Agentic AI: what changes when the system acts, not just decides

What agentic AI is, and what it is not

A classic AI systemAI systemA machine-based system that, for explicit or implicit objectives, infers from input how to generate outputs (predictions, content, recommendations or decisions) that can influence physical or virtual environments. The OECD-style definition followed by the EU AI Act.Open full entry → produces an output: a score, a recommendation, a draft. A human looks at that output before anything happens in the world. That human review is a natural checkpoint, and the responsible-AI principlesprincipleOne of the seven responsible-AI values a governed system should live up to (fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, human oversight). A principle is abstract: it states an outcome, not a lever you can pull. It becomes governable by naming the harm that would breach it, assessing the risk that harm carries, and placing controls against that risk. Held this way, a principle becomes a pillar. See pillar, harm, risk.Open full entry → were worked out with that checkpoint in place: fairnessfairnessThe responsible-AI principle that systems should not create or reinforce unjust discrimination; operationalized through bias testing, representative data and per-group thresholds. It has multiple, mutually incompatible mathematical definitions. Under the EU AI Act, providers of high-risk AI systems must examine their data sets for possible biases (Article 10), and several discriminatory uses are prohibited outright (Article 5). See bias, proxy discrimination, high-risk AI system, responsible AI.Open full entry → is verified on the output, oversight happens at the output, accountabilityaccountabilityThe principle that a named human or organization answers for an AI system's outcomes, through ownership, documentation, audit trails and redress; never the system itself. The EU AI Act attaches obligations to the role rather than the technology, with provider duties in Article 16 and deployer duties in Article 26, supported by technical documentation (Article 11) and record-keeping (Article 12). See provider, deployer, record-keeping, responsible AI.Open full entry → attaches to the person who acted on the output.

An agentic system is different in one decisive way: it acts. It plans a task, chooses tools, executes a step, reads the result, and executes the next step, each step feeding the one after it. A payment gets made, a case gets closed, a message gets sent, and the human is no longer positioned between every step and its consequence.

This is not a niche pattern. Agents are moving from experiments into core business workflows across the software organizations already run, and industry projections put agent functionality inside a large share of enterprise applications within the next few years. The governancegovernanceThe system through which an organization steers itself: corporate governance, risk management, compliance, lines of accountability, risk appetite, and the operating model. It exists across everything the organization does, before and beyond AI. AI governance is this same system extended for AI. See AI governance, governance design, execution level.Open full entry → question is no longer whether an organization will run agents, but whether it will govern them deliberately or discover them after the fact.

What agentic AIagentic AISystems where a model takes actions (calling tools, executing multi-step plans), amplifying both capability and every failure mode; governed with action allowlists, approvals and full logging.Open full entry → is not: it is not an eighth principle. Fairness, safety, privacyprivacyThe principle that personal data used by or produced through an AI system stays within the purpose and the legal basis it was collected for. Three routes cause most of the trouble: personal data in training material that was never intended for it, model output that reproduces what the model retained, and purpose creep, where a system built for one use drifts into another the original basis never covered. The GDPR governs this in full, and the EU AI Act adds data governance duties for high-risk systems (Article 10). See DPIA, purpose limitation, responsible AI.Open full entry →, security, transparencytransparencyOpenness about the fact that AI is used and how it operates in general: disclosures, documentation, notices. Pairs with explainability, which addresses individual outcomes.Open full entry →, accountability, and human oversighthuman oversightDesigned-in human ability to monitor, intervene in, override or shut down an AI system. It is meaningful only when the human has authority, information and time to act. One of the seven pillars of responsible AI, and under the EU AI Act a requirement for high-risk AI systems: Article 14 requires that those systems are designed so natural persons can effectively oversee them. Oversight that exists on paper but amounts to confirming in practice does not meet that bar. See override rate, automation bias, high-risk AI system, fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, responsible AI. In the IAPP AIGP body of knowledge, this principle appears as human-centricity, with human oversight as one of its elements.Open full entry → remain the complete set. What changes is the condition under which all seven have to hold: continuously, across a connected sequence of actions, instead of once per reviewed output.

The checkpoint moves

The core of the change fits in one sentence: the check moves from inside each decision to around the whole system.

In practice that one move breaks down into three shifts, and each of them lands in governance.

From periodic to continuous. A model that produces outputs for review can be governed in cycles: validate before release, review samples, audit periodically. An agent that acts at machine speed cannot. By the time a periodic review runs, the agent has executed thousands of actions. Oversight becomes a continuous activity: the chain is monitored as it runs, not reconstructed afterwards. That is not a tooling preference; it is a change in what the execution levelexecution levelThe operational tier of AI governance: risk assessments, control testing, monitoring, and the evidence they produce. Where governance design decides what good looks like, the execution level shows whether the organization meets it in practice. See governance design, evidence.Open full entry → of governance has to deliver.

