From AI that recommends to AI that acts: building the governance architecture for the autonomous enterprise.
Introduction: When AI Stops Recommending and Starts Acting
The evolution of enterprise Artificial Intelligence is entering a new phase.
For several years, organizations have primarily focused on deploying AI systems that analyse information, generate content, summarize documents, identify patterns and recommend decisions. Generative AI has significantly changed how employees interact with technology, access knowledge and perform everyday tasks.
However, the next evolution is more consequential.
Agentic AI systems are increasingly designed to pursue defined objectives, plan multi-step activities, interact with external tools, retrieve information, invoke APIs, communicate with other agents and execute actions with varying degrees of autonomy.
Consider a relatively straightforward enterprise scenario.
An employee asks an AI assistant to review outstanding supplier invoices. A conventional AI assistant might identify overdue invoices and recommend follow-up actions.
An AI agent, depending on its permissions and design, could go considerably further:
Retrieve supplier information from an ERP platform.
Compare invoices against purchase orders.
Identify discrepancies and potential exceptions.
Contact suppliers for clarification.
Update workflow records.
Initiate an approval request.
Potentially trigger a payment workflow within its delegated authority.
The distinction is fundamental.
The organization is no longer governing only the information generated by an AI system. It is governing a system capable of taking actions within the enterprise environment.
This introduces a new governance question:
When an AI agent acts on behalf of an organization, who authorized the action, what boundaries governed it, and who remains accountable for the outcome?
Agentic AI governance must address that question before autonomous capabilities become embedded in critical business processes.
1. Understanding Agentic AI: Beyond Traditional Generative AI
Agentic AI refers broadly to AI-enabled systems that can pursue objectives through a sequence of decisions and actions, often using tools, external systems, memory or other agents.
The terminology is evolving, and not every product marketed as an AI agent has the same degree of autonomy. Some agents operate within tightly controlled workflows, while others can dynamically select tools, plan activities and adapt their execution.
For governance purposes, it is useful to distinguish three broad operating patterns.
Pattern 1: AI-assisted decision-making
The system analyses information and produces recommendations. A human reviews and performs the action.
Pattern 2: AI-orchestrated execution
The system plans and coordinates activities, but significant decisions or actions require human approval.
Pattern 3: Autonomous agent execution
The system can independently perform approved activities within predefined permissions, constraints and operating boundaries.
These patterns should not be treated as a simple maturity ladder in which greater autonomy is automatically better. The appropriate level depends on business impact, risk exposure, reversibility, data sensitivity and the organization's ability to maintain effective oversight.
An agent that schedules internal meetings does not require the same governance as one that modifies customer records, changes production infrastructure or initiates financial transactions.
The governance architecture must therefore be proportionate to the agent's actual capabilities and potential impact.
2. Why Agentic AI Creates a New Enterprise Risk Landscape
Traditional AI governance remains relevant, but autonomous execution introduces additional dimensions that organizations cannot adequately address through model accuracy and responsible-use policies alone.
Consider the following risk categories.
2.1 Identity and privilege abuse
An agent may require access to multiple enterprise applications, databases, APIs and services.
If organizations assign agents excessive permissions, reuse human credentials or fail to distinguish individual agents, a compromised or misdirected agent could operate with privileges beyond its intended purpose.
Every agent should have a distinguishable identity, an accountable owner and permissions aligned with its approved responsibilities.
2.2 Goal hijacking and instruction manipulation
An agent may process emails, documents, web pages, tickets or other externally supplied content.
Malicious or manipulated instructions embedded in those sources may influence the agent's behaviour, redirect its objectives or induce it to perform unintended actions.
This is particularly important when agents can access sensitive information or invoke privileged tools.
2.3 Uncontrolled tool execution
An agent's ability to call tools is also its ability to affect enterprise systems.
An incorrectly configured integration, unsafe API call or poorly validated action could result in unauthorized changes, data disclosure or disruption of business operations.
Tool access must therefore be governed as an explicit privilege, not treated as a convenient technical integration.
2.4 Memory and context poisoning
Agents may retain or retrieve information from previous interactions, knowledge bases or external sources.
If this context becomes inaccurate, manipulated or contaminated, future decisions and actions may be affected.
