Operate
Governance is how a company stays in control after the first agent works.
Without it, every team launches a side agent. With too much of it, nothing reaches production. The job is a short set of rules an operator can use.
How I see it
AI agent governance
Agent governance should answer four questions. Who may put an agent on a workflow? What actions require approval? How is the agent evaluated after launch? Who can shut it off?
That is enough for a first production agent. A 40-page responsible-AI policy is not. The COO needs a decision path that lets a valuable workflow move and stops a risky one from going live on a Friday afternoon.
Governance also includes the do-not-fund list. Some work should stay human. Some work should stay a report. Recording those decisions is part of the system.
As more agents appear, governance becomes portfolio management: owners, cost, quality, and overlap. It should not become a transformation office.
Common mistakes
What teams usually get wrong.
Policy without an owner
A document nobody can apply will not stop a shadow agent or help a good one launch.
Committee as a default
If every change needs six approvals, the company will either stall or go around the process.
Governance after the incident
The first write-back is the moment to have rules, not the first customer complaint.
A useful diagnostic
Five questions before you fund the work.
Can you name the person who can approve a production agent this month?
If not, you have opinions, not governance.Is there a written list of actions agents may not take?
A blank page means every team will invent its own boundary.Do launched agents have a review date and an owner?
Unowned agents become abandoned software with access.Is there a kill switch that operations can use?
Governance that cannot stop the system is ceremonial.Are overlapping agent projects visible in one place?
If not, you will fund the same workflow twice.
Economic model
Minimum governanceapprover + forbidden actions + owner + review cadence + kill switch
Add more process only when a second or third agent makes the minimum insufficient.
Three credible paths
How far should you go?
Do not force one solution. Choose the path the economics, the risk, and the organization can support.
One-page rules for the first agent
Write the owner, the allowed actions, the review date, and the shutoff path.
You are launching the first production workflow.
Will not cover a portfolio.
Lightweight portfolio review
Review agents monthly for value, cost, quality, and overlap.
Two or more agents are in production or in build.
Needs a single person who can say no.
Shared controls
Standard identity, logging, evaluation, and approval patterns across agents.
Several teams want to build and the first controls have been proven.
Can become a platform program if you start here.
When this is the wrong next step
Do not fund an agent here.
- The company wants a governance program instead of a first production result.
- Legal wants a complete policy before anyone may see a workflow baseline.
- There is no executive who will accept responsibility for a no.
A useful next step
Bring one workflow. Get guided into production.
We guide the implementation, go deep on the technical path, and stay hands-on through operations — or tell you when a simpler answer is better.
Discuss an AI opportunity