AI agents change the governance question. The concern is no longer only whether a model produces a good answer, but whether a system should be allowed to take an action.
An agent may retrieve data, call tools, update records, initiate workflows or coordinate other agents. Each connection increases usefulness—and expands the consequences of error, manipulation or misunderstood intent.
From content risk to action risk
Traditional AI review often concentrates on model quality, bias, privacy and acceptable use. These remain important, but agentic systems introduce operational authority. A plausible output can become a system change before a person has the opportunity to question it.
Governance must therefore follow the chain from user intent through reasoning, tool selection, permission and final effect.
The defining control question is simple: what is this agent permitted to do, under which conditions, and who remains accountable?
Design boundaries before autonomy
Start by defining the agent’s role as precisely as a human operational role. Document its purpose, permitted systems, data access, prohibited actions, escalation conditions and accountable owner.
Autonomy should expand only when evidence supports it. Low-impact, reversible actions may require notification. Material or irreversible actions should require explicit approval or remain outside the agent’s authority.
A practical control model
Give each agent a distinct identity, owner and traceable credentials.
Limit tools, data and actions to the minimum needed for the assigned role.
Require human authorisation for consequential, unusual or irreversible actions.
Record intent, context, tool calls, decisions, results and exceptions.
Provide rate limits, safe failure modes, revocation and immediate shutdown.
Test the workflow, not only the model
Assurance must cover the full system: prompts, memory, retrieved data, connected tools, permissions and downstream effects. Tests should include ambiguous instructions, malicious content, compromised dependencies and attempts to exceed authority.
Where organisations should start
Inventory agents already in use, including prototypes connected to live data. Classify them by impact and autonomy. For the highest-risk systems, map the complete action path and identify where human judgement, technical enforcement and monitoring are required.
The goal is not to eliminate autonomy. It is to make autonomy deliberate, bounded and observable.