Defining SLAs for Autonomous Agents

The CISO asked what the SLA was. The SI pasted 99.9 percent monthly uptime from a cloud annexure and a penalty of one percent of the monthly fee per hour below that. Nobody could say what up meant for a process that drafts a noting, waits for a deputy secretary, and then writes to an MIS that itself is down on the first Monday of the month.

Uptime is a server idea. An agent is a chain: retrieve, reason, call a tool, wait for a human, write a log, refrain from leaving the perimeter. The chain can fail while the GPU still answers ping. If your SLA only pings, you have not bought reliability. You have bought a green dashboard.

This template is for committees writing the service schedule of an on-prem or air-gapped agent. It does not invent a mandatory availability percentage. Those numbers are commercial choices, and fake precision is how vendors later prove they were up while the district was not served. Write objects you can measure on your side.

Four objects that belong in an agent SLA

Availability of the inference and retrieval path you actually use — measured from the department's probe, not from the vendor's status page. Say what probe, from where, how often, and which planned maintenance is excluded. Do not copy a public-cloud five-nines line you cannot observe.

Tool-call success. Of the authorised tool invocations the agent attempts, how many return a well-formed success or a well-formed, classified failure. A timeout into a silent retry that writes twice to the MIS is not success. Publish the classification.

Human-gate latency. Once a payload sits with a named role, how long until the platform has presented it in the queue the officer actually uses. You cannot SLA the officer. You can SLA the queue. Mixing the two is how vendors get punished for a secretary who is in the House.

Log export and egress honesty. Traces must land in the department store within a stated freshness. Undeclared destinations are a breach whether or not the model answered. CERT-In's 28 April 2022 directions already speak to ICT logs and clocks for covered entities; your contract should not make those logs a vendor souvenir.

SLA objects you can put in a schedule. Targets are examples of structure, not mandated numbers.

Object	How the department measures it	What is not a measurement	Typical remedy shape
Path availability	Department probe of retrieve + draft on a synthetic item	Vendor status page; GPU ping	Service credit; extend support; terminate for persistent miss
Tool-call success	Export of attempts vs classified outcomes	Anecdotes from the demo	Fix first, then credit; repeated silent writes are a security incident
Human-gate presentation	Timestamp from ready-to-review to visible in the role queue	Time until the officer clicks	Credit; extra ops support — do not fine the officer
Log freshness	Arrival in SIEM / official store	Visible in vendor UI	Breach of security schedule if logs vanish
No undeclared egress	Periodic capture or allow-list audit	Vendor assurance letter	Material breach; not a small credit

What not to put a penalty on

Do not SLA accuracy as a monthly percentage without a frozen task and dataset. Accuracy belongs in acceptance and in a periodic evaluation, not in a cash penalty that tempts the vendor to refuse hard cases. See the companion note on defining accuracy.

Do not SLA the department's own MIS, network, or officer attendance. Vendors will otherwise spend the quarter proving your eOffice was slow.

Do not invent 99.99 percent as a badge of seriousness. If you cannot measure four nines from your probe, you have written fiction. A measured 99 percent on the real path is more honest than an unmeasured four nines.

Do not apply heavy liquidated damages to every miss. Uninsurable SLAs empty the bid room or get priced back to you as contingency. Persistent miss, undeclared egress, and missing logs deserve teeth. A single slow afternoon deserves a conversation and a credit, not a career event.

How to write the schedule so operations can live with it

One page per object: definition, probe or export, exclusions, reporting date, credit formula, escalation. Attach a sample monthly report. If the vendor's first report cannot be produced from your logs, the SLA is still theirs.

Name who in the department signs the monthly exception list. Unowned SLAs become decorative.

Align the security objects with the isolation annexure. An SLA that is silent on egress while the technical bid promised an air gap is two different contracts stapled together.

1. List the workflows in production, not the ones on the slide.
2. For each workflow, name the tools and the human gate.
3. Write probes the department can run without the vendor.
4. Pick credits you will actually raise invoices for.
5. Send undeclared egress and log loss to the breach clause, not to the credit table.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

If we do not write 99.99 we will look unsophisticated.

You will look unsophisticated when you cannot measure it. Write what your probe can see.

The vendor will only accept uptime.

Then they are selling a server, not an agent. Keep tool-call, gate, log and egress objects even if the credits on the first two are modest.

CERT-In already covers logs, so the SLA can skip them.

CERT-In is a direction to covered entities. Your vendor is not automatically you. Contract the export so you can obey the direction.

We will add SLAs after go-live when we know the numbers.

After go-live you have no leverage. Write the objects now and the numeric targets as bands you can tighten at the first review, with a method.

A two-week SLA workshop

1. Day 1–3: map one real workflow end to end. Name every tool and gate.
2. Day 4–6: write probes the department can run. If you cannot write a probe, you cannot write an SLA.
3. Day 7–8: decide which misses are credits and which are breaches.
4. Day 9–10: table the draft with finance so the credit math is payable, then drop it into the bid.

How this shows up in the file

Subject: Service schedule for the agent platform — objects beyond uptime.

The attached schedule defines path availability (department probe), tool-call success (classified export), human-gate presentation (queue visibility), log freshness (arrival in our store), and undeclared egress (material breach). No availability percentage is presented as a statutory requirement. Accuracy is handled in the acceptance and evaluation schedule, not as a monthly cash penalty.

This note is not legal advice.

A monthly report the department can produce

If the first monthly SLA report can only be generated by the vendor's engineer on the vendor's laptop, you do not have an SLA. You have a newsletter. The report must be buildable from your probe logs, your tool-call export, your queue timestamps, and your SIEM arrivals. Ask for that query pack at acceptance.

Name the officer who signs exceptions. Unowned exceptions become a pile of vendor explanations. A signed exception is a departmental decision that the miss was the MIS, the House, or announced maintenance. Unsigned exceptions are how a green dashboard survives a dead queue.

Once a quarter, replay the undeclared-egress check even if the monthly credits were fine. Egress is not a credit object. It is a breach object. Monthly politeness will hide it unless someone still pulls a capture.

This article is a field guide for Indian public buyers, not legal, procurement, financial or audit advice. Confirm every citation against the live GFR compilation on doe.gov.in, the relevant DoE procurement manual, GeM terms, CVC guidance and your own counsel before a sentence enters a tender file.

How to put this in the RFP, not the preamble

A P2 Procurement who searches “AI agent SLA government” is usually drafting or scoring a bid. “Defining SLAs for Autonomous Agents” belongs in eligibility, the evaluation matrix, or a numbered annexure. If it only lives in the covering note, L1 will ignore it.

An agent can be up and still refuse every tool, stall every human gate, swallow its logs, and phone a vendor host. Write those four duties as the SLA, not a borrowed five-nines line. QCBS weights are a choice you must publish before opening. Accuracy is a task plus a dataset, not a slogan. SLAs for agents must name tool-calls, human gates and log export — uptime alone is a hosting metric.

Do not let a vendor write the specification and then bid on it. Record unsolicited proposals. Pay for pilots that touch personal data. Write exit before you write go-live.

1. Move the control from the preamble into a scored or eligibility row.
2. Attach a one-page definition (accuracy, SLA, language, data handling).
3. Require an artefact in the technical bid, not a slide.
4. Extend the bid date if a corrigendum is material.
5. Minute the demo on your data, offline if you claimed air-gap.

Close this loop before the next CAB

Put “Defining SLAs for Autonomous Agents” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P2 Procurement, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI agent SLA government” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.