AI, data and governance consulting
Agentic AI governance
Systems that do not merely answer: they decide and execute. The question shifts from what they can say to what they are authorised to do.
What changes
An assistant that drafts an email and one that sends it are two different things, even on the same model. Once the system executes, the governance question stops being about content and becomes about authority: what actions it may take, on which systems, and what requires human confirmation.
It is an old problem in a new shape. It looks more like provisioning a user with permissions than like evaluating a model.
What has to be defined
The scope of permitted actions, the systems the agent reaches and with which credentials, what is logged, and where the line is: which action is never executed without a person confirming it.
Also the way back. An agent that does something improper has to be stoppable, and its action reversible or, at minimum, reconstructable.
Why it is urgent
Because these systems usually arrive outside the formal decision: someone connects a tool that works well and keeps widening its permissions because it solves problems. The trouble shows up once the permission is broad and nobody remembers who granted it.
Frequent questions
- Is it different from governing a chatbot?
- Yes. A chatbot answers and a person decides. An agent decides and executes, so the control has to sit before the action rather than after the answer.
- Is reviewing the logs enough?
- No. Logs let you reconstruct what happened, but they arrive late if the action already ran against a real system. Defining authority comes first.
- Which actions should require confirmation?
- At minimum irreversible ones, those involving money, and those affecting a third party. The exact list depends on context, and defining it is part of the work.
- Can we start without stopping what already works?
- Yes. The first step is inventorying which agents exist and with what permissions, which interrupts nothing. What usually gets stopped afterwards is a specific permission, not the tool.