AI agent governance can’t be bolted on

AI agent governance is the set of rules and controls that decides what each AI agent may access, what it may do and who answers for it, and that records every decision an agent makes so a person can check it later.

It isn’t the AI governance most companies already have. That kind reviews models: is the output accurate, fair, safe to show? Agents don’t stop at output. They send the email, change the price, approve the refund. A model that gets it wrong says something wrong. An agent that gets it wrong does something wrong, and often it can’t be taken back.

So agent governance has to answer four questions about any agent, at any moment.

1. Who is it? A unique identity, and a named person who owns it.
2. What may it touch? The data, tools and systems within its reach, and nothing more.
3. When does a person decide? The actions that need a human approval before they happen.
4. What did it do, and why? A record of each decision: what the agent read, which rule allowed it and on whose authority it acted.

It isn’t data governance either, although it depends on it. Data governance governs the asset: what a record means, who owns it, who may use it. Agent governance governs the actor: what an agent does with that record once it has it. An agent with perfect permissions acting on an out-of-date fact is still wrong, which is why context needs governing too.

Because agents have been given authority faster than anyone built the controls around them.

Look at what sits behind the second number. Access control is the most basic guardrail there is, and only 40% of the organizations in IBM’s study used it on AI models and data at all. The same report found AI governance missing at 68% of breached organizations, up from 63% a year earlier. Adoption is outrunning oversight, and the gap is getting wider, not narrower.

Meanwhile the rules have arrived. Not all at once and not all binding, but they point the same way.

The EU AI Act doesn’t define an agent. It regulates AI systems by what they’re used for, and an agent is an AI system like any other. An agent that screens job applicants or scores credit is high-risk. Its provider has to build in the automatic recording of events over the system’s lifetime (Article 12). Its deployer has to assign human oversight to people with the competence, training and authority to exercise it, and keep the logs for at least six months (Article 26). The Digital Omnibus moved those high-risk obligations to 2 December 2027. That’s a reprieve, not a repeal: the date moved, the requirements didn’t.

Most marketing and service agents won’t be high-risk. But Articles 12 and 26 are the clearest description yet of what a regulator will expect to see when an agent’s decision is questioned: a log, and a person who was responsible.

NIST’s AI Risk Management Framework is voluntary, and its four functions, Govern, Map, Measure and Manage, are the vocabulary most US risk teams already speak. It was written before agents. NIST launched an AI Agent Standards Initiative in February 2026, and its first piece of work, on agent identity and authorization, is still a draft concept paper.

Singapore’s Model AI Governance Framework for Agentic AI is the first written for agents specifically. IMDA launched it at Davos in January 2026 and updated it in May with feedback from more than 60 organizations. Its four dimensions read like a checklist: assess and bound the risks upfront, make humans meaningfully accountable, implement technical controls and processes, and enable end-user responsibility. On identity it is unusually concrete. Every agent should have its own unique identity, tied to a supervising human or department, and to prevent agent sprawl, those identities “should be issued from and tracked by a centralised system.”

The vendors are converging on the same idea. Microsoft’s Entra Agent ID gives every agent its own identity, with a registry and least-privilege access across the agent’s lifecycle. Identity companies such as Okta now treat agents as a workforce to secure. Their numbers, and IBM’s, show how far most companies are from that.

Read side by side, the frameworks agree on more than they differ. Every agent identifiable. Every agent bounded. A human accountable. Every decision on record. None of them tells you how to get there with forty agents from twelve vendors.

Because most agents arrive with their governance already inside them. The CRM’s agent comes with the CRM’s permission model, the CRM’s approval settings and the CRM’s log. So does the ad platform’s agent, and the help desk’s. Buy ten agents tool by tool and you have ten rulebooks, written in ten dialects and enforced inside ten walls. That’s agent sprawl, seen from the risk side.

Bolting governance on means writing a policy above all of them and hoping it holds. In practice it breaks in four places.

One rule, ten configurations. “No discount above 15% without approval” has to be set in every tool that can give one, in each tool’s own terms, and kept in sync. Miss one setting and, for that agent, the rule doesn’t exist.

Borrowed identities. Vendor agents act under service accounts, API keys or the login of whoever set them up. The log says a person or a key did it. Nobody can say which agent.

Logs that never meet. A decision that passes through three agents leaves three partial records in three systems. Reconstructing why it happened becomes a forensic project, and an auditor’s question takes weeks to answer.

Hand-offs nobody guards. When one vendor’s agent passes work to another’s, the work crosses a gap where neither vendor’s rules apply.

An inventory and a policy document are worth having. But you can’t audit your way out of an architecture.

Most products sold as AI guardrails are filters on the model. They screen prompts and responses for leaked data, toxic content and jailbreak attempts. They’re useful, and they aren’t enough: they check what an agent says, not what it does.

System-wide guardrails sit around the agents instead of inside each one: one identity model, one policy layer, one approval model and one decision log. Every agent runs inside them, whichever model or vendor powers it.

In our name, the guardrails are the brackets. [MAAD] stands for four layers: Meaning, the context agents read; Anchor, the identity of every customer and every agent; Agents, the workers with real authority; and Decision, what they do in production. The brackets don’t belong to any one of the four. They surround all of them.

Design them into the system before the agents arrive, then let every agent inherit them. Six steps, in this order.

1. Give every agent an identity and an owner. Its own identity, never a shared service account, issued from one central registry and tied to a named person or team. When the agent’s job ends, its identity retires with it.
2. Bound what it may touch. Grant access per task, not per connector. An agent that reads customer data to draft a reply doesn’t need permission to change a price.
3. Write the rules once. One policy layer that every agent checks before it acts: limits, thresholds, consent, brand rules. Change a rule there and every agent follows it at once.
4. Decide where humans decide. Set approval thresholds by how costly and how reversible an action is. A €20 goodwill credit can go through; a price change waits for a person. Then keep the approvals meaningful. A reviewer who approves everything is a rubber stamp, not oversight.
5. Log decisions, not just actions. For each decision, record which agent acted, on whose authority, what it read, which rule allowed it and what it did. “HTTP 200 at 02:14” is an action log. A decision log answers finance’s three questions in a minute.
6. Test before launch, watch after. Test every agent against the policies before it goes live, then monitor for agents acting outside their scope. The OWASP Top 10 for Agentic Applications is a good list of what to test against.

Built this way, governance gets cheaper with every agent instead of more expensive. The fortieth agent doesn’t need its own rulebook. It inherits the one that’s already there.

None of them on its own, because each answers a different question. They stack.

The EU AI Act is the law: what you have to be able to prove if you operate in the EU.

ISO/IEC 42001 is a management system standard you can be certified against: how you run AI governance as a process.

The NIST AI RMF is the shared vocabulary for AI risk, and the one US customers and partners will expect.

Singapore’s agentic framework is the most practical playbook written for agents specifically.

The OWASP Top 10 for Agentic Applications is the threat list your security team tests against.

For a European company, a sensible stack is the AI Act as the floor, Singapore’s framework as the agent playbook and ISO/IEC 42001 when customers ask for a certificate.

But every framework is, in the end, a list of questions. Which agents do you run? Who owns each one? What may it do? What did it decide, and why? The framework decides which questions get asked. The architecture decides whether you can answer them in a minute or in a month.

Only when it’s bolted on. A company that can’t answer finance’s three questions has one safe move: keep its agents on a short leash, with a person checking everything they do. A company that can answer them can give its agents real authority, because every decision can be traced, checked and, where it has to be, reversed.

That’s what we build at House of [MAAD]: the guardrails around the whole system, designed in from the start, so the agents inside them can be trusted with real work.