Agentic AI in the enterprise: a governance-first blueprint

The most useful reframing we have found: an agent is a non-human identity that takes actions. Your organisation already has a mature framework for those - service accounts, scoped credentials, least privilege, audit logging, rotation policy. Almost none of it gets applied to agents, because agents arrive through an innovation channel rather than a platform one.

Start by giving each agent its own identity rather than borrowing a developer's credentials or a shared integration account. That single decision makes every subsequent control possible: you can scope permissions per agent, revoke one without affecting others, and answer the question 'which agent made this change' from logs you already collect.

For every tool you expose to an agent, write down the worst thing it can do if the model is confidently wrong. A read-only query tool has a small blast radius. A tool that issues refunds, amends records or sends external email has a very large one, and belongs behind an explicit human confirmation step until you have evidence to justify removing it.

We split tools into three tiers. Tier one is read-only and unrestricted. Tier two writes to systems but is reversible, logged and rate-limited. Tier three is irreversible or externally visible, and always requires a human approval that is recorded with the approver's identity. Most agent deployments that go wrong do so because tier three was treated as tier two.

Cost is part of the blast radius too. An agent in a retry loop against a frontier model can spend a startling amount overnight. Hard per-agent, per-day token ceilings - enforced at the gateway, not in prompt instructions - are non-negotiable.

A demo proves an agent can succeed. What governance requires is knowing how often it fails and in what way. Build a evaluation set from real historical cases with known correct outcomes, and run it on every prompt change, model change and tool change. Version the results.

Report two numbers to your risk function: task success rate, and - more importantly - the rate at which the agent produces a confident wrong answer rather than declining. The second number is what determines whether a human checkpoint can safely be removed, and it is the one nobody measures.