Agentic AI governance, explained for business leaders

Permitted is not the same as appropriate.

Identity and access controls decide whether an AI agent is allowed to reach a system. Once agents act on their own, that is no longer enough. Organisations also need to know whether permitted access is being used appropriately: in line with business intent, delegated authority and policy, every time an agent acts.

Identity and access management
Can this agent access this system?
Agentic governance
Should it take this action, now, for this purpose, on this evidence?

The objective is not to constrain agents. It is to let them operate safely, responsibly and at scale, with governance invisible until intervention is needed.

1. A governed refund

Every step checked before anything consequential happens

A customer asks a travel company's AI agent for a refund after a cancelled flight. Follow the request from complaint to payment, and see which checks apply at each step.

A customer asks for a refund

Customer "My flight was cancelled. I'd like a refund." Refund agent Booking system Payments Authorised reviewer A person with refund authority Governance check Outside the agent, before each action ALLOW Evidence record Every decision, as it happens

Illustrative scenario. Times, amounts and systems are examples.

2. Beyond identity and access

The biggest risks come from access that is perfectly valid

Traditional controls answer whether an agent may reach a system. Agentic governance answers whether what it is doing with that access is right. Three things can go wrong even when every access check passes.

Identity and access management

Decides whether access is permitted
Identity
Who or what is asking?
Entitlements
Which systems and data can it reach?
Authorisation
Do its permissions allow this request?

Agentic governance

Decides whether permitted access is being used appropriately
Purpose
Is this within what the agent was appointed to do?
Intent
Does this step make sense for the objective it is pursuing?
Action
Is this specific action justified, here and now, on this evidence?

Misuse by a person

Someone directs or manipulates an agent to use a legitimate capability for an unintended purpose.

Capability VALIDInstruction NOT VALID

Outside its boundary

The agent pursues an outcome beyond the purpose or authority it was given.

Access VALIDPurpose NOT VALID

Right goal, wrong action

The agent pursues an approved objective but chooses an action the circumstances do not justify.

Access and purpose VALIDAction NOT VALID
3. Four scenarios to plan for

How agents reach your systems, authorised or not

The greatest risk is often not unauthorised access. It is authorised access used in ways nobody intended.

1
An unauthorised agentAn unknown or malicious agent tries to reach enterprise systems and data.Keep it out, and accept some will try.
2
A person using an unapproved agentThe agent works through a person's own login, so every system sees it as that person.Its reach is limited to what that person can do, but it acts far faster.
3
A person using an approved agentThe agent uses authority delegated by a person and may go beyond what they intended.Check each action against what was actually asked.
4
An approved agent off courseA known, approved agent takes actions inconsistent with its approved purpose.Check purpose and intent, not just access.
4. Seven checks, every time

What a governance check actually asks

Each consequential action is evaluated on seven dimensions, and the result is one of three outcomes: allow, approval required, or deny. Escalation to a person is a governed outcome, not a failure.

IdentityWho is acting, and for whom?
ContextWhat is the situation right now?
PurposeIs this within its approved purpose?
AuthorityHas it been delegated authority for this?
PolicyDo the rules allow it?
ActionIs this action justified now?
EvidenceIs the decision recorded and explainable?

Regulators and industry bodies are pointing the same way

Emerging guidance points to five consistent expectations for autonomous AI.

AccountabilityClear ownership of AI decisions and their outcomes
Agent identityAgents identified, governed and auditable like any other actor
Decision rightsDelegated authority and escalation defined explicitly
Continuous oversightMonitoring after go live, not just approval before it
EvidenceThe ability to prove governance is working, not just to say it is
5. For business leaders

Questions worth asking about your own agents

Access controls tell you an agent can act. Governance tells you it should.

  1. For each agent in your business, could you say what it is for, what it may decide alone, and who answers for it?
  2. Which actions do you want a person to approve, whatever the agent recommends?
  3. Can an agent ever approve its own recommendation in any of your processes?
  4. If an agent took the wrong action tomorrow, how quickly would you know, and could you explain why it happened?
  5. Could you show a regulator evidence that your agent governance works, rather than a policy saying it should?