Your ADM register, backed by receipts, not questionnaires
From 10 December 2026, if a computer program makes, or substantially and directly helps make, decisions that could significantly affect people using their personal information, your privacy policy has to say so. AgentValet sits in your agents' credential path, so it can show what each agent can reach and what it actually did. You add the judgement only a person can make.
What APP 1.7 to 1.9 ask for
When all three are true: a program you have arranged makes a decision or does something substantially and directly related to one, it uses personal information, and the decision could significantly affect someone's rights or interests. Your privacy policy must then describe:
- 1.8(a) the kinds of personal information those programs use,
- 1.8(b) the kinds of decisions made solely by them, and
- 1.8(c) the kinds of decisions they substantially and directly help make.
A human approving each outcome does not take a program outside the rule if the program's output is a key factor in the decision. Making a decision includes refusing or failing to make one. Read the OAIC's APP 1 guidance.
A sample register
Five agents at a fictional retailer, run through the same code that builds a customer's register. Activity window 2026-09-02 to 2026-12-01.
| Agent | Personal information it can reach (inferred from access) | What it did, and the human's role | Decision | APP 1.7 status |
|---|---|---|---|---|
| Refund triage Gmail, Stripe | Contact detailsEmail and message contentFinancial and transaction informationPayment card details | 1,552 actions 150 approval requests: 141 approved, 9 denied | Assessing customer refund requests Substantially and directly assists | Likely in scope |
| Credit control Xero | Contact detailsFinancial and transaction informationCustomer and sales records | 655 actions No approvals requested | Placing customer accounts on credit hold for overdue invoices Solely automated | Likely in scope |
| Applicant screener Google Drive, MCP server (mcp-hire-example-com-1a2b3c4d) | Files and documentsUnclassified, needs review (1) | 152 actions No approvals requested | Shortlisting job applicants for interview Substantially and directly assists | Likely in scope 1 unclassified scope |
| Lead enrichment HubSpot | Contact detailsCustomer and sales records | 2,210 actions No approvals requested | Not described Not yet assessed | Review needed |
| Status page bot Cloudflare | None inferred | 40 actions No approvals requested | Not described Does not make or assist decisions | Likely out of scope |
Draft APP 1.8 privacy policy wording
Draft for review by your privacy or legal adviser. AgentValet does not provide legal advice.
- Contact details
- Email and message content
- Financial and transaction information
- Payment card details
- Customer and sales records
- Files and documents
- Placing customer accounts on credit hold for overdue invoices
- Assessing customer refund requests
- Shortlisting job applicants for interview
1 agent still needs review and is not in this draft, which is the point: gaps are named, not hidden.
The template is free to use without AgentValet. It has the same columns as the register AgentValet fills in for you.
How the register is built, and what it does not do
Inferred from access
Each platform and scope an agent holds maps to the kinds of personal information it can reach. Anything the mapping does not cover is shown as "Unclassified, needs review", never dropped. This is not a scan of your data.
Counted from the audit log
Actions per platform and every approval, approve or deny, come from AgentValet's records of what the agent actually did. Human approval is shown as evidence of the human's role, never as an exemption.
Judged by your people
Whether an agent makes or substantially assists a decision, and whether that decision could significantly affect someone, is your call. It is recorded with who decided and when, with version history and a review date.
Snapshots freeze the register with a SHA-256 fingerprint, so the copy you cite is the copy you can download again later. The register view is on every paid plan; snapshots, exports and draft wording are on Team and above. Read the methodology.
Draft for review by your privacy or legal adviser. AgentValet does not provide legal advice.