Why does agent governance exist apart from AI governance?
Because the failure mode changed. A chatbot that errs says something wrong; an agent that errs approves a transaction, emails a customer or deletes a record. Classic AI governance frameworks review models and use cases; agent governance has to control behavior at runtime, where the consequences are. The unit of governance shifts from the model to the action, which is why the practical controls look like security engineering rather than policy writing.
What are the core controls?
Five keep recurring across frameworks. Each agent gets its own agent identity, never a person’s borrowed login, so actions attribute cleanly. Access is least privilege per tool and data source, granted temporarily where possible. Consequential actions pass a tool approval gate, enforced outside the model so the agent cannot reason its way around it, the job of an agent policy engine. Everything lands in an agent audit trail. And every agent has a named human owner who answers for it. An agent nobody owns is an incident with a start date.
Who is pushing agent governance frameworks?
By late 2026, everyone with exposure. Microsoft wired governance actions such as blocking and owner reassignment into its agent platform; the American Medical Association published a framework for agentic AI in clinical settings built on four questions about function, performance, permitted actions and accountability (Healthcare Dive, 15 October 2026, read 19 October 2026). Analyst guidance converges on the same registry-identity-least-privilege core. The frameworks differ in vocabulary and agree in architecture, which is a sign the practice is settling.
What does agent governance look like for a mid-sized company?
Lighter than the enterprise versions, same skeleton. An inventory of every agent in use, including the unsanctioned ones that arrive embedded in SaaS. One owner per agent. Budgets and caps enforced in software. A log you could hand an auditor. And a standing review that retires agents that stopped earning their access. Govern the estate you actually have, not the one on the architecture slide: most of the risk lives in agents nobody wrote down.