The Agent Governance
Framework
Five controls decide whether your agent reaches production or dies in security review. Here they are in full. No form.
Copy it, adapt it, take it to your board. If you want help applying it, that part is at the bottom.
lack full visibility into their AI identities
do not enforce access policies for AI identities
effectively govern AI access to core business systems, though 71% report that access already exists
2026 CISO AI Risk Report, Cybersecurity Insiders and Saviynt, January 2026. Self-reported survey of 235 CISOs and senior security leaders at large enterprises. Vendor-sponsored, so read it for direction rather than precision.
Your Security Team Isn't Being Difficult
They are being asked to approve something that holds credentials, writes to systems of record, and cannot explain itself. Four questions come up in almost every review. Almost nobody answers all four.
Nobody Owns It
A business team stood it up. No registry, no named owner, no expiry on its access.
It Borrowed a Login
It runs on a person’s credentials. The audit log names the wrong actor, and revoking access disables an employee.
You Can't Reconstruct the Decision
Something went out wrong. Nobody can show what it read, what it concluded, or who approved the step.
There's No Off Switch
The only way to stop it is to page the engineer who built it, and hope they’re awake.
None of these are model problems. They are governance gaps, and they are why working pilots never get approved.
Five Controls. Every Agent. No Exceptions.
The full framework. Five controls, in the order a security reviewer asks about them. Each answers a question, produces an artifact, and has a specific failure mode when it is missing.
Identity
Every agent has a name, an owner, and an expiry date.
One list, every agent, including the ones a business team stood up without telling IT.
A named human who is accountable for what it does.
Its purpose, the systems it touches, and a date its authority ends. Renewal needs a signer.
You cannot answer “how many agents do we have, and what can they reach?” That question ends most security reviews before the demo starts.
Scoped Credentials
The agent gets its own keys, not a person’s.
A service identity per agent. Never a shared account, never a human one.
The smallest set of systems, records, and actions the workflow actually needs.
Killed in one action, without touching anyone’s access. Enforced at the resource, because a revoked long-lived token is still a live token.
Your blast radius is whatever that employee could do, and your only containment move takes a person offline with the agent.
Audit Trails
Every decision is written down, and the record can’t be edited later.
Input, retrieved context, action taken, and the model’s stated confidence. Log the reasoning summary too, but treat it as a narrative the model produced, not proof of how it decided.
What the human did next. Approved, edited, overrode, ignored.
Immutably, to your existing records policy, queryable by someone who is not an engineer. Redact personal data at write time so the record survives an erasure request.
Your incident review is guesswork, and your regulator gets an answer that starts with “we think”.
Human Gates
Approval sits where the consequence is expensive, not where the anxiety is loudest.
Consequence and reversibility. Written down before launch, reviewed on a schedule.
Cheap and reversible actions. Expensive or irreversible ones wait for a named approver.
Dollar value, record sensitivity, reversibility, retrieval-source trust. Model self-reported confidence is not calibrated, so log it as evidence and never wire it to a gate.
You choose between blanket approval, which nobody reads after week two, and blanket review, which removes the reason you built the agent.
Kill Switches
One control stops it, and somebody has tested that control recently.
Reachable by on-call, not only by the team that built it.
A severity-one control in its own right, with its own authorisation path.
Reversible work rolls back. Irreversible work, a sent email or a posted payment, gets fenced so it cannot re-fire, and the runbook names what you accept as lost.
Your containment plan is a message to the engineer who built it, and your time-to-stop is however long they take to reply.
What These Five Don't Cover
These govern ownership and permission. They do not govern adversaries. A framework that claims to cover everything is the one to distrust, so here are the gaps:
- Prompt injection. A compromised agent attacks you with its own legitimate credentials. Least privilege limits the damage. It does not prevent the compromise.
- Tool supply chain. Somebody has to vet the tool server your agent calls. Usually nobody does.
- Retrieval poisoning. If an attacker can write to what the agent reads, they steer it without touching the model.
- Model version changes. Thresholds you tuned last quarter are now tuned to something that no longer exists.
