01 · Definition
What Is Agentic AI Governance?
Agentic AI governance is the operating system of rules, roles, decisions and evidence used to direct AI agents. It establishes which agents may exist, who is accountable for them, what authority they receive, how their actions are monitored and when people must intervene.
Governance sets acceptable purpose and responsibility. Security implements technical protection. Runtime control observes behaviour and applies constraints while an agent operates. A mature programme connects all three without treating them as the same function.
02 · Change
How Agentic AI Changes Enterprise Governance
Traditional AI oversight often reviews a bounded model or application at defined lifecycle gates. An agent may plan tasks, choose tools, call external services, access changing data and delegate work to another agent. The risk therefore depends on current permissions and environment as well as the underlying model.
Reviews must address authority and action paths: what the agent can do, on whose behalf, under which conditions and with what consequence. Governance also needs faster reassessment when tools, credentials, instructions or connected agents change.
03 · Proportionality
Classify Autonomy and Consequence Before Applying Controls
Autonomy describes how independently an agent can act. Impact describes what can happen if the action is wrong. Treat them as separate dimensions: a narrow automated action can still be high impact, while a broadly capable research agent may have no authority to change a system.
| Autonomy level | Example action | Minimum approval | Runtime control | Required evidence |
|---|---|---|---|---|
| 1 · Observe or retrieve | Read approved records | Approved purpose and data scope | Access boundary and logging | Identity, query, source and result |
| 2 · Recommend | Draft a decision for a person | Human performs the action | Output review and prohibited-content checks | Recommendation, reviewer and final decision |
| 3 · Act with approval | Prepare a refund and request confirmation | Explicit gate before execution | Transaction limit, step-up approval and timeout | Request, approver, policy and execution result |
| 4 · Bounded delegated authority | Resolve low-value cases within policy | Pre-approved scope plus exception escalation | Deterministic limits, monitoring, pause and kill | Complete action trace, exceptions and review |
Increase control strength with impact, reversibility, data sensitivity and scale. The agentic AI governance playbook turns this classification into implementation gates.
04 · Visibility
AI Agent Inventory and Discovery
A useful inventory is more than a name and owner. It records the agent's purpose, lifecycle state, business process, technical identity, model, data sources, tools, environments, downstream dependencies and other agents it can invoke. Discovery can reveal unregistered agents, but business owners must confirm context and legitimacy.
Agent ID, purpose, accountable owner, technical owner, model, data, memory, permissions, tools, upstream and downstream agents, environment, autonomy level, approval state, lifecycle status and last material review.
04 · Accountability
Agent Identity, Ownership and Accountability
Every production agent needs an unambiguous technical identity and an accountable human or organisational owner. Technical identity enables authentication, access decisions and attribution. Ownership establishes who approves purpose, accepts residual risk, maintains the agent and responds when behaviour diverges.
Shared credentials and vague team ownership weaken both security and auditability. Buyers should test whether a platform can link an observed action to the agent, its delegated user or service, the approving owner and the policy in force at that moment.
05 · Authority
Permissions, Delegation and Tool Access
Permissions should reflect the smallest authority required for the task. Delegation must preserve the origin and limits of authority when an agent acts for a user or invokes another agent. High-impact actions may require step-up approval, transaction limits or human confirmation.
- Separate read, create, change, approve and delete permissions.
- Limit tools, data scope, environments, duration and transaction value.
- Prevent an agent from expanding its own authority.
- Record who granted access, why, and when it expires or is reviewed.
06 · Delegation
Multi-Agent and Delegated Action Chains
A parent agent may ask a specialist agent to act, which then calls a tool or another service. Governance must preserve the original requester, the authority passed at each step and any narrower downstream limit. A downstream system should not treat the intermediary as unrestricted simply because it is trusted to connect.
Require correlation identifiers across the chain and record who requested, planned, approved and executed a material action. Test whether the evidence still makes sense when one agent delegates to another. For the detailed identity control model, use agent identity and permissions.
06 · Lifecycle
AI Agent Lifecycle Governance
A lifecycle gate should not become a static form. Material changes—new tools, broader data access, different objectives, model substitution or altered autonomy—should trigger proportionate review.
07 · Protocols
MCP and Agent-to-Agent Governance Considerations
The Model Context Protocol (MCP) standardises connections between AI applications and external systems. Agent-to-agent patterns allow agents to coordinate or delegate. These connections improve interoperability, but they also expand the authority graph that governance must understand.
Maintain an approved server and tool catalogue, authenticate every party, constrain delegated scopes, validate outputs before consequential actions and retain correlation records across the chain. Treat a new server, tool or downstream agent as a change to the governed system—not merely a connector configuration.
Protocol reference
Model Context Protocol documentation describes the protocol architecture and security guidance. Organisational controls remain your responsibility.
09 · Assurance
Monitoring and Evidence
Monitoring should capture the evidence needed to explain material actions. Not every interaction needs identical retention; evidence requirements should reflect risk, privacy, security and legal obligations.
| Evidence field | Question it answers |
|---|---|
| Agent and upstream requester | Who initiated and who acted? |
| Context and policy version | Which information and rule informed the decision? |
| Tool request and permission result | What authority was tested and allowed? |
| Action and outcome | What changed in the external system? |
| Approval, block, override or escalation | Which control intervened and who accepted the result? |
| Review and retention status | Can the organisation investigate and prove control operation later? |
Useful metrics include inventory completeness, orphaned agents, excessive permissions, overdue reviews, blocked high-impact actions, unresolved exceptions and time from detection to accountable response. See governance evidence and metrics for a fuller evidence model.
10 · Worked example
How Controls Change With Authority
Consider a customer-service agent that reads a customer record, drafts a resolution and may issue a refund. At Level 2 it recommends an amount and a person executes it. At Level 3 it prepares the transaction but waits for approval. At Level 4 it may issue refunds below a defined value, while policy blocks higher amounts, sensitive accounts and repeated attempts.
Across all levels, the agent needs a distinct identity, an owner and an action trace. Higher autonomy adds deterministic limits, exception escalation, control testing and a reliable pause or revocation path. The runtime governance controls guide explains how to test those interventions.
11 · Buying criteria
How to Evaluate Agentic AI Governance Platforms
- Demonstrate discovery across the environments where agents are built and embedded.
- Show how identities, owners, tools, permissions and downstream agents form one record.
- Trace a material change to reassessment, approval and updated control state.
- Distinguish monitoring, recommendation, orchestration and direct enforcement.
- Export an evidence trail that remains understandable outside the product.
Use the implementation playbook to convert these criteria into a controlled demonstration, the platform buyer's guide for the broader evaluation method and the agentic AI security guide for runtime protection depth.
12 · Further reading
Related Insights
Agentic AI governance playbook
Move one agentic use case from pilot to controlled production.
Read insight →Identity & accessAI agent identity and permissions
Evaluate attributable identity, delegated authority and access boundaries.
Read insight →Runtime controlRuntime AI governance controls
Distinguish observation from intervention.
Read insight →