From output review to mandate and bounds. No organization can review every action an agent takes; that is the point of an agent. What the organization can do is decide in advance what the agent is allowed to do: its scope, the tools it may use, the data it may touch, the limits it must respect, and the point at which it must stop and hand over to a person. That decision is the agent's mandate, and writing it down is design work. An agent without an explicit mandate has one anyway, it is just undefined, and undefined mandates are where agents do things nobody decided they should do.

From decision accountability to mandate accountability. With a classic system, accountability attaches to the person who approved the output. With an agent, the question changes: who gave this agent this mandate, and can the organization show, for every action, under whose authorization the agent acted. That is an audit trail requirement and a roles question. If the trail is missing, the organization can no longer reconstruct its own decision making, and governance loses the thing it exists to produce: evidenceevidenceThe concrete proof that a control is designed, implemented, and working: a test report, an audit trail, an impact assessment, a monitoring log. Each link in the governance chain produces an artifact, and together they are what an organization hands to its own board, a regulator, a customer, or an affected person to show, not say, that a system is governed. Its absence is itself the failure: a risk register without test results, or a mitigation claimed without validation, is a governance gap, not a paperwork one. The closing link of the governance chain. See control, governance.Open full entry →.

The risks that matter to the organization

Security research is producing detailed taxonomies of technical attack surfaces for agents. Those matter, but they are a different scope: they describe how agents can be attacked. Governance is about how agents are controlled, and there the risksriskIn the EU AI Act's terms, the combination of the likelihood that a harm occurs and the severity of it if it does. The link between a principle (via the harm that would breach it) and a control (the measure that reduces it). Naming the harm and assessing its risk is required by Art. 9 before any mitigation measure is chosen. See harm, control, residual risk.Open full entry → cluster into four patterns.

Actions outside the mandate. The agent does something nobody explicitly allowed, usually because the mandate was never sharply defined. The failure is not in the agent; it is in the design level that never wrote the bounds down.

Chain errors that compound. In a multi-step chain, a small error rate per step compounds across steps. An agent that screens, prices, or allocates can turn a minor biasbiasA systematic skew in data, model behavior, or outcomes that treats one group differently from another without justification. Bias usually enters through training data that reflects historical patterns. For high-risk AI systems, Article 10 of the EU AI Act requires examination of datasets for possible biases and measures to detect, prevent, and mitigate them. See fairness, proxy discrimination.Open full entry → or a minor data fault into many wrong decisions before anyone reviews an outcome. The classic per-output check would have caught it once; in a chain it repeats.

Accountability gaps. Actions happen, but the organization cannot show which agent took them under whose authorization. Nothing may even have gone wrong, and the governance failure is still real: the evidence that decision making was controlled does not exist.

Oversight that exists on paper. A human is formally in the loop, but in practice reviews so many agent decisions that reviewing collapses into confirming. Automation biasautomation biasThe human tendency to over-trust automated outputs: accepting a system's recommendation without genuinely weighing the case, which hollows out human oversight.Open full entry → turns human-in-the-loophuman-in-the-loopOversight configuration where a human approves or decides each case the system recommends. It fits high-stakes individual decisions and is meaningful only with authority, information and time.Open full entry → into human-on-the-loophuman-on-the-loopOversight configuration where humans monitor operation and intervene by exception. It fits high-volume systems where per-case review is impossible.Open full entry → without anyone deciding it. For agents this is the default failure mode, not the exception, and it is why oversight has to be designed around the system rather than declared per decision.

What the law and the frameworks require

The EU AI ActEU AI ActRegulation (EU) 2024/1689, the European Union's law on artificial intelligence. It takes a risk-based approach: prohibited practices, requirements for high-risk AI systems, transparency obligations for specific uses, and a separate regime for general-purpose AI models. Obligations are divided between providers and deployers. See general-purpose AI, conformity assessment.Open full entry → does not have a separate chapter for agents, and it does not need one: its obligations apply to what a system does, and an agent in a high-risk use case is a high-risk system. Two anchors matter most. Article 14 requires that high-risk systems can be effectively overseen by natural personsnatural personA living human individual, as distinct from a legal person such as a company; the holder of data-protection and AI-Act rights.Open full entry →, including the ability to intervene or interrupt. Article 26 places oversight duties on the deployerdeployerAn organization using an AI system under its own authority in its activities. It carries the operator duties: use per instructions, oversight, input relevance, monitoring, notices.Open full entry →, including assigning oversight to people with the competence, training, and authority to carry it out. For an agent, meeting those duties per decision is impossible by construction, so they have to be met around the system: bounds, monitoring, and intervention capability, designed and evidenced.