Organizations need to understand what an agent remembers, where that information is stored, how it is updated and when it should be removed.
2.5 Inter-agent communication and cascading failures
An enterprise may deploy several specialized agents that delegate tasks to one another.
A failure in one agent can propagate across interconnected workflows. An incorrect recommendation may become an instruction to another agent, which may execute it without independently validating the original information.
The result can be a chain of unintended actions rather than an isolated AI error.
2.6 Human over-reliance and accountability gaps
Employees may assume that an autonomous system has correctly interpreted a request or completed an activity.
Managers may also assume that another team owns the agent's decisions, particularly when responsibility is divided between technology, business operations and risk functions.
Automation must never become a mechanism for transferring accountability away from the organization.
These risks reinforce an important principle:
An AI agent's autonomy must be matched by an equally mature governance and control environment.
3. The Agentic AI Governance Operating Model
Agentic AI governance should not become a disconnected framework sitting outside the organization's existing AI governance, cybersecurity, enterprise risk and operational control structures.
It should extend the established AI Management System and Enterprise GRC environment to address autonomous execution.
The following operating model provides a practical structure.
Layer 1: Enterprise and Board Oversight
The Board and executive leadership establish the organization's risk appetite for autonomous AI.
Their responsibilities include:
Approving the strategic direction for agentic AI adoption.
Understanding material business and operational risks.
Establishing accountability for autonomous activities.
Reviewing significant incidents and control failures.
Ensuring that governance investment keeps pace with adoption.
The Board does not need to approve every agent deployment. It needs visibility into material risks, delegated authority and the effectiveness of management oversight.
Layer 2: AI Governance and Enterprise Risk
The AI Governance Council, supported by GRC, Risk, Legal, Privacy and Compliance functions, establishes the enterprise governance requirements.
Its responsibilities include:
Defining agent classification and approval criteria.
Establishing risk assessment and impact assessment processes.
Setting minimum control requirements.
Maintaining the enterprise AI and agent inventory.
Defining human oversight requirements.
Monitoring regulatory and contractual obligations.
Reviewing exceptions and residual risks.
This layer translates strategic risk appetite into operational governance requirements.
Layer 3: Security, Identity and Technology Controls
CISO, IAM, Security Architecture, Cloud Security, Application Security and platform engineering teams implement the technical control environment.
Key responsibilities include:
Agent identity and authentication.
Authorization and privilege management.
Secure tool and API integrations.
Secrets and credential protection.
Network and data access restrictions.
Runtime monitoring and anomaly detection.
Logging, evidence retention and incident response.
Secure development, testing and change management.
Layer 4: Business Ownership and Operational Execution
The business function sponsoring an agent remains accountable for its approved business purpose and operational outcomes.
Responsibilities include:
Defining the agent's intended purpose.
Identifying the business process and affected stakeholders.
Assigning an accountable business owner.
Validating the agent's outputs and actions.
Maintaining human approval requirements.
Monitoring operational performance.
Escalating exceptions and incidents.
Technology teams can operate the platform, and GRC can oversee the control framework, but neither should become the substitute for business ownership.
4. The Agentic AI Lifecycle: Governance From Registration to Retirement
One of the biggest governance mistakes organizations can make is treating agent approval as a one-time activity.
Agentic systems can evolve through changes to models, prompts, tools, permissions, connected applications, knowledge sources and operating objectives.
A controlled lifecycle is therefore essential.
The proposed lifecycle is:
Identify → Classify → Assess → Authorize → Deploy → Monitor → Reassess → Retire
Step 1: Identify and Register
Every enterprise agent should be recorded in a centralized inventory.
Minimum information should include:
Unique agent identifier.
Agent name and business purpose.
Business owner and technical owner.
Developer, platform and service provider.
Model and version information, where available.
Connected applications and tools.
Data sources and data classifications.
Assigned permissions and identities.
Approved autonomy level.
Human oversight and escalation requirements.
Deployment environment and lifecycle status.
An organization cannot govern what it cannot identify.
The inventory should include internally developed agents, externally provided agents, embedded agents within enterprise SaaS platforms and material agents deployed by business functions.
Step 2: Classify the Agent
Not every agent requires the same level of governance.
A practical classification should consider:
Business impact: Could the agent affect financial results, customer outcomes or critical business operations?
