The fastest-growing AI governance blind spot

What good agent governance looks like

Agents are AI systems that act on their own, for example by approving a payment or updating a record, rather than just offering suggestions.

The gap between a weak and a strong governance position is rarely about intent. It is about whether governance has moved from assertion to evidence. Use the table below as a benchmark. Read across each row to see where your organisation sits, from weak to strong. It matters because a board, auditor or regulator will ask for evidence, not intent.

Agent governance maturity: where are you today?

The benchmark above shows what good looks like in five areas. This scale gives you one overall rating for your agent governance, from level 1 (no formal framework) to level 5 (continuously improved and independently validated). Each level reflects how far governance is documented, embedded across teams and independently tested.  Be honest about what you could evidence today, not what your policy says. The lower you score, the more the ownership and controls that follow matter.

Governance maturity should never be assumed. Until independently confirmed, treat it as unknown when planning, and set risk ratings accordingly.

A federated ownership model

Once you know where you stand, the next question is who closes the gap. Agent governance fails when it is owned entirely by one function, because no single team has visibility of both the technical behaviour of an agent and the business outcome it is meant to deliver. A federated model, with clear boundaries, is more practical. The example below is one way to split responsibility across four functions, so that every agent has an accountable owner and nothing falls between teams:

How organisations are starting to control agents

With owners in place, the focus moves to controls. Leading organisations are moving from policy statements to controls built into the agents themselves. The pattern is consistent: define what an agent may do, check it before it acts, and keep evidence that the controls work. You should:

1. Know the estate -have a maintained inventory of agents, each risk-classified and with a named owner.
2. Limit what agents can do -create a documented action scope, least-privilege access and approval gates for higher-risk actions.
3. Keep humans in control -have human sign-off on consequential decisions, with logging and a tested kill switch to pause or stop an agent.
4. Monitor and evidence -have continuous monitoring with escalation thresholds, independent testing and regular reporting to the board.

Where to start with AI agent governance

Whatever your score on the maturity scale, you should:

• build a full agent inventory, including agents that IT does not yet formally know about
• close the policy-to-control gap: test whether policy is actually reflected in approval gates and logging
• commission independent assurance against a structured risk and controls matrix, starting with the highest-autonomy agents.

If you would like support building your governance framework or assessing your current maturity, get in touch.