- Agents you don’t own the runtime for. The ones arriving inside your SaaS stack cannot be registered, credentialed, or stopped by you. That is a procurement problem before it is an engineering one, and it is the fastest-growing part of most estates.
Handled in the build and in vendor terms, not in this framework. Naming them is the point.
Hundreds of Systems Shipped. Six Agents You Can Inspect.
Fair question: has any of this actually run? The agents on our development page ship with permission boundaries, audit logging with full lineage, human-in-the-loop checkpoints, and rollback. Named agents, real traces, real numbers.
Bring us one workflow. We prove it pays, build it properly, control it so security signs off, and keep it running after everyone else has moved on.
Governance is the fourth clause. It’s also the one that decides whether the first three ever reach a user.
Where the Five Controls Map to NIST
Structured against NIST AI RMF 1.0 and its four functions: Govern, Map, Measure, Manage. Where an agentic-specific control exists we name it, from the Cloud Security Alliance’s NIST AI RMF Agentic Profile, a draft white paper published April 2026. Every control ID below is quoted from it so you can check us.
| Control | NIST AI RMF function | Agentic Profile reference | What a reviewer asks you for |
|---|---|---|---|
| Identity | Govern | AG-GV.3 Agent Lifecycle Governance | The agent registry, with owners, authorities, and expiry dates. |
| Scoped Credentials | Map | AG-MP.1 Tool Risk Classification | The permission matrix: which agent can reach which system, and what it can do there. |
| Audit Trails | Measure | AG-MS.1 Behavioral Telemetry | A reconstructed decision, end to end, for a date they pick. |
| Human Gates | Govern | AG-GV.1 Autonomy Tier Classification, AG-GV.2 Delegation Accountability | The written gate policy, and evidence the gates fired. |
| Kill Switches | Manage | AG-MG.1 Incident Response | The runbook, and the date of the last successful test. |
Score Your Agent Estate in Two Minutes
Ten questions, two per control. Answer for the agents running today, not the roadmap. Score conservatively: if you’d have to ask someone to confirm it, it’s a no. Nothing is sent anywhere, nothing is stored.
Check the statements that are true today. Your tier and where to start will appear here.
Want the long version? The self-assessment workbook has all 40 questions, the scoring rubric, and a board-ready summary page.
Request the WorkbookYou May Already Own Most of This
Agents are new identities in systems you already run, so a lot of this is configuration, not procurement. We don’t sell a governance platform. That’s why our answer can change with your estate.
Your existing stack covers it
Run Okta, SailPoint, or Entra for identity and Splunk or Datadog for telemetry? Agents become first-class identities in what you own. Controls 01 to 03 are mostly configuration, not a purchase.
Policy tooling helps, to a point
Credo AI and IBM watsonx.governance handle policy, documentation, and regulatory mapping well. They generally do not stop a running agent mid-action. Controls 04 and 05 still get built into the runtime.
The controls live in the agent
When the workflow is your edge, gates and kill switches belong in the runtime itself, in your repo, owned by you. That is engineering, and it is the part governance vendors don’t do.
Most land on a mix of all three. The framework doesn’t change. Who builds each piece does, and that is the first thing we work out. See how we build →
The Governance Assessment
Two weeks. Your estate scored against all five controls, with a remediation plan that has owners and dates on it.
From $25K
Two weeks. Half the fee credits against the implementation.
Thirty minutes with a senior engineer, not a salesperson.
What you get
- An agent inventory built from your identity provider’s service accounts, API gateway traffic, SaaS admin audit logs, and a structured pass across business units. Two weeks will not surface everything. It will surface the agents holding credentials to systems of record, which is the set that matters.
- Each one scored against the five controls, with the gaps ranked by consequence rather than by effort.
- A remediation plan with named owners, sequence, and dates, split into what you configure and what gets built.
- The artifacts a reviewer asks for: registry, permission matrix, gate policy, and a kill-switch runbook written against what your runtime can do today, with the gap to what it should do.
- A readout your security lead and your CFO can both sit through.
