Is your AI Governance ready for AI Agents?

Many organizations have taken the first important steps in AI governance. Principles are defined, use cases are assessed, risks are classified and responsibilities are becoming clearer. Then AI agents enter the conversation.

Do we need to start again?

Probably not. But we do need to challenge whether our existing governance is ready for AI that can do more than generate an output.

The important shift is from asking only:

Can we trust what the AI produces?

to also asking:

What are we prepared to let the AI do?

An AI assistant that drafts an email is one thing. An AI agent that can access systems, retrieve information, use tools and take actions on behalf of a user or organization introduces a different level of responsibility. That does not necessarily require an entirely new governance framework. It does require us to look at the governance we already have through a different lens.

1. Autonomy — what are we prepared to let the agent do?

There is an important difference between AI recommending an action and an AI agent executing it. What can the agent do independently? What requires human approval? Where must a person remain involved? This does not have to be an all-or-nothing decision.

The appropriate level of autonomy depends on the use case, potential impact, reversibility of actions and the organization’s ability to detect and respond when something goes wrong. As experience and confidence grow, autonomy can evolve too.

2. Authority and access — on whose behalf does the agent act?

For an agent to perform useful work, it may need access to data, applications, tools, APIs or business processes. That raises questions beyond simply “What data can the AI see?” On whose behalf is the agent acting? What authority has it been given? What does it genuinely need access to? And what should remain outside its reach?

Existing security, privacy, identity and access-management controls remain relevant. But they need to be considered in the context of an AI system that can not only access information, but also take actions.

3. Accountability — who owns the outcome?

Giving an AI agent greater autonomy does not remove organizational accountability. There still needs to be clear ownership of the use case, the decisions around its deployment and the outcomes it produces. If an agent takes an unexpected action, who is responsible for responding? If several systems or teams are involved, is ownership still clear?

Governance should make accountability understandable before something goes wrong, rather than trying to establish it afterwards.

4. Boundaries — when should the agent stop?

Governance should define not only what an agent can do, but also what it must not do. When should it stop? When should it ask for approval? When should it escalate to a person? Which actions should never be delegated? And what happens when the agent encounters a situation outside the conditions for which it was designed?

These boundaries should reflect the business context and potential consequences. The same level of control will not be appropriate for every agent or every use case.

5. Monitoring — how do we know what the agent is actually doing?

Governance cannot stop at approval. Once an agent starts operating, the organization needs to understand how it behaves in practice. Can we see which actions it took? Can we understand when and why it escalated? Can we identify unexpected behaviour? Can we intervene when necessary?

The greater the autonomy and potential impact, the more important effective monitoring and traceability become. This shifts part of governance from approval before deployment towards continuous oversight during operation.

Don’t replace your governance. Test it.

For organizations that already have AI governance in place, the arrival of AI agents should not automatically trigger another governance framework or an additional layer of processes. Instead, take your first real agent use case and use it to properly test the governance you already have. Walk it through your existing governance model. But don’t assess only the AI output. Challenge the model against the additional questions that agency introduces:

What can it decide and do?

Under whose authority does it act?

What can it access?

Who owns the outcome?

Where are its boundaries?

How will we monitor it and intervene when necessary?

Then test those controls in practice. Monitor what happens. Identify where existing governance works, where it creates unnecessary friction and, importantly, where it leaves gaps. Use that experience to improve and tighten your governance before expanding autonomy or moving into more consequential use cases.

Some existing controls may prove perfectly adequate. Others will need to evolve. And practical implementation will almost certainly expose questions that were difficult to anticipate on paper. That is not a weakness in the governance model. It is how governance matures alongside the technology and the organization using it.

Governance should evolve with what AI can do

AI agents introduce new possibilities, but organizations do not need to respond by creating governance complexity for its own sake. Start with the governance foundations you already have.

Extend the questions from what AI produces to what AI is allowed to do. Be deliberate about autonomy, authority, access, accountability, boundaries and monitoring. Then use real implementation experience to challenge and strengthen the model.

Good governance should not slow the journey towards agentic AI. It should give the organization the confidence to take the next step responsibly.

Make Data & AI work for you.
Simple. Strategic. Future-ready.