Data sensitivity: Does it access confidential, personal, regulated or commercially sensitive information?
Execution authority: Can it read, modify, approve, delete, transfer or execute?
Autonomy: Does it require human approval, or can it act independently?
External exposure: Does it interact with customers, suppliers, public services or external systems?
Reversibility: Can its actions be easily reversed?
Dependency: Does it delegate activities to other agents or rely on third-party services?
A useful internal classification could be:
| Classification | Typical capability | Governance expectation |
|---|---|---|
| Level 1 – Assistive | Read, summarize and recommend | Standard AI controls |
| Level 2 – Coordinated | Prepare and orchestrate workflows | Defined human approvals |
| Level 3 – Controlled execution | Execute approved, bounded actions | Strong identity, access and monitoring controls |
| Level 4 – High-impact autonomy | Execute material or sensitive activities | Enhanced approval, segregation, continuous oversight and tested emergency controls |
This is a proposed enterprise classification model, not an official regulatory classification.
The organization should map its internal categories to applicable legal and regulatory requirements rather than assuming that autonomy level alone determines regulatory classification.
Step 3: Conduct Agent-Specific Risk Assessment
Traditional AI risk assessments should be supplemented with agent-specific questions.
For example:
Can the agent access more information than necessary?
Can it execute transactions or modify critical records?
Can it invoke tools outside its approved purpose?
Can untrusted content influence its instructions?
Can it delegate tasks to another agent?
Can the agent's memory retain sensitive information?
Can an incorrect action create cascading business impact?
Is there a reliable mechanism to interrupt execution?
Can the organization reconstruct what happened and why?
The assessment should cover business, operational, security, privacy, legal, compliance, third-party and resilience risks.
Risk assessment should also evaluate the full workflow, not just the underlying AI model.
Step 4: Authorize and Approve
Before deployment, the organization should formally authorize:
Business purpose and process ownership.
Approved autonomy level.
Data access and processing boundaries.
Tool and application permissions.
Human approval checkpoints.
Financial or operational execution limits.
Monitoring and escalation requirements.
Incident response and shutdown procedures.
High-impact agents should undergo documented approval involving the relevant business owner, technology owner and independent control functions.
The approval should be tied to a specific configuration and scope. Material changes to that configuration should trigger reassessment.
Step 5: Deploy With Guardrails
Deployment should follow secure engineering and change-management practices.
The organization should validate:
Approved model and agent versions.
Identity and access configuration.
Tool allowlists and API restrictions.
Data access controls.
Runtime policy enforcement.
Human approval mechanisms.
Logging and monitoring.
Recovery and rollback procedures.
Production deployment should not rely solely on successful demonstrations or proof-of-concept results.
Step 6: Monitor and Reassess
Agent behaviour and business context may change over time.
Monitoring should cover both technical activity and business outcomes.
Examples include:
Unexpected tool invocation.
Unusual access patterns.
Repeated authorization failures.
Actions outside approved operating hours or scope.
Excessive delegation or agent-to-agent activity.
Policy violations.
Unexpected changes in transaction volumes.
Repeated human overrides.
Material changes to underlying models or integrations.
Reassessment should occur periodically and when significant changes, incidents or new dependencies emerge.
Step 7: Retire and Revoke
Retirement must be treated as a formal control activity.
When an agent is decommissioned, organizations should:
Revoke its identities and credentials.
Disable API keys and service accounts.
Remove application permissions.
Review and retain required audit records.
Address stored memory and sensitive data.
Remove obsolete integrations.
Update the enterprise agent inventory.
Confirm that dependent workflows remain secure.
An agent that is no longer in use but still has valid credentials is an unnecessary attack surface.
5. Identity and Access Management: Every Agent Needs an Identity
This is arguably one of the most important control areas in agentic AI governance.
Traditional enterprise IAM frameworks are built around human users, service accounts, applications and workloads.
Agentic AI introduces a more complex identity and authorization requirement.
An agent may act on behalf of a human, operate under a business process identity, interact with another agent or execute tasks through multiple connected services.
Organizations must be able to distinguish:
Who initiated the activity.
Which agent performed it.
Which identity was used.
What authority was delegated.
Which resources were accessed.
What action was executed.
Whether the action was approved.
