Enterprises increasingly are turning to agentic AI to drive process automation, but recent reports of AI agents circumventing their programming and breaking out of secure environments demonstrate the inadequacy of traditional governance models.
According to a new report from Info-Tech Research Group, AI agents capable of independently accessing applications, triggering workflows and making decisions should be treated as persistent digital actors rather than conventional IT assets or earlier-generation AI models.
The Toronto-area research and advisory firm’s Govern Enterprise AI Agents While Preserving Innovation blueprint focuses on managing agent identity, access, autonomy and ongoing oversight.
“AI agents cannot be governed like traditional IT assets or earlier AI models because they do more than generate outputs; they act across systems,” says Altaz Valani, principal advisory director at Info-Tech Research Group. “Many people will have multiple agents working for them, but AI agents cannot be governed the way we govern humans because they move quicker and lack emotions, conscience, and consequences.”
In the report, Info-Tech identified several emerging governance challenges, including agents created outside sanctioned tools, mismatches between agent capabilities and monitoring, expanding permissions and unclear accountability when an agent causes harm.
The firm recommends a three-phase governance approach. Organizations first establish governance authority, decision rights and guardrails. They then map the agent lifecycle, identify agents across the enterprise, classify them by risk and establish monitoring requirements. The final phase establishes accountability, metrics and executive reporting.
The goal is to shift agent governance from one-time approvals to continuous oversight as agents operate and their capabilities, permissions and scope change.