agent-controls-2026-11-02