Which accountable owner is responsible.
Recommended Agent IAM Controls
1. Unique agent identity
Each production agent should have a unique, traceable identity. Shared credentials across multiple agents should be avoided.
2. Least privilege
Grant only the permissions required for the approved business purpose.
An agent that needs to read invoice records should not automatically receive permission to modify supplier bank details or initiate payments.
3. Delegated authorization
Where an agent acts on behalf of a human or another system, authorization should be explicit, limited and traceable.
Delegation should not silently inherit unrestricted privileges from the initiating user.
4. Just-in-time and time-bound access
Where practical, sensitive permissions should be granted only for the required task and duration.
5. Credential and secrets management
API keys, tokens and certificates should be securely managed, rotated and monitored. Credentials must not be exposed through prompts, agent memory or logs.
6. Segregation of duties
An agent should not be allowed to initiate and independently approve a sensitive transaction where organizational policy requires separation of responsibilities.
7. Revocation and emergency disablement
Organizations must be able to revoke an agent's access or suspend its execution quickly when required.
8. Non-repudiable activity records
Logs should preserve the relationship between the initiating user, agent identity, delegated authority, tool invocation and resulting action.
The underlying principle is straightforward:
An AI agent should have an identity, not an anonymous collection of permissions.
6. Human-in-the-Loop: Where Should Human Authority Begin and End?
Human oversight is frequently presented as a universal solution to AI risk.
However, simply adding an approval button does not establish effective human oversight.
The reviewer must have sufficient information, authority, competence and time to make a meaningful decision.
For agentic AI, human oversight should be designed around the potential impact and reversibility of actions.
Three Oversight Patterns
Human-in-the-Loop (HITL)
The agent prepares or recommends an action, but a human must approve it before execution.
Appropriate examples include high-value transactions, sensitive access changes and decisions with significant customer or employee impact.
Human-on-the-Loop (HOTL)
The agent executes predefined activities autonomously, while a human monitors performance and can intervene.
Appropriate examples may include routine, low-impact operational workflows with clear boundaries and tested intervention mechanisms.
Human-in-Command (HIC)
A designated human authority retains the ability to direct, restrict, suspend or terminate the agent's activities.
This is particularly important for critical workflows, material incidents and high-impact autonomous systems.
A Practical Approval Matrix
| Action type | Suggested oversight |
|---|---|
| Read approved internal knowledge | Autonomous within access policy |
| Draft an internal communication | Human review before external distribution |
| Update a low-risk workflow record | Bounded autonomous execution with monitoring |
| Modify privileged access | Explicit human approval |
| Change supplier payment details | Independent verification and human authorization |
| Initiate a material financial transaction | Approval under financial delegation and segregation-of-duties policy |
| Modify production infrastructure | Controlled change approval and rollback capability |
| Delete critical records or suspend essential services | Explicit authorization and tested emergency controls |
The exact thresholds should be defined by the organization based on its business, regulatory and operational context.
A critical distinction must be maintained:
Human oversight is not meaningful if the human cannot understand, challenge or stop the action.
7. Agentic AI Security: Extending the Enterprise Security Architecture
Agentic AI should be integrated into the organization's existing cybersecurity architecture, but with additional controls that address autonomous behaviour and tool use.
The following control domains deserve particular attention.
Application and API Security
Maintain approved tool and API inventories.
Validate tool inputs and outputs.
Enforce authorization at the API layer.
Restrict high-risk operations.
Apply rate limits and execution quotas.
Prevent unauthorized tool discovery and invocation.
Data Security and Privacy
Apply data classification and access restrictions.
Prevent unauthorized data movement between tools.
Mask or minimize sensitive information where appropriate.
Protect agent memory and context stores.
Define retention and deletion requirements.
Monitor data access and exfiltration indicators.
Runtime Security
Enforce policies at the point of execution.
Detect unusual agent behaviour.
Restrict unapproved destinations and integrations.
Monitor agent-to-agent communications.
Maintain execution limits and circuit breakers.
Support immediate suspension and recovery.
Secure Development and Supply Chain
Assess third-party agent frameworks and components.
Validate plugins, connectors, tools and model dependencies.
Review agent configuration and code changes.
Maintain version control and release approvals.
Conduct adversarial testing and security assessments.
