Context Governance Audit (QA)

Context Governance Audit (QA)

1. 01

   Inventory every data source the assistant can access

   List inboxes, calendars, file shares, and chat platforms connected to the assistant. Confirm each source is still needed for current client work and that no departed team member's accounts remain linked.

2. 02

   Map each data source to a client and a sensitivity level

   Assign a classification such as public, internal, confidential, or restricted. This mapping drives retention rules and access controls, and it surfaces sources that hold data from multiple clients in one assistant context.

3. 03

   Verify encryption and access controls on the assistant's stored context

   Check whether the tool encrypts data at rest and in transit, and confirm who on the team can query the assistant's memory. For locally stored tools like MyHandler, confirm the on-device database is protected by the operating system's full-disk encryption.

4. 04

   Test the assistant's response against a known client fact

   Ask a question that requires pulling from a specific client's email or meeting transcript, then compare the answer to the original source. This confirms the assistant is not mixing context across clients or pulling stale data.

5. 05

   Review the assistant's activity log for unexpected access patterns

   Look for queries or data retrievals outside normal working hours, from unfamiliar IPs, or touching sensitive sources without a related task. Autonomous agents can act in unexpected ways, as seen when OpenAI agents posted 18,000 times to a public wiki, so logs are your first line of defense.

6. 06

   Confirm data retention and deletion policies match client contracts

   Align the assistant's retention settings with any contractual data handling requirements. If a client requires deletion after project end, verify the assistant purges that client's context within the agreed window.

7. 07

   Document the audit findings and set a re-audit date

   Record which sources were removed, which classifications changed, and any access control gaps you fixed. Schedule the next audit within 90 days, since new integrations and team changes can silently expand the assistant's reach.