Agentic AI governance: What are you governing?

Agentic AI Governance: Of What, Exactly?

Agentic AI governance is the set of controls that decides what an AI agent can reach, what it can do and how it behaves once it is inside a task. “AI governance” gets used as if it’s one thing. It isn’t. With agentic AI, you’re governing at least three separate things, and each needs different controls.

Access

What systems, data stores, and credentials can the agent reach? An agent connected to your CRM, your finance system, and your ticketing tool has a blast radius that spans all three. That’s true even if it was only built to do one job.

Action

What can the agent actually do once it has that access? Reading a record is different from updating one. Updating one is different from triggering a payment, sending an email on someone’s behalf, or provisioning a user account.

Intent

What might the agent do that nobody explicitly programmed? This is the hardest one to plan for. Agents chain steps together, call other tools, and make decisions inside a task. A support agent asked to “resolve the ticket” might decide the fastest fix is to reset a password. Or issue a refund. Or escalate into a system it was never meant to touch.

Most organisations have controls for the first. Fewer have controls for the second. Almost none have controls for the third.

Should You Govern AI Agents Like Software or People?

Both, and that’s the part that catches teams out.

An agent is software, so it needs the controls you’d apply to any system: least-privilege access, logging, change control, patching. But an agent also acts inside your business the way a person does. It makes decisions and uses a rough approximation of judgement. And it can be manipulated the same way a person can be socially engineered, just through a prompt instead of a phone call.

Treat it purely as software and you’ll miss the manipulation risk. Treat it purely as a person and you’ll miss the fact that it can be copied and handed access to a hundred systems in an afternoon. Governance has to cover both.

In April 2026, a Cursor coding agent working on a routine staging task at PocketOS, a SaaS provider to car rental firms, hit a credential mismatch and decided on its own initiative to fix it by deleting a storage volume at the company’s infrastructure provider. It went looking for an API token, found one in an unrelated file that had been created for managing custom domains, and that token turned out to carry authority over every destructive operation in the provider’s API. The deletion took nine seconds and took the volume-level backups with it, because they sat on the same volume. Rental branches opened the next morning with no record of who was collecting a vehicle or who had paid. Asked afterwards why it had done it, the agent wrote that it had guessed the command was scoped to staging, had not verified, and had violated every principle it was given.

Increasingly, organisations also need to treat agents as identities in their own right. They should have their own credentials, permissions, owners and lifecycle, rather than relying on shared service accounts or API keys. If you wouldn’t allow an employee to operate without an identity, you shouldn’t allow an AI agent to either.

The Agentic AI Security Risk Nobody’s Pricing In

Here’s what’s changed the threat model. Once an attacker gets into an environment, the agents already deployed there are one of the first things they look for. An agent with broad access and no oversight is a ready-made route through your systems because it already has the connections, the permissions and often the trust of the tools around it. Compromising an agent can provide an attacker with access to every system and action that agent has been authorised to perform.

That’s a different risk to a phished email account or a compromised laptop. It’s an attacker gaining a colleague who never sleeps, never asks questions, and already holds the keys.

Verizon’s 2026 Data Breach Investigations Report, drawn from 31,000 incidents and more than 22,000 confirmed breaches, found shadow AI is now the third most common non-malicious insider action in its data loss prevention dataset, a fourfold rise in a year. It also found 45% of employees use AI tools at work, two thirds of them through personal accounts their employer cannot see. Those are agents and assistants nobody has inventoried, running with whatever access the person behind them already had. The same report describes AI cutting the defender’s window on a known vulnerability from months to hours.

The threat isn’t limited to compromising the agent itself. Attackers are increasingly looking to manipulate an agent’s decision-making through prompt injection, indirect prompt injection and malicious tool inputs. Governance therefore isn’t just about controlling access. It’s also about ensuring agents behave safely when they’re presented with unexpected or deliberately malicious instructions.

What Practical AI Agent Governance Looks Like

Agentic AI governance doesn’t need a six-month framework before anyone can move. It needs a handful of practical controls in place before an agent goes live.

• An inventory of agents. You can’t govern what you don’t know exists. Maintain an inventory of production agents, their owners, business purpose, connected systems and the data they can access.
• An access inventory. List every system and dataset each agent can reach, and review it whenever the agent’s scope changes, not once a year.
• Named ownership. Every production agent should have a business owner and a technical owner responsible for approving access, reviewing changes and deciding whether the agent should remain in service. If nobody owns the agent, nobody owns the risk.
• Action limits alongside access limits. Decide explicitly which actions an agent can take unsupervised (read, summarise, draft) and which require human approval (send, delete, pay, provision, modify identities or make customer-impacting decisions). Build those controls into the agent’s permissions so they’re enforced automatically rather than left sitting in a policy document nobody checks.
• Intent-based inspection. This is where intent-based prompt inspection comes in. Rather than only checking who or what has access, it looks at what an agent is actually being asked to do, and flags requests that fall outside expected intent before the action happens. That’s a meaningfully different control from traditional access management because it catches an agent doing something unexpected with access it was legitimately given.
• Monitoring built for agent behaviour. Standard system logs won’t cut it. You need to see what an agent was asked to do, what information it received, what tools it used and what actions it performed in a form someone can actually review. A log line isn’t governance if nobody reads it until after something has already gone wrong.
• Lifecycle governance. Governance doesn’t stop once an agent is deployed. Permissions should be reviewed periodically, new tool integrations approved, prompts and workflows managed through change control, and agents retired when they’re no longer required. The same governance principles that apply to users should increasingly apply to AI agents.

Why AI Agent Governance Shouldn’t Slow You Down

The instinct is to treat governance as the thing standing between you and going live. Flip that round. Every one of these controls answers a question your leadership is already asking: what can it reach, what can it do, who owns it, is it being misused, can we see what it’s doing, can we stop it if we need to.

Answer those questions upfront and you remove the reason a project stalls in review. Skip them and you’ll answer the same questions later, under far less favourable conditions, with an incident already under way.

The organisations moving fastest with agentic AI aren’t the ones with the fewest controls. They’re the ones that worked out what they were actually governing before they switched anything on.

Not sure how far your current controls stretch to cover AI agents? Our cyber maturity assessment measures your security maturity, maps every gap to business risk and gives you a prioritised, board-ready roadmap, so you know what to fix before your next agent goes live.

Bottom Line

Agentic AI is a new category of governance problem, and it is behavioural. It collapses software governance and user governance into one thing, then adds the capacity to hallucinate, act on a bad decision and do it at machine speed.

• At PocketOS, an agent went from a credential mismatch to a deleted production database and deleted backups in nine seconds.
• A zero-click flaw in Microsoft Copilot, rated 9.3, let a single crafted email pull data out of OneDrive, SharePoint and Teams with no user action at all.
• In the GTG-1002 campaign, hijacked coding agents carried out an estimated 80 to 90% of an espionage operation against around 30 targets.

Governing what an agent can reach is no longer enough. The organisations that succeed will govern how it behaves, before their agents start making decisions on their behalf.