Chapter 1 of 6
Module scope#
What we will do#
Objective. Put one governed Foundry agent under a responsible-AI decision file and a human approval gate.
This module records the AI system inventory entry, use-case intake result, Article 5 screen, EU AI Act risk class, Article 50 transparency obligations, impact assessment, and transparency note for the agent from Session 04. It then adds a pause-and-resume approval gate to one consequential tool and checks that approval executes the tool while rejection does not.
Why it matters#
Problem. A governed agent can pass technical deployment checks and still lack a clear record of why it is acceptable, what users must be told, and which human can stop a consequential action.
Solution. This module puts those decisions in durable records and binds the highest-risk tool to human approval before execution.
EU AI Act. This module supports Article 5 (prohibited practices) with the screen, Article 6 and Annex III (high-risk classification) with the risk class, Articles 9 and 27 (risk management and fundamental rights impact assessment) with the impact assessment, Articles 13 and 50 (transparency) with the transparency note and disclosures, and Articles 14 and 26(2) (human oversight) with the approval gate.
Boundaries#
This module sits outside the numbered session sequence.
It changes the responsible-AI records and one runtime approval path for one approved Foundry agent. Microsoft Foundry and the agent runtime remain authoritative for live agent state. The repository stores the decision contract and approval-gate code.
Session 09 owns evaluation release gates. Session 10 owns red-team and Defender checks. Session 14 owns estate-wide lifecycle operations. This module records decisions for one system and tests one approval gate. It is not legal advice. Legal or compliance counsel owns final classification and disclosure wording.
Module preparation
Who should join
- Responsible AI and AI governance leads
- Microsoft Foundry agent product owners
- Legal, compliance, privacy, and risk reviewers
- Foundry platform and agent runtime engineers
- Delivery owners who approve consequential agent actions
What you need
- Session 04 has created the approved nonproduction Foundry agent, and the agent owner can identify its project, deployment, version, tools, and lifecycle path.
- The product owner can complete the use-case intake, Article 5 prohibited-practice screen, EU AI Act risk class, and Article 50 transparency obligation fields for one AI system.
- Legal or compliance counsel can review the classification and the transparency wording. This module records the decision path; it does not provide legal advice.
- The runtime owner can deploy the approval gate to the approved agent application path and protect any tool execution endpoint outside this repository.
- One approver role, one consequential tool, and one synthetic approved and rejected tool-call payload are available for the delivery checks.