COMMENTARY: For the last two years, the agentic AI conversation has been almost entirely about capability. Can an agent reason across multiple steps? Can it call the right API? Can it coordinate with other agents to finish a task end-to-end without a human retyping every instruction?The answer, increasingly, has been: Yes – agents now file tickets, provision access, triage security alerts, reconcile invoices, and trigger downstream workflows across dozens of enterprise systems — autonomously, and at a scale no human team could match.But capability was never the hard part. Governance has become the harder challenge.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]Every enterprise leader I talk to — CISOs, compliance officers, heads of IT operations — has asked a version of the same question: not “What can this agent do?,” but: “What happens when it does the wrong thing?, and: Can I prove what happened afterward?”That question doesn’t have a satisfying answer in most agentic deployments today, because most of them were built the same way the early internet was built: optimized for speed and flexibility, with security and oversight treated as something to retrofit later. Later is now, and retrofitting always has been harder than building it in from the start.That's the gap a real enterprise framework for governing agentic AI needs to close.
Why now’s the time
Three forces are converging at once. First, agentic systems are moving from pilot to production, which means the cost of an ungoverned mistake is no longer theoretical — it’s an agent with live access to financial systems, identity infrastructure, or customer data.Second, regulatory expectations are catching up fast, from the EU AI Act’s obligations around high-risk automated systems to sector-specific rules in finance and healthcare that already require auditability for any system making consequential decisions.Third, boards are starting to ask security and operations leaders a pointed question: If an autonomous agent took an action that caused harm, could we reconstruct exactly what it did, why, and who — or what — authorized it?Most organizations can’t answer that today. That’s the problem a governance framework promises to solve.The five pillars
Stripped of vendor marketing, an enterprise framework for governing agentic AI needs to manage five issues, regardless of which platform or model sits underneath:- Policy-as-code, not policy-as-document: Rules about what an agent can and cannot do must get enforced computationally at execution time, not written into a governance wiki that nobody — human or agent — actually checks before acting.
- Least-privilege identity for agents: Treat every agent like a new employee: scoped credentials, time-boxed access, no standing administrative rights, and revocation that’s instant rather than a ticket in a queue. Most security incidents involving automation trace back to overprovisioned access, not malicious intent.
- Human oversight at defined thresholds: Full autonomy isn’t the goal everywhere. The framework has to define, in advance, which classes of decisions escalate to a human — and make that escalation a structural part of the workflow, not a feature someone forgot to enable.
- End-to-end traceability: Every decision, every API call, every piece of data an agent touches needs to be logged with enough fidelity to reconstruct the full chain of reasoning and action after the fact. Without this, “explainability” becomes a slide in a deck, not a capability.
- Continuous risk monitoring: Don’t make governance a quarterly audit checkbox. Teams need to monitor agent behavior, access patterns, and policy adherence continuously, because agentic systems adapt to context in ways static rule sets weren’t built to anticipate.
