Artificial Intelligence

AI Agent Governance Framework: How to Control Agents by Autonomy Level

By Clateway Technology Council · 20 October 2026 · 6 min read

Bottom line: AI agents are arriving faster through software you already bought than through projects you approved. One governance policy for every agent fails both ways: simple agents get slowed down and risky ones slip through. An AI agent governance framework that works sorts agents by autonomy level, gives each one its own identity and a named owner, and enforces controls at runtime, not only in policy documents.

Why AI agent governance is now a board-level question

Three data points explain why IT leaders are being asked about agents this quarter:

• Agents are coming built in. Gartner predicted in August 2025 that up to 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% in 2025. A CRM, ITSM or HR suite you approved two years ago can gain the ability to act through an ordinary release.
• Projects get stopped. Gartner also expects over 40% of agentic AI projects to be cancelled by the end of 2027 because of rising costs, unclear business value or weak risk controls (June 2025).
• The governance gap shows up in production. In May 2026 Gartner predicted that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps found only after incidents.

Identity teams feel this already. A January 2026 Cloud Security Alliance survey of nearly 400 IT and security professionals found that 79% had low to moderate confidence in defending against attacks that use non-human identities, and more than 16% did not track the creation of new AI-related identities (as reported by TechTarget, September 2026).

The blind spot: approved software that quietly turns agentic

Most AI governance programmes were built around a front door: a team asks to use a model or tool, and a review board approves or rejects it. Agents do not always use that door. Vendors switch on agent features in existing licences, business users connect assistants to mailboxes and ticket queues, and suppliers embed their own engineers to build agents for you.

That last route has its own risk. In September 2026 Gartner warned that 70% of enterprises will abandon agentic AI systems built with vendor assistance by 2028 when customers lack the knowledge and control to maintain them once the vendor leaves. Gartner's advice: agree governance, IP ownership, knowledge transfer and an exit strategy from day one.

The practical answer is to trigger a review on capability change, not only on purchase. If a product gains write access, the ability to send messages or the ability to change configurations, it goes back through governance, even when the contract and the vendor stay the same.

A four-level AI agent governance framework

Gartner's May 2026 guidance warns against binary governance ("locked down or fully trusted"). It proposes proportional controls across four autonomy levels. We have turned it into a working checklist:

| Level | What the agent can do | Typical use | Minimum controls | |---|---|---|---| | 1. Observe | Read-only access to defined sources; output only to the requester | Summarising documents, search, explaining code | Scoped data access, user authentication, usage logging, basic security testing | | 2. Advise | Drafts and recommends; humans carry out every action | E-mail drafts, reports, decision support | Level 1 plus accuracy and hallucination testing, domain quality checks, user training against automation bias | | 3. Act with approval | Writes data, sends messages or changes configurations after explicit human approval | Ticket updates, customer replies, config changes | Level 2 plus approval workflows with audit trails, security testing, agent-specific incident response, monitoring for approval fatigue | | 4. Act autonomously | Acts on its own within