Monitor material changes to external dependencies.
Resilience and Business Continuity
Define manual fallback procedures.
Establish recovery and rollback mechanisms.
Test agent failure scenarios.
Identify critical dependencies and single points of failure.
Prevent cascading failures across interconnected agents.
A particularly important consideration is that the organization should not rely exclusively on model-level safety controls.
An agent can produce a seemingly harmless response while invoking an unsafe tool or performing an unauthorized action. Security controls must therefore operate across the complete execution path.
8. Agentic AI Governance Metrics: What Should Leadership Measure?
Traditional AI dashboards often focus on model performance, adoption, accuracy and productivity.
These remain useful, but agentic AI requires additional metrics that measure authority, execution, control effectiveness and operational outcomes.
A proposed Agentic AI Governance Scorecard could include six dimensions.
| Dimension | Suggested metrics |
|---|---|
| Inventory and ownership | Percentage of production agents registered; percentage with named business owners |
| Identity and access | Percentage with unique identities; privileged access exceptions; credential rotation compliance |
| Execution control | Percentage of high-impact actions requiring approval; unauthorized tool invocation attempts |
| Security and resilience | Agent-related incidents; anomalous execution events; successful recovery tests |
| Human oversight | Approval response time; override rate; unresolved exceptions |
| Assurance and compliance | Risk assessment coverage; control testing completion; overdue remediation actions |
KPIs and KRIs Must Be Balanced
KPIs help determine whether the agent is delivering business value.
Examples include:
Reduction in processing time.
Improvement in workflow completion rates.
Reduction in manual effort.
Increase in service availability.
Cost savings.
KRIs indicate whether the organization is accumulating unacceptable risk.
Examples include:
Percentage of agents with excessive permissions.
Number of unauthorized execution attempts.
Number of high-impact actions without adequate approval.
Percentage of agents operating outside their registered scope.
Number of unresolved critical security findings.
Frequency of material human overrides.
An organization that reports only productivity gains may be measuring the benefits of autonomy without measuring the risks created by it.
9. Agentic AI Incident Management: When an Agent Goes Rogue
Incident management must evolve alongside agent capabilities.
Traditional AI incident management already covers model failures, harmful outputs, bias, data leakage and performance degradation.
Agentic AI introduces additional scenarios:
An agent executes an unauthorized transaction.
An agent modifies or deletes business records.
An agent exposes sensitive data through an external integration.
A compromised agent uses legitimate privileges maliciously.
One agent delegates an unsafe instruction to another.
A configuration change expands an agent's execution authority.
An agent becomes trapped in a repeated action cycle.
Organizations should define an agent-specific response process.
Detect → Triage → Contain → Investigate → Recover → Learn
Immediate Containment
Depending on the incident, containment may involve:
Suspending the affected agent.
Revoking credentials and tokens.
Disabling specific tools or integrations.
Blocking external communication.
Preventing further execution.
Preserving relevant logs and evidence.
Investigation and Accountability
The investigation should establish:
Which user or process initiated the activity.
Which agent and version were involved.
What instructions and context influenced execution.
Which tools and permissions were used.
What actions were completed.
Whether another agent or external dependency was involved.
What business or regulatory impact occurred.
Recovery and Revalidation
Before restoring an agent, organizations should validate the root cause, correct the relevant control weaknesses, review affected data and transactions, and confirm that the agent operates within its approved boundaries.
Recovery should not simply mean restarting the agent.
It should mean restoring the system with sufficient confidence that the original failure cannot recur under the same conditions.
10. Integrating Agentic AI Into Enterprise GRC
Agentic AI governance should not create another disconnected compliance programme.
It should integrate with existing enterprise processes.
| Existing GRC process | Agentic AI governance integration |
|---|---|
| Enterprise AI Governance | Agent inventory, classification, approval and oversight |
| IT Risk Management | Agent-specific risk assessment and treatment |
| IAM Governance | Agent identities, delegated permissions and access reviews |
| Third-Party Risk Management | Agent platforms, tools, models and external dependencies |
| Change Management | Agent configuration, model, tool and permission changes |
| Security Operations | Runtime monitoring, incident detection and response |
| Privacy Management | Personal data access, processing and retention |
| Business Continuity | Manual fallback, agent recovery and dependency resilience |
| Internal Audit | Evidence, control testing and independent assurance |
| Compliance Management | Applicable regulatory and contractual obligations |
This integration is important because agentic AI risk rarely remains confined to one function.
