Introduction
Traditional AI risk asks what a system generates. Agentic AI risk also asks what a system is authorized to do. That second question changes who owns the risk, what evidence you need, and how fast things can go wrong.
The exposure is growing. KPMG's Q3 survey found 62% of surveyed executives are building, testing or deploying agents. Gartner forecasts that over 40% of agentic projects will be canceled by the end of 2027, partly because of inadequate risk controls.
This article is for boards, audit and risk committees, executives, CISOs, CIOs, legal teams, and risk leaders at US enterprises. It covers a risk-tiered framework, lifecycle controls, decision rights, evidence requirements, and a roadmap for scaling without losing accountability.
Key Takeaways
- Agents add action, execution, and outcome risk to accuracy and bias risk.
- Every agent needs a named owner, defined authority, limited access, and an auditable action record.
- Hard-to-reverse actions need approval gates, transaction limits, or mandatory escalation.
- Boards own risk appetite and accountability; management owns execution and remediation.
What Changes When AI Can Act
An agentic system perceives context, reasons toward a goal, calls tools or APIs, and completes multistep tasks with limited human intervention. Deloitte describes these agents as completing complex tasks with little or no human supervision.
The contrast with an assistant is simple. An assistant recommends a refund. An agent issues it, emails the customer, and updates the record.
Authorization and scope risk
The first question after any incident: did the agent have explicit authority for that action? Permissions can also expand through prompt manipulation, misconfiguration, or chained workflows. OWASP's agentic list names goal hijacking, tool misuse, and identity and privilege abuse as core threats.
Irreversibility and blast radius
Not all actions carry equal weight. Drafting an internal summary is reversible. These are not:
- Financial transactions
- Customer record changes
- External communications
- Regulated decisions
- Destructive changes
A widely reported 2025 case involved a coding agent that deleted a live production database during an experiment. One case is not an incident rate, but it shows the failure shape.
Attribution and cascading risk
When an error travels across systems, agents, and vendors, you need to trace the agent, the human approver, the policy state, the data used, the tool calls, and the downstream effects. Without that chain, nobody can explain what happened to a regulator, an auditor, or a board.
A Practical Agentic AI Risk Management Framework
Build an agent inventory and system boundary
Keep a central inventory of every production agent and material pilot. Record:
- Business purpose and named owner
- Model or provider, and connected tools
- Data sources and permissions
- Deployment environment and human oversight
- Vendors and dependencies
Then define the workflow boundary: where the agent can read, write, communicate, approve, purchase, delete, or delegate, and which external parties are involved.
Risk-tier use cases by autonomy and impact
Score each use case on:
- Decision impact and data sensitivity
- Autonomy and reversibility
- Transaction value and blast radius
- Effect on customers or employees
- Regulatory relevance
Tie each tier to minimum requirements for testing, approval, identity, logging, monitoring, human review, and reassessment.
The Cloud Security Alliance's Agentic Trust Framework offers a useful model:
- Observe and report
- Recommend with approval
- Act with notification
- Act autonomously within a domain
It is a proposed framework, not a benchmark. Avoid treating any agent as fully safe or fully prohibited.
Assign decision rights
Name who:
- Approves the use case
- Owns the business outcome
- Operates the agent
- Controls access
- Advises on privacy and legal duties
- Can suspend the agent
Write escalation thresholds in language people can use mid-incident. Policy binders fail at runtime.
Each top risk needs one accountable leader, with board escalation defined separately from management.
Apply controls across the lifecycle
| Phase | Controls |
|---|---|
| Pre-deployment | Use-case approval, data assessment, threat modeling, adversarial and sandbox testing, permission review |
| Runtime | Policy checks before tool calls, approval gates, identity verification, rate limits, full action tracing |
| Post-deployment | Drift detection, revalidation, access recertification, incident review, change management, retiring unused agents |
Map to standards and obligations
Use recognized references as guides, not safe harbors:
- NIST AI RMF (Govern, Map, Measure, Manage), which sets no universal agent risk tiers
- ISO/IEC 42001 for an AI management system
- NIST CSF 2.0 and SP 800-53 for security baselines
- NIST's 2026 concept paper on agent identity and authorization, which is not yet a standard
Legal exposure depends on your use case, and counsel should validate applicability. Current examples include:
- Colorado's SB26-189 (replacement developer obligations begin January 1, 2027)
- California's ADMT rules (compliance begins January 1, 2027)
- NYC Local Law 144 and Texas TRAIGA
Sector rules matter too. FINRA's 2026 oversight report flags agent access, human oversight, and action tracking, while HIPAA, GLBA, and EEOC guidance apply through existing law. The FTC has stated there is no AI exemption from existing law.
Controls for Governing Agentic AI in Production
Identity and least privilege
Treat each agent as a distinct non-human identity with unique credentials, narrow permissions, separate environments, and short-lived or task-bound access. OWASP's non-human identity list flags overprivileged identities and long-lived secrets as top problems.
- Eliminate shared administrator credentials
- Review permissions whenever the agent's purpose changes
- Separate authority to create, approve, execute, and modify high-impact actions
- Run quarterly access reviews
Tool and action authorization
Enforce policy at the execution layer, before the API call, database change, message, or transaction happens.
Core controls include:
- Allowlists for tools and destinations
- Constrained parameters and validated context
- Transaction, volume, time, and data-boundary limits
- Defined handling for requests outside the agent's purpose
UK AISI testing found that asynchronous monitoring gives weaker safety guarantees than synchronous checking. Monitoring supplements prevention; it does not replace it.