How We Handle Your Estate While We're In It
You are letting an outside firm enumerate identities, read audit logs, and map permissions. Your third-party risk team asks this first, so here it is up front.
Onshore, employees only
No offshore delivery and no subcontractors on this work. The people who see your estate are on our payroll and background checked.
SOC 2 Type II
Held by Field1st, our product company, and the same control environment governs this engagement. Report available under NDA.
Least access that answers the question
Read-only wherever read-only is enough. We do not ask for write access to run an inventory.
Your data stays yours
Findings are returned or destroyed at close, and the readout is written so you can circulate it internally without republishing anything sensitive.
AI Agent Governance, Answered
What is AI agent governance?
AI agent governance is the set of controls that make an autonomous AI agent accountable: knowing which agents exist and who owns them, giving each one its own scoped credentials, logging every decision immutably, requiring human approval where the consequence is expensive, and being able to stop any agent on demand. It is distinct from AI model governance, which is concerned with how a model was trained, evaluated, and documented. Governance for agents is about what the software is permitted to do in your systems.
How is agentic AI governance different from traditional AI governance?
Traditional AI governance mostly asks whether a model’s outputs are accurate, fair, and explainable. An agent doesn’t just produce an output, it takes an action: it writes to a system of record, sends something to a customer, or moves money. That shifts the questions from bias and accuracy to identity, permission, auditability, and containment. A model that is wrong produces a bad answer. An agent that is wrong produces a bad answer and then acts on it.
What are the risks of running AI agents without a governance plan?
Four show up most often. Agents accumulate access nobody tracks, because they inherit a person’s credentials. Incidents can’t be reconstructed, because the reasoning wasn’t logged. Approval becomes all or nothing, so either everything is rubber-stamped or nothing ships. And when something goes wrong there’s no tested way to stop it quickly. In practice the most common outcome is not a dramatic failure, it’s a working pilot that never gets approved for production.
Do we need an AI agent governance platform?
Often not, or not only. Agents are new identities in systems you already own, so a meaningful share of the work is configuration inside your existing identity and observability stack. Governance platforms are useful for policy, documentation, and regulatory mapping. They generally do not enforce a human approval gate or stop a running agent mid-action, so those controls still get built into the agent itself. The honest answer depends on what you already run.
Does NIST have a standard for AI agents?
Not a certification. The NIST AI Risk Management Framework 1.0 provides four functions, Govern, Map, Measure, and Manage, which apply well to agents but were not written specifically for autonomous action. The Cloud Security Alliance published a NIST AI RMF Agentic Profile as a draft white paper in April 2026, adding agent-specific controls for autonomy tiers, delegation accountability, tool risk, behavioral telemetry, and incident response.
Nobody can certify you as NIST-compliant for agents today, so a vendor claiming their product does that is selling you something that doesn’t exist. What alignment actually buys you is a shared vocabulary with your auditors and a defensible answer to “how did you decide this was safe.”
What about ISO 42001 and the EU AI Act?
ISO/IEC 42001 is the one you can actually be certified against. It certifies an AI management system at the organization level, not any individual agent, and that distinction is worth holding onto: passing 42001 does not mean the agent that moved money last Tuesday was governed. The two are complementary rather than competing.
The five controls produce evidence that lands directly in a 42001 audit, and Controls 03 and 04 map to the EU AI Act’s logging and human-oversight obligations for high-risk systems. If you are already inside either process, the useful move is to score your estate against the five controls and bring the gaps into that workstream rather than running a second one beside it.
How long does it take to govern an agent estate?
Scoring the estate and producing a remediation plan takes about two weeks. The remediation itself depends almost entirely on how much of the identity and logging work your existing stack can absorb. Teams with mature identity management often close Controls 01 and 02 in weeks, because those are configuration in systems they already run. Audit trails, human gates, and kill switches take longer: they are runtime instrumentation built into each agent, not something bolted on around it.
Bring Us One Agent You Can't Approve
Thirty minutes with a senior engineer. You’ll leave knowing which of the five controls is actually blocking you, whether your existing stack can close it, and what proving that would cost.
The agent, the systems it touches, and who has to sign off. That is enough to start.