A single agent may simultaneously create technology risk, operational risk, privacy risk, third-party risk and financial control exposure.
The enterprise needs one coherent governance architecture rather than multiple teams independently assessing fragments of the same activity.
11. The Agentic AI Governance Framework — Six Pillars of Controlled Autonomy
Based on the governance requirements discussed above, I propose the following original framework for enterprise adoption.
The Agentic AI Governance Framework — Six Pillars of Controlled Autonomy
Pillar 1: Identity and Ownership
Every agent must have a unique identity, a named business owner and a technical custodian.
The organization must know who initiated an activity, which agent executed it and who is accountable for its outcome.
Pillar 2: Authority and Boundaries
An agent should operate only within explicitly approved objectives, permissions, tools, data access and execution limits.
Autonomy must be delegated, not assumed.
Pillar 3: Risk and Impact Management
Agents should be classified and assessed based on business impact, data sensitivity, execution capability, autonomy, reversibility and external dependencies.
Higher-impact agents require stronger controls and oversight.
Pillar 4: Human Oversight and Intervention
Human approval, monitoring, escalation and emergency intervention must be proportionate to the potential impact of agent actions.
Oversight must be meaningful, not ceremonial.
Pillar 5: Continuous Security and Assurance
Organizations must monitor agent behaviour, validate permissions, test controls, maintain evidence and reassess material changes throughout the lifecycle.
Pillar 6: Accountability and Resilience
The organization must remain accountable for agent-enabled business outcomes.
It must also be capable of containing failures, recovering operations, investigating incidents and learning from control weaknesses.
These six pillars are intended as an original enterprise governance model. They complement established AI management and cybersecurity frameworks; they are not an official ISO, NIST or regulatory standard.
12. A Practical 90-Day Agentic AI Governance Roadmap
Organizations do not need to wait for a fully mature agentic AI ecosystem before establishing governance.
A structured 90-day programme can create a practical foundation.
Days 1–30: Discover and Establish Control
Identify existing and planned AI agents.
Establish a central agent inventory.
Identify business and technical owners.
Document connected tools, applications and data sources.
Identify agents with privileged or high-impact capabilities.
Define an interim agent usage and approval policy.
Review existing service accounts and credentials used by agents.
Expected outcome: Visibility into the agent landscape and immediate control of unmanaged exposure.
Days 31–60: Assess and Implement Guardrails
Establish an agent classification methodology.
Conduct risk assessments for priority agents.
Define approved autonomy levels.
Implement unique agent identities.
Review permissions and enforce least privilege.
Establish human approval thresholds.
Introduce runtime logging and monitoring.
Define emergency suspension procedures.
Expected outcome: A documented governance and control baseline for priority agent deployments.
Days 61–90: Validate and Operationalize
Conduct agent-specific security testing.
Test prompt injection and unsafe tool-use scenarios.
Validate human approval and intervention mechanisms.
Test incident response and recovery procedures.
Establish agent governance metrics.
Integrate agent risks into enterprise risk registers.
Conduct an independent control review.
Report material risks and progress to executive leadership.
Expected outcome: A repeatable governance operating model supported by measurable controls and executive oversight.
The 90-day roadmap is a proposed implementation approach, not a regulatory deadline or certification requirement.
13. Ten Questions Every CISO, CIO and GRC Leader Should Ask
Before approving significant agentic AI deployments, leadership should be able to answer ten questions:
Do we have a complete inventory of enterprise AI agents, including those embedded in third-party platforms?
Does every production agent have a clearly identified business owner and technical custodian?
Does every agent have a unique identity and permissions restricted to its approved purpose?
Do we know which agents can independently modify records, initiate transactions or execute privileged operations?
Are agent objectives, tools, data access and execution boundaries formally approved?
Which actions require human approval, and can the human meaningfully challenge or stop them?
Can we reconstruct every material agent action, including its initiating user, identity, permissions and tool calls?
Do we continuously monitor agent behaviour, inter-agent communications and changes to external dependencies?