Human-in-the-loop controls
Decide in advance which actions need human approval, based on impact, reversibility, affected parties, legal or financial consequences, and uncertainty. "Human oversight" as a vague principle fails.
Give reviewers the proposed action, relevant data, policy reason, uncertainty indicators, and the clear ability to reject, modify, or escalate. A reviewer who only clicks approve is not oversight.
Data protection and provenance
Classify the data agents can reach. Restrict retrieval, sharing, caching, prompts, embeddings, logs, and outputs by sensitivity and purpose. Capture where key data originated, when, how it was transformed, and which agent or tool used it. W3C's PROV-DM offers a general provenance model.
Observability and evidence
Logs should connect the full decision chain:
- Initiating user or event and instructions
- Model version and retrieved information
- Tool calls, identity, and policy decisions
- Approvals and final actions
Protect logs from alteration and set retention periods. NIST SP 800-53 AU-9 covers protection of audit information, though not every log is automatically tamper-evident. For vendors, require logging, evidence retention, and deletion on termination in contracts.
Testing, resilience, and containment
Test before and after deployment for:
- Prompt injection and unauthorized tool use
- Privilege escalation and data leakage
- Unsafe delegation and chained-agent failures
- Context drift and runaway loops
Add sandboxing, rate and cost limits, rollback procedures, continuity plans, and a tested emergency suspension mechanism for critical agents. Test break-glass access too.
Operating Model and Board Oversight
Board and committee oversight
Directors need a concise view of:
- Agent inventory and highest-risk use cases
- Material changes, control exceptions, and incidents
- Open decisions and trend against risk appetite
Only 31.6% of S&P 500 companies disclosed any board AI oversight in 2024, according to ISS-Corporate. That figure covers AI broadly, not agents specifically.
A workable rhythm:
- Quarterly board updates and monthly committee touchpoints
- A one-page dashboard: top risks, what changed, decisions needed
- Three-month trends against approved thresholds
- Full-board time reserved for material thresholds and major incidents
Use plain English. Activity counts without business exposure do not help directors decide.
Management accountability
Name owners across business, technology, security, privacy, legal, procurement, data governance, compliance, and internal audit. Create a repeatable forum to approve use cases, resolve control conflicts, escalate incidents, and reassess agents after major model, tool, data, or process changes.
Exceptions should carry:
- A named owner
- A compensating control
- An expiry date (for example, 60 or 90 days)
People and vendors
Train teams on agent behavior, exception handling, secure tool integration, and escalation.
Extend due diligence to model providers, software and data vendors, and external agents. Cover security, logging, incident notification, data use, service changes, and termination.
A Practical Implementation Roadmap
Establish the baseline and pick one bounded use case
Start with an inventory of known and suspected agents, a current-state control assessment, and a defined risk appetite. Choose one high-value workflow with limited permissions, clear inputs, and measurable outcomes.
A one-page appetite statement should define protected priorities, unacceptable impacts, and materiality anchors such as money, downtime, customer harm, and legal duty.
Assign a business owner and control owners before testing. Document what the agent may do, what it may never do, and when it must escalate.
Design, test, and evidence the controls
Apply the control set for the chosen use case:
- Risk tier and identity model
- Data limits and tool allowlists
- Approval points and audit requirements
- Monitoring signals, incident procedures, and a suspension mechanism
Validate normal and failure behavior with sandbox and adversarial scenarios. Record test results, exceptions, approvals, remediation owners, and residual risk.
Operate, report, and scale deliberately
McKinsey recommends bounded autonomy, with expansion only after monitoring shows predictable behavior. CISA-coauthored guidance likewise supports phased deployment and graduated autonomy. Neither provides a measured benchmark, so set your own thresholds.
Start with constrained production access and track:
- Authorized-action rates and policy violations
- Approval outcomes and drift indicators
- Data-boundary exceptions
- Incident response performance
- Suspension and recovery test results
Report material changes to management and the board committee, and reassess before expanding autonomy. Accountable execution of those decisions depends on clear decision rights, escalation thresholds, and a 90-day plan with owners and measurable outcomes. Tyson Martin supports boards and executive teams on that work as a board advisor and interim or fractional CISO.
Frequently Asked Questions
What is agentic AI?
Agentic AI systems plan, use tools, make decisions, and execute multistep actions with limited human supervision. A chatbot or generative assistant produces content; an agent acts on it.
What is the agentic AI governance framework and how does it work?
It combines agent inventory, risk tiers, decision rights, lifecycle gates, runtime controls, monitoring, evidence, and continuous reassessment. Higher-impact agents face stricter requirements.
How are enterprises using agentic AI?
Customer service leads: PwC's survey found 57% of agent-using companies report current or planned use. Procurement, IT operations, finance, and workflow automation follow. Each needs controls scaled to its impact.
What controls should an organization put around AI agents?
Start with non-human identity, least privilege, tool authorization, human approval thresholds, data controls, logging, testing, rate limits, and emergency suspension.
Who is accountable when an AI agent takes a harmful action?
Named human owners and decision-makers, through documented authority, approvals, audit trails, and escalation paths. Accountability never transfers to the agent.
How should boards oversee agentic AI risk?
Boards oversee risk appetite, material use cases, accountability, significant exceptions, incidents, and trends. They should also ask management to show that controls work in practice.
