Introducing the Agent Review: Every Agent Gets an Enforced Mandate

Deploying an AI agent should require the same rigor as deploying production code — maybe more. The Agent Review is Clevername's answer to the question: "What is this agent actually allowed to do, and who said so?"

How It Works

Every agent gets a mandate: a machine-readable policy compiled from a 27-question security intake covering six critical areas — scope, tools, data access, autonomy level, compliance requirements, and integration bindings. The mandate compiles into a guardrail profile that follows the agent through every session.

The honest part, because it matters for how you read the rest: Clevername drafts that mandate for you. After an agent has been observed for enough real calls, we extract what it actually does, compile the mandate, and arm it. You do not have to fill in a questionnaire before your agent can be governed.

Drafted by us, confirmed by you

A mandate we drafted is provisional. It is fully enforced — ScopeGuard checks every call against it from the moment it is armed — but no human has confirmed that it says the right thing. The dashboard tells you so, in as many words, and offers you the one action that matters: Review & lock.

When a human reviews and locks the mandate, it stops being provisional and becomes what a human actually signed off on.

Two things follow from that, and we would rather state them plainly than let you infer them:

• Enforcement does not wait for a human. An agent is governed from its first calls, not from whenever someone gets around to the questionnaire. Provisional never means unenforced.
• Human sign-off is available, and it is the default where a review council is configured. Team and Enterprise organizations can require quorum approval before any agent moves from draft to active — a real gate, with reviewers and votes. Without a council configured, there is no reviewer, and the mandate stays provisional until its owner confirms it.

That is the trade we chose: an agent that is governed on day one and honestly labelled, rather than an agent that sits ungoverned while it waits for a review that may never come.

Continuous Validation

Approval isn't a one-time event. Clevername re-validates the agent's behavior against its mandate at runtime. If an agent drifts — requesting tools it wasn't approved for, accessing data outside its scope, or exceeding its autonomy level — enforcement kicks in.

The guardrail profile travels with the agent. Every session loads it. Every action is checked against it. The version hash is re-validated at activation — if the agent definition drifts from its reviewed state, the session is blocked until re-submission. Governance doesn't decay.