You don't need a committee, you need a decision in writing
AI governance sounds like big-company bureaucracy, but for a small business it can be as simple as a one-page document: which agents exist, what each one can do, and who approved them. What matters isn't the format — it's that it exists and that someone reviews it.
Separate "reading" from "acting"
An agent that checks availability doesn't carry the same risk as one that cancels an appointment or issues a refund. Classify every capability you give an agent into one of these two categories before turning it on, and require explicit human approval for the second until you have real confidence in it.
Define what happens when something fails
It's not a remote possibility — it will happen. What makes the difference is whether there's already a process in place to detect it, fix it and prevent it from happening again, or whether the first time it happens nobody really knows what to do.
Ask for traceability, not promises
Any agent that acts on your business should leave a reviewable record of every action: what it did, when, with what data, with what result. If a provider can't show you that record, you don't have real governance — you have a black box with good presentation.
Review it as usage grows
The rules that work for one agent in one department don't automatically work for ten agents across the whole company. Review the document every time you add an important new capability, not just once a year.