AI agent governance

Agentic AI governance · Agentic governance · Governance of AI agents

Definition

AI agent governance is the discipline of deciding what an AI agent may decide or do by itself, under which limits, who answers for it, how it can be stopped and how its actions can be proven afterward. It governs delegated decisions, where classic AI governance governs systems.

Why agents change the question

A model that drafts text leaves a person between its output and the world. An agent has tools, memory and the ability to plan, so it can issue a refund, change a price or delete a file with nobody in between. It behaves less like an advisor and more like someone holding a power of attorney, which is why the useful questions are the ones you would ask about a representative: what may it sign, up to what amount, and who is liable when it goes wrong?

Field research points the same way. In a September 2026 paper based on interviews with 25 organizations, the OECD reports that none of them runs agents with unrestricted autonomy, that autonomous execution stays within defined perimeters with human agreement on high-stakes or irreversible acts, and that turning principles into concrete engineering requirements is the governance difficulty cited most often.

The five questions a governed agent can answer

What may it decide? Its decision authority is written in a mandate, with figures.
What must never reach it? Non-delegable decisions are listed before any score is calculated.
Who answers? A named human, never the agent, and in ACF a DDAO who can refuse a deployment.
How does it stop? Through a kill switch that does not depend on the agent, tested rather than described.
What is left afterward? An audit trail that a third party can check.

Start from the decision, not from the agent

The ACF method reverses the usual order. Instead of picking a use case and then adding safeguards, you list the decisions that structure the activity, score each one, and only then decide whether an agent has a place. Two companies running the same agent can get opposite behavior, because what differs is the rules given to it.

To avoid starting from a blank page, ACF has classified 150 common decisions across 8 business functions into three zones: the agent acts alone, the agent prepares and a human validates, or the decision stays human. They are paired with 100 guardrails sorted by type of agent.

Detecting is not the same as preventing

Many tools document agents or report on them after the fact. Both are useful, and neither stops an action already under way. Governance becomes effective when a mechanism applies the rules at the moment the agent acts. Depending on volume, that mechanism can be a written procedure with a named validator or, once decisions run into the thousands, software. ACF Control plays that role: before an action runs, it authorizes it, adjusts it, blocks it or escalates it to a person, then keeps the signed record.

What the reference texts already say

Singapore published a Model AI Governance Framework for Agentic AI in January 2026. NIST's preliminary Cyber AI Profile states that "a human is assigned responsibility for the actions of an AI system". The EU AI Act never uses the word "agent" in its 2024 text, yet its rules on human oversight and record-keeping apply to agents that fall within a high-risk use.

Frequently asked questions

What is the difference between AI governance and AI agent governance?

AI governance looks at the system: its risks, data and documentation. AI agent governance looks at the decision the system takes on your behalf: who allowed it, within which limits, who answers and what proof remains. The second does not replace the first, it extends it to the point where software acts.

Do small companies need AI agent governance?

Yes, in a lighter form. One person can carry the responsible role part-time and the written rules can fit on a page. Software enforcement can wait until the volume of decisions makes human validation a formality.

Does AI agent governance slow down deployment?

It moves some effort earlier. What it prevents is the late discovery that nobody can defend a decision the agent has taken, and the prudence it asks for is what makes adoption defensible when an incident occurs.

Is there a standard for AI agent governance?

No shared standard has emerged yet: the OECD notes the absence of a common evaluation standard for agents. Organizations refer to the OECD principles, NIST AI RMF, ISO/IEC 42001 and the AI Act. ACF is a proposed method, open and free to use, that works at the level of the delegated decision and comes with no guarantee of legal compliance.

Where does your organization stand?

ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.

Take the ACF Score AI Act checker ACF Control

See all 25 terms in the glossary

Primary sources

Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated 2026-11-09.