Words
A diagram needs an owner.
Governance is who may approve a use, who may accept the risk that remains, and who may stop the service. An owner is a person accountable for that agent, not a team name with no one on call.
Inventory agents, tools, identities, memory, children, and connections. Include workers that run after the chat closes. If it is not on the list, you cannot revoke it.
A risk decision names what remains possible, who accepts it, and what would trigger a review. “We enabled a filter” is not that decision.
NIST’s AI Risk Management Framework is for organizing that work: govern, map, measure, manage. The Cybersecurity Framework is the broader security program: govern, identify, protect, detect, respond, recover. Use them to assign owners. They do not execute the agent’s tools.