AI agent governance

AI agent governance is the control of AI agents that take actions rather than only produce text: which identity an agent acts under, which tools and data it may use, which steps require human approval, and what record it leaves behind.

Governing an assistant is mostly about what it may read. Governing an agent adds what it may do, which is a different class of risk, because a wrong action changes a system rather than a sentence on a screen.

Four controls carry most of the weight. The agent acts under an identity with its own permissions rather than borrowing a broad service account, it can only call an approved set of tools, high-impact steps stop for a named human, and every run leaves a record of what it did and on whose authority.

The check people miss is authority, not access. An agent asked to approve an exception may technically be able to write the record, while nobody in the thread holds the role that is allowed to grant it. Testing a decision against the roles permitted to make it is what separates agent governance from a permissions checkbox.