Governed AI agent

A governed AI agent is an AI agent that uses an organisation-approved model and operates only with permitted data, tools, identities, and approval policies, where high-risk steps still require human approval.

The distinction is not the model, it is the boundary. A governed agent inherits the organisation's existing identity and access model, so it can only reach what the requesting person could already reach.

Two controls separate governance from a permissions checkbox: authority checks that test a decision against the roles allowed to make it, rather than against whoever happens to be in the thread, and done-gates that verify a task was completed against the original request before it is marked complete.

No agent can change organisational policy. Policy change stays a human decision with a named approver.