Trusted AI Governance Starts Where Intent Becomes Action

Agentic Systems Change The Governance Problem

Traditional enterprise governance assumes software behavior can be specified before deployment. A service exposes an API contract. A workflow follows a defined sequence. A release can be reviewed, tested and approved before it goes live. Runtime governance usually confirms that the system continues to behave according to what was already specified.

Agentic systems do not fit that model cleanly. An agent can reason over context, call tools, retrieve data, invoke APIs, delegate tasks and decide when to continue, stop, escalate or retry. The output matters, but the path matters, too. The authority used, data accessed, tools called and decision to act all become part of the governed surface.

That creates an inversion. In deterministic systems, governance can start with the output specification. In agentic systems, the enterprise must govern the boundary where intent becomes action and retain evidence after the action. Pre-deployment review still has value, but there is no final output contract that can be verified once and trusted forever.

Trust Is Not A Model Property

A model can be powerful, accurate and useful. That does not make it trusted in an enterprise. Trust comes from the architecture around the model, including controls that make agent behavior inspectable, attributable and bounded.

Inspectable means the enterprise can see what happened, including tool calls, data access, applied policies, human oversight and resulting action. Attributable means the enterprise knows who or what acted, and under whose authority. An agent should not act as an anonymous workload or shared service account. It needs identity, delegated authority and traceable actions.

Bounded means the agent operates within defined limits: access, tools, data, policy, cost, jurisdiction and human approval. Without these properties, trust collapses into hope.

AI Requires Two Governance Models

Trusted AI governance requires two complementary enforcement models: inline governance and infrastructure-enforced governance.

Inline governance is implemented inside the agent or application flow. Teams add policy checks, validation logic, safety rules, approval steps and logging directly into the system. This matters because it has access to local workflow context, business intent and domain-specific rules.

But inline governance is not sufficient by itself. In a large enterprise, every team implementing its own governance logic creates uneven coverage. Controls get duplicated, drift over time and become hard to audit consistently.

Infrastructure-enforced governance applies controls outside the agent implementation through gateways, proxies, runtimes, service meshes, identity systems, model gateways, API gateways and other enforcement points. This gives the enterprise a common enforcement layer at shared boundaries for model calls, API calls, tool access, data access and agent-to-agent traffic.

The two models are not substitutes. Inline governance gives domain precision. Infrastructure-enforced governance gives enterprise consistency. One without the other becomes fragmented or too coarse.

Authorization And Identity Need More Precision

Authorization is essential, but it is not the same as safety. An agent may be authorized to use an email tool, but that does not mean every email it writes should be sent. It may include confidential information, make an unapproved commitment or send a message to the wrong recipient.

The risk is rarely in the tool name alone. The risk is in the parameters of the action, such as which customer record, which amount, which recipient, which query, which file, which authority and which purpose. Authorization determines access to a capability. Safety determines whether a specific use is acceptable in context.

Agents also need identity. Many enterprise systems still depend on shared service accounts, user sessions and embedded credentials that are difficult to attribute cleanly. That model becomes dangerous when agents take multistep actions. The enterprise needs to know who the agent is and on whose authority it is acting.

What Technology Leaders Should Do Now

For technology, AI and security leaders, the priority is to make governance executable, not to write another AI policy document.

Start with discovery. You cannot govern agents, tools, models, APIs, delegated authorities or agent-to-agent interactions you cannot see.

Then treat agents as first-class actors. Give them identities, make delegation explicit, and avoid hiding agentic behavior behind anonymous workloads or shared accounts. Define the boundaries where intent becomes action, such as the points where agents reach models, APIs, tools, data, workflows and other agents. Combine inline and infrastructure-enforced controls at those boundaries, and capture evidence after action.

Governance Must Cover Design Time, Runtime And Evidence

The agentic era will not be governed by policy documents alone. Governance has to be designed before deployment, enforced while agents act and proven after action through evidence. Design-time governance defines policies, tools, evaluations and approval paths. Runtime governance enforces boundaries when agents access systems, use tools, invoke APIs, delegate work and coordinate with other agents.

Evidence closes the loop. Without evidence, governance becomes a claim. With evidence, it becomes something the enterprise can inspect, audit and improve. The enterprises that get this right will not simply “trust AI.” They will build systems where trust is inspectable, attributable and bounded by design.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?