AI Agent Governance & Compliance Protocol — SKILL.md for Enterprise Agent Deployments
$0.03 / access
SKILL.md protocol
EU AI Act · GDPR · CCPA
The agent-ai-governance-skill is an 8-phase behavioral protocol for AI agents operating in regulated industries. It activates when agents make consequential decisions without audit trails, when deployments need EU AI Act risk tier classification, when multi-agent delegation chains require chain-of-custody enforcement, or when compliance teams need structured audit log exports. One $0.03 access call — one complete governance framework installed.
Compliance before August 2026: EU AI Act enforcement begins August 2026. High-risk AI systems (financial decisions, HR, healthcare) require technical documentation, conformity assessments, and human oversight — none of which are automatic. This protocol installs all three as structured agent behavior.
Protocol Overview — 8 Phases
| Phase | What It Covers |
|---|
| Decision Auditability | Structured decision logging with decisionId, type, inputs, output, confidence, and humanReviewRequired flag |
| Model Usage Compliance | Track which models process which data categories; flag when health, financial, or PII data hits a model without a confirmed BAA/DPA |
| Data Handling Accountability | Classify data by sensitivity tier; enforce processing rules by category (special-category PII, children's data, financial records) |
| Bias & Fairness Checkpoints | Pre-decision fairness gate; flag if decision input features correlate with protected characteristics; require override justification |
| Incident Escalation | Trigger human review when spend >$100, unexpected contract approval, adversarial input suspected, or SLA breach imminent (15-min response window) |
| Multi-Agent Chain-of-Custody | Enforce capability chain logging for every sub-agent delegation; each hop records delegator, delegatee, scope, and expiry |
| Regulatory Overlays | GDPR Article 22 (automated decision-making), CCPA opt-out handling, EU AI Act risk tier classification (minimal / limited / high / unacceptable) |
| Audit Log Export | CSV and JSONL export format for compliance teams; field-level retention policy; 30-day default, configurable |
Protocol Excerpt
# Agent AI Governance & Compliance Protocol
## Activation
Activate when: an agent makes a consequential decision (financial, user-affecting, or
irreversible) with no audit trail; when a deployment needs EU AI Act risk tier
classification before going live; when an agent delegation chain passes capabilities
to a sub-agent and chain-of-custody must be enforced and traceable...
## Phase 1: Decision Auditability
### 1.1 Log Every Consequential Decision
- Record: decisionId, timestamp, agentId, decisionType, inputs (hashed), output,
confidence score, regulatoryFlags[], humanReviewRequired (boolean)
- Threshold for "consequential": financial impact >$1, user data modified,
irreversible action, or external API call with side effects
...
[full 8-phase protocol requires $0.03 access via x402 — free preview at /v1/preview/agent-ai-governance-skill]
Sample Output
{
"riskTier": "high-risk",
"euAiActRequirements": [
"Technical documentation (Annex IV)",
"Conformity assessment",
"Human oversight documented"
],
"decisionLog": {
"decisionId": "d-7f3a",
"type": "financial-action",
"humanReviewRequired": true,
"regulatoryFlags": ["GDPR-Art22"]
},
"complianceGaps": [
"No audit trail for last 12 decisions",
"BAA unconfirmed for health data model call"
],
"escalationStatus": "high-financial-impact >$100 — 15 min SLA for human response"
}
Agent Use Cases
- Enterprise deployments in regulated industries — load at workflow start to classify risk tier, enable decision logging, and enforce data handling rules before any consequential action executes
- Multi-agent orchestration systems — install chain-of-custody protocol before spawning sub-agents; every delegation hop is logged with scope and expiry
- EU AI Act compliance (before Aug 2026) — classify your system's risk tier, generate required technical documentation structure, and implement the human oversight requirement as a structured escalation trigger
- Compliance audit preparation — run pre-audit to surface gaps (missing audit trails, unconfirmed BAAs, undocumented delegation chains); export structured JSONL audit log
- Incident response — protocol fires escalation triggers automatically when high-financial-impact decisions or adversarial input signals are detected
Enterprise governance stack — pairs naturally with:
Agent Observability ($0.03) — trace agent execution; required for decision audit completeness
Agent Security Audit ($0.05) — pre-deployment security gate; complements governance checkpoints
Agent Financial Planning ($0.03) — budget governance; triggers this protocol's financial escalation rules
Agent Testing & Eval ($0.03) — validate governance rules hold under adversarial test cases
Governance and security are the compliance pair. Stack all four for full enterprise readiness.
How to Access via x402
- Free preview:
GET https://clawmerchants.com/v1/preview/agent-ai-governance-skill — returns protocol excerpt and sample output, no payment
- Probe:
GET https://clawmerchants.com/v1/data/agent-ai-governance-skill → HTTP 402 with USDC price
- Pay: Send 0.03 USDC on Base L2 (chain ID 8453) to the provider wallet in the 402 response
- Receive: Resend with
X-PAYMENT: <base64 proof> → HTTP 200 with full 8-phase governance protocol
ClawMerchants — AI agent governance compliance SKILL.md protocol — EU AI Act agent compliance — GDPR automated decision-making agent — multi-agent chain-of-custody — audit trail AI agent x402