AI agents
How to govern AI agents: six pillars and four risk tiers
Decide six things before go-live, then match the control to the risk. A read-only assistant and a payments agent should not carry the same weight.
Leron Garriques, Baxter Mountain Group
Short answer: govern an AI agent by deciding six things before it goes live: its role and scope, its permissions, where a person must approve, what gets logged, what data it may touch, and how it is monitored. Then match the amount of control to the agent’s risk. A read-only assistant needs light control. An agent that moves money needs approvals, tamper-evident logs and a way to switch it off.
Why do AI agents need governance?
Because agents act, not just answer. A chatbot that gets something wrong produces a bad sentence. An agent that gets something wrong can send the email, update the vendor record or release the payment.
Good governance is not a brake on adoption. It is what lets you say yes faster, because everyone knows what the agent may do, who answers for it, and what happens when it is unsure.
Agent governance: the set of decisions that define what an AI agent may do, who is accountable, where a person must approve, and how its behaviour is recorded and reviewed.
What are the six pillars of agent governance?
Each pillar is a decision made once per agent, then revisited as the agent earns trust.
| Pillar | The question it answers |
|---|---|
| Role and scope | What is the agent for, what is it not for, and who answers for it? |
| Permissions and access | Which systems can it reach, and can it read, draft, write or approve in each? |
| Human approval and thresholds | Where must a person say yes: money, volume, customers, sensitive systems, uncertainty? |
| Audit and traceability | Can we reconstruct what triggered an action, what the agent saw and who approved it? |
| Data and privacy | What data may it see, where may it go, and how is it protected? |
| Monitoring and review | How do we watch quality and cost, change it safely and switch it off? |
How do you decide how much control an agent needs?
Score its risk, then scale the control to match. Five factors do most of the work:
- What it can do: read only, draft for approval, act within limits, or act autonomously.
- Data sensitivity: public, internal, confidential or regulated.
- Impact of an error: low, moderate, high or severe.
- Volume: how many actions it takes.
- Sensitive systems: whether it can act on payments, finance or similar systems.
The total maps to four tiers: Assist, Supervised, Controlled and Critical. Each tier brings a heavier set of controls, from owner sign-off and light sampling at the bottom to dual approval, real-time monitoring and formal change control at the top.
Why does a score alone not decide the tier?
Because some combinations are riskier than their points suggest. A good scheme adds override rules that lift the tier regardless of the total, and shows them openly. Four are worth having:
- Read-only cap. A read-only agent should not land in the highest tiers on score alone.
- Regulated data floor. Regulated data sets a minimum of Tier 3, even for an agent that only reads.
- Severe impact floor. If an agent can act and an error would be severe, the minimum is Tier 3.
- Autonomy with high stakes. An agent that acts autonomously on regulated data, or where errors would be severe, is Tier 4.
A worked example: the agent that updates supplier bank details
Hypothetical agent, chosen to show the method. A team proposes an agent that updates supplier bank details when a supplier sends a change request. Volume is low, so the points alone put it at Tier 3. But it acts autonomously, and a wrong change is a common route for payment fraud, so the impact is severe. The autonomy rule lifts it to Tier 4, Critical.
Governance for Tier 4 changes the design. A person approves each change, using a call-back to a number already on file. The agent’s log is tamper-evident. Alerts fire on unusual patterns, and an executive sponsor owns the agent. The agent still does the matching and drafting. A person makes the decision.
Contrast that with a policy question-and-answer assistant that reads internal documents and cannot change anything. It sits at Tier 1: an owner signs off, outputs are sampled, and it is reviewed quarterly. Same framework, very different weight.
The goal is not maximum control. It is the right control for the risk.
Where should a person stay in the loop?
On every key decision. We recommend capping automation at around 80% for most business tasks, and keeping a person on anything involving money above a threshold, customers, sensitive systems or cases where the agent is unsure. Write those thresholds down in the policy so they are checked, not remembered.
Key takeaways
- Agents act, so they need decisions made before go-live, not after an incident.
- Six pillars cover it: role, permissions, approval, audit, data and monitoring.
- Score risk on five factors, map to four tiers, and add override rules for dangerous combinations.
- Match the control to the tier. Light for Tier 1, heavy for Tier 4.
- Keep a person on key decisions and automation around 80% or below.
Build a policy for your own agent
The Agent Governance Framework walks through the six pillars, classifies five example agents as a warm-up, then asks eight questions about yours. It shows your risk tier, the rules that fired, and generates a draft policy for your risk, security and legal teams to review. It is free and runs in your browser. It is a starting point, not legal advice.
Frequently asked questions
What is AI agent governance?
It is the set of decisions that define what an agent may do, who is accountable, where people approve, and how its actions are logged, monitored and reviewed.
What should an AI agent policy include?
Role and scope, a permissions matrix, approval thresholds, audit log requirements, data handling rules, monitoring and review cadence, incident response, change management and named sign-off.
How do you classify the risk of an AI agent?
Score what it can do, the sensitivity of its data, the impact of an error, its volume and whether it acts on sensitive systems. Map the total to a tier, then apply override rules for combinations such as regulated data or autonomous action with severe impact.
Does every AI agent need human approval?
Not every action, but every key decision. Low-risk agents may only need sampling and review. Agents that move money, touch regulated data or deal with customers should route those actions to a person.