Why AI agents need SOPs

AI agents are starting to do real work.

They can search systems, draft answers, update records, test software, summarise documents, create pull requests, and trigger other tools. In some organisations, they are already moving from experiment to everyday workflow.

That causes a documentation challenge. If an AI agent is going to act on behalf of a team, it needs a clear standard operating procedure.

Recent product updates show why this matters:

• GitHub has added Copilot agent session streaming, so enterprises can capture prompts, responses and tool calls for audit and compliance.
• It has also made enterprise-managed Copilot settings generally available, and released browser tools that let agents interact with live web applications.
• Anthropic’s Managed Agents updates point in the same direction: agents are becoming governed workplace systems.

Once an agent can act inside business tools, the organisation needs more than a prompt. It needs an SOP.

Agents need instructions they can follow

Most organisations already have procedures for people.

They explain who does the work, when it should happen, what information is needed, what system to use, what good looks like, and when to stop and ask for help.

AI agents need the same kind of guidance.

They need to know:

• What task they are allowed to perform.
• Which sources they should trust.
• Which systems they can access.
• What they must never change.
• When a human must review the output.
• How to record what they did.

Without this, an agent is left to infer the process from a mixture of prompts, interface labels, old documents, chat history, and whatever happens to be available in its context. That is a poor basis for reliable work.

The result might look confident. It might even be useful much of the time. But it will be hard to audit, hard to improve, and hard to defend when something goes wrong.

Old procedures might not be ready for AI

Many existing SOPs were written for people who already understand the workplace.

They assume background knowledge. They use shorthand. A person can often fill in the gaps. An agent might not.

If a procedure says “check the latest policy”, where is that policy? Which version is current? What happens if two sources disagree? If a customer record contains missing data, should the agent stop, ask a question, or continue with a note?

These details matter.

AI-ready procedures need to be more explicit about sources, decision points, exceptions, and review steps. They also need to separate routine work from judgement-heavy work.

A distinction should be documented before the agent is put to work:

• Which tasks can be automated?
• Which should only be assisted?
• Which should stay with people?

SOPs reduce avoidable risk

The risks are not only technical.

An agent might give a customer the wrong answer because the knowledge base is out of date. And it might update a record without leaving enough evidence for a later review.

These are documentation failures as much as AI failures.

A good SOP gives the organisation a control point. It defines the approved way to complete the task. It gives reviewers something to test against. It gives support, compliance, operations, and product teams a shared reference.

It also helps avoid a common problem: every team inventing its own way to use AI. Before long, an organisation can end up with several unofficial procedures and no clear way to know which one is correct.

An SOP brings the work back into the open.

The SOP should cover the human work too

An AI-agent SOP should not only describe what the agent does.

It should describe the whole workflow.

For example, if an agent drafts release notes, the SOP should cover the source material, the required structure, the reviewer, the approval route, the publishing location, and the correction process.

If an agent answers support questions, the SOP should cover approved knowledge sources, escalation triggers, regulated topics, logging, and how gaps in the knowledge base are reported.

If an agent helps write procedures, the SOP should say how source documents are checked, how subject matter experts review changes, and how old versions are retired.

The agent is only one part of the system. The procedure needs to cover the system.

Treat prompts and agent instructions as controlled content

Many organisations still treat prompts as personal notes.

That is unlikely to work for long.

If a prompt or agent instruction affects customer communication, product documentation, compliance work, operational decisions, or internal records, it should be managed like other business-critical content.

That means ownership, version control, review, testing, and retirement.

It should be clear who can change the instruction. It should be clear why it changed. It should be possible to test whether the new version still produces acceptable results.

This is familiar ground for technical authors and content teams. It is content management, but applied to a new type of operational content.

What an AI-agent SOP should include

A useful SOP for an AI agent will often include:

• The purpose of the workflow.
• The systems and sources the agent may use.
• The inputs the agent needs before starting.
• The steps the agent should follow.
• The outputs it should produce.
• The checks a human must perform.
• The situations where the agent must stop.
• The record that should be kept.
• The owner of the procedure.
• The review date.

For higher-risk work, it should also include approval rules, data handling limits, exception handling, and audit requirements.

This does not need to become a heavy document. In many cases, a short, clear procedure is better than a long one. The point is to remove ambiguity where ambiguity creates risk.

This is a documentation requirement

Documentation teams can help organisations decide what content agents should use, how workflows should be described, how outputs should be reviewed, and how knowledge gaps should be fixed.

They can also help turn vague AI policies into practical working procedures.

That is where many organisations will struggle. They might have an AI policy saying staff must use tools responsibly. They might have enthusiastic teams building agent workflows. What they often lack is the connective tissue between the two: clear operating instructions.

And this is where SOPs matter.

If an AI agent is going to act, the organisation needs to describe the action. If it is going to make recommendations, the organisation needs to define the evidence it should use. If it is going to produce content, the organisation needs to define the standard that content must meet.

AI agents need SOPs because work needs structure. The more capable the agent, the more that structure matters.

—

Cherryleaf helps organisations create procedures, policies, knowledge bases and AI-aware documentation workflows that people and AI-enabled systems can use with confidence.

—

We used ChatGPT to generate the image for this post. We also used ChatGPT to search the web for new developments in AI and technical communication.