Inside the New Governance Playbooks for Agentic AI Deployments
When AI stops advising and starts acting, governance shifts from approving models to approving actions.
Eighteen months ago, most enterprise AI governance documents were written for chatbots: a model answered a question, a human read the answer, and the risk stopped there. Agentic systems break that assumption. An agent that can open a ticket, change a firewall rule or issue a refund is no longer advising — it is acting.
That shift is forcing a quiet rewrite of governance playbooks across large enterprises. In conversations with technology leaders at banks, insurers and manufacturers, the same three changes come up again and again.
From model approval to action approval
The first generation of AI review boards approved models. The new generation approves actions. Instead of asking "is this model accurate enough?", teams now maintain an explicit register of what each agent is allowed to do, in which systems, and with what spending or data limits.
One insurer we spoke to classifies every agent action into three tiers: read-only, reversible and irreversible. Anything irreversible still requires a human to click approve, no matter how confident the agent is.
“We stopped governing the model and started governing the permissions. That's what actually limits the blast radius.”
Logs that a regulator can read
The second change is observability. Agents chain dozens of steps together, and a single bad output can be buried several calls deep. Leading teams now require every agent run to produce a human-readable trace: what it was asked, what tools it called, what it changed and why.
- Every action is tied to a named business owner, not just a service account
- Traces are retained for the same period as financial records
- Rollback procedures are tested before an agent goes live, not after an incident
Kill switches are now a design requirement
Finally, governance teams are insisting on a fast, boring way to stop an agent. Several CIOs described a single feature flag that disables all agent write-access across the company in under a minute — and they rehearse using it.
None of this is glamorous. But the organisations moving fastest with agentic AI are, almost without exception, the ones that settled these questions before their first production deployment rather than after their first mistake.