AI agent governance

Three principals, not one

The most common modelling error is treating an agent as a single identity. In practice a privileged action involves three distinguishable things: the agent itself, the human or service it acts on behalf of, and the credential it presents to the target system.

Collapsing these makes attribution impossible. When an audit asks who approved a change, "the automation account" is not an answer; it is the absence of one.

What a registry has to record

An inventory that lists names is not a registry. Governance needs the fields decisions depend on.

• Accountable owner, and a review date for that ownership.
• Purpose — the task this agent exists to perform.
• Provider, model and framework, versioned, so a change is visible.
• Environment and trust state — unmanaged, observed, registered, verified or privileged.
• Effective authority — the tools, data scopes and actions currently reachable, not those originally requested.
• Delegation relationships, in both directions.

Authority is temporary, not configuration

Human access is periodically recertified. Agent permissions are usually granted once at build time and never revisited, which is how a prototype ends up with production credentials two years later.

Treating agent authority as temporary — scoped to a task, time-boxed, reviewed on a schedule, and revoked when the owner or purpose changes — removes most of the standing risk without constraining legitimate work.

Delegation must narrow

When one agent hands work to another, the receiving agent should never end up with more authority than the delegating one. This is easy to state and easy to violate: a chain of agents each using its own service account can quietly assemble a union of permissions no single step was granted.

Governance that does not model the delegation chain cannot detect this, because each individual grant looks reasonable.

Common questions

How is agent governance different from model governance?

Model governance concerns how a model behaves — accuracy, bias, evaluation. Agent governance concerns what software is permitted to do: which tools it calls, which data it reaches, and what it can irreversibly change.

Can existing IAM govern AI agents?

Partly. IAM represents identities and grants well, but was built for humans and long-lived service accounts. It typically has no model for an agent acting on a person's behalf, delegating to another agent, or having its authority evaluated per action.

What is the first step?

Inventory. Every other control — ownership, least privilege, approval, evidence — depends on knowing which agents exist and what authority they currently hold.