Can we immediately suspend a compromised or malfunctioning agent without disrupting the wider business unnecessarily?
Can we demonstrate through evidence that our agentic AI controls are operating effectively?
If these questions cannot be answered confidently, the organization may be adopting autonomy faster than it is developing the ability to govern it.
14. Standards, Frameworks and Regulatory Considerations
Agentic AI governance should build upon existing standards and emerging guidance rather than creating an entirely separate compliance universe.
Some particularly relevant references include:
ISO/IEC 42001:2023 — Artificial Intelligence Management Systems
Provides requirements for establishing, implementing, maintaining and continually improving an AI management system. Its management-system approach offers a foundation for governing AI across organizational roles, processes, risks and controls.
NIST AI Risk Management Framework (AI RMF 1.0)
The Govern, Map, Measure and Manage functions provide a useful structure for integrating agentic AI risks into enterprise AI risk management.
NIST: Identity and Authority of Software Agents
NIST's February 2026 concept paper explores how identity standards and authorization practices can be applied to software agents, including identification, authorization, auditing and non-repudiation considerations.
CISA and International Partners: Careful Adoption of Agentic Artificial Intelligence Services (May 2026)
Provides practical cybersecurity guidance on limiting agent autonomy, strengthening identity management, applying layered defences, threat modelling and continuous monitoring.
OWASP Top 10 for Agentic Applications (2026)
Provides a security-focused view of agentic application risks, including goal hijacking, tool misuse, identity and privilege abuse, supply-chain vulnerabilities, memory and context poisoning, cascading failures and rogue agents.
EU Artificial Intelligence Act
Organizations operating in or providing AI systems within the EU should assess the Act's applicability based on the system, role, intended purpose and relevant obligations. Agentic capabilities do not automatically create a separate legal classification. However, where an agent forms part of a regulated AI system or performs activities subject to other legal requirements, those obligations must be assessed accordingly.
The regulatory analysis should also consider applicable privacy, cybersecurity, financial services, employment, consumer protection and sector-specific requirements.
The important distinction is that these standards and guidance documents provide different types of support: management-system requirements, risk-management guidance, cybersecurity recommendations and regulatory obligations. They should not be treated as interchangeable or as automatic certification of an agentic AI deployment.
Final Thoughts
Agentic AI has the potential to transform enterprise operations.
It can reduce manual effort, accelerate decision-making, improve service delivery and enable organizations to execute complex workflows with greater efficiency.
But autonomy introduces a different level of organizational responsibility.
When an AI system can independently access information, invoke tools, modify records and execute business activities, governance can no longer focus exclusively on the quality of its outputs.
It must also govern the authority under which the system operates, the boundaries within which it acts, the evidence it produces and the accountability that remains with the organization.
The objective should not be to eliminate autonomy. It should be to ensure that autonomy is intentional, proportionate, controlled and demonstrably accountable.
An enterprise should never confuse the ability to automate a decision with the authority to make that decision.
The future of responsible AI will not be defined by how much autonomy organizations can deploy, but by how effectively they can govern the autonomy they delegate.
Technology may accelerate innovation. Trust determines whether that innovation endures.
Looking Ahead
In Part XI of GRC Insights | Responsible AI Governance, we will explore another critical dimension:
AI Governance in the Software Development Lifecycle — Securing AI From Design to Deployment and Beyond.
As organizations increasingly embed AI into applications, products and enterprise platforms, governance must move closer to engineering.
We will examine how AI governance can be integrated into secure SDLC, DevSecOps, model development, testing, release management, change control and continuous assurance.
The objective will be to move from governance as a periodic review to governance as an integral part of how AI-enabled products and services are built and operated.
Sources & Further Reading
ISO/IEC 42001:2023 — Artificial Intelligence Management Systems
NIST — New Concept Paper on Identity and Authority of Software Agents (February 2026)
NIST — Back to the Future: Why Agentic AI Needs a Strong Identity Foundation (August 2026)
Editorial note: The six-pillar Agentic AI Governance Framework, four-level internal agent classification and 90-day roadmap presented in this article are original proposed governance models developed for GRC Insights. They are not official standards, regulatory classifications or certification schemes. Organizations should tailor their implementation to applicable laws, contractual obligations, risk appetite and operating context.
.png)