Beyond the Act, dedicated agentic governanceagentic governanceGoverning the actions an autonomous AI system takes, not just the decisions it makes; ensuring those actions can be contained, traced, and reversed.Open full entry → frameworks are beginning to appear, and their core requirements read like a governance checklist: bounded autonomy and tool access, traceability of every agent action to a human decision maker, and defined checkpoints where a person takes over. The established management frameworks, the NIST AI RMFNIST AI RMFThe AI Risk Management Framework of the US National Institute of Standards and Technology, published as version 1.0 in 2023. It is a voluntary framework built around four functions: govern, map, measure, and manage. In a layered setup, it serves as the risk method inside a management system such as ISO/IEC 42001. See ISO/IEC 42001, ISO/IEC 23894.Open full entry → and ISO/IEC 42001ISO/IEC 42001The international requirements standard for AI management systems, published in 2023 and certifiable. It defines how an organization establishes, implements, maintains, and continually improves a management system for AI. Certification against ISO/IEC 42001 does not create a legal presumption of conformity with the EU AI Act. See AI management system, harmonized standard.Open full entry →, remain the structural basis, but they were written for systems whose decisions can be reviewed; for agents, the same structures have to be filled in with continuous rather than periodic execution.

Governing agents: design and execution

Agentic AI does not need a new governance system. It needs the two levels the organization already runs, with agent-specific content in each.

At the design level, the organization sets the rules before an agent runs: a mandate per agent (scope, tools, data, limits, and a named owner, no agent without an owner); delegation made explicit (who may grant which mandates, recorded so accountability has an address); and escalation and intervention rules defined in advance (when the agent must stop on its own, when a person is pulled in, and who can shut it down).

At the execution level, the organization carries those rules out, continuously: monitor the chain as it runs, with automatic escalation when the agent driftsagent driftThe gradual divergence of an agent's behavior from its expected envelope over time, surfaced by behavioral monitoring and drift detection across the chain.Open full entry → outside its bounds; keep the audit trail per action (which agent, under whose mandate); and test the intervention capability, because a kill switchkill switchThe designed-in, rehearsed ability to suspend or deactivate an AI system quickly when containment requires it.Open full entry → that has never been used is a hypothesis, not a controlcontrolThe concrete, testable measure that reduces a specific risk, and through that risk protects the principle behind it. Also called a risk management measure, risk response, or risk treatment. Always traceable to the risk it addresses: under EU AI Act Art. 9 every control must map back to a specific risk, and controls recorded separately from their risks is a recognized compliance failure. It works in one of three types: preventive, detective, or corrective. See risk, control types, evidence.Open full entry →.

The pattern is the same chain that governs everything else on this site: the principle, the harmharmHarm is the concrete damage an AI system causes or can cause: to a person, a group, an organization, or society. A risk is that same damage seen in advance, weighed by likelihood and severity; a harm that has occurred is remedied rather than managed.Open full entry → that would breach it, the risk, the control, and the evidence that the control works. Agents change the content of the controls and the tempo of the execution; they do not change the chain.

Across all seven pillars

Because the checkpoint moves for the system as a whole, every pillarpillarA responsible-AI principle as something an organization actively holds rather than merely endorses: one of the seven pillars of responsible AI, one per principle. A pillar is held, not implemented, by naming the harms that would breach the principle, assessing their risk, and placing controls that reduce it. Distinct from agentic AI, which is not one of the seven but a condition that changes how all of them are governed. See principle, harm, risk, agentic AI.Open full entry → is affected, each in its own way. The pillar pages work each one out in a dedicated "with agentic AI" section, split into governance designgovernance designThe design tier of AI governance: policy, roles, organizational structure, and risk appetite. Governance design sets the boundaries within which AI systems may operate; the execution level tests whether reality stays inside them. See execution level, risk appetite.Open full entry → and execution.

Where to start

The starting discipline is the same as for AI governance in general, applied to agents.

Inventory first: find the agents already running, including the ones quietly switched on inside the SaaS tools the organization already uses. You cannot mandate what you have not mapped. Then give every agent a mandate and an owner. Then make the trail work: for every action, which agent, under whose authorization. Then define the escalation and intervention rules, and test them. And monitor behavior continuously, because with agents, reviewing outcomes after the fact is reviewing history.

Done in that order, agents stop being an exception the governance system tolerates and become what every other AI system is: something the organization can understand, control, and demonstrate control over.

Working it out: architecture, risk, controls

The steps above set the order for the organization. The design work behind them is worked out in three articles that follow one sequence, each answering the question the previous one leaves open.

1. How an AI agent knows your business process maps the architecture: the six building blocks through which process knowledge reaches an agent, plus the autonomy it is granted, and what each of those choices commits the organization to.
2. Agentic AI risk assessment turns those architecture decisions into risk scenarios and control objectivescontrol objectiveA statement of the outcome a control must achieve, such as "unauthorized payments must not be technically executable". It says what must be true rather than what must be built, which leaves room for more than one control activity to meet it. Keeping the objective separate from the activity is what keeps a control register testable. See control activity, enforcement point.Open full entry →, applying the risk method this site already sets out rather than a separate one.
3. The control environment for agentic AI takes those objectives and asks where each one is enforced, how you test that it holds, and what evidence shows it held over a period.

Read in that order, the three answer one question in three parts: where the agent's knowledge and authority live, what can go wrong because of that, and where the controls belong.

Continue reading

• AI governance: the system that delivers responsible AI
• Why your agentic stack is one high-risk system
• Documenting an agent is not governing it
• Progressive autonomy: a maturity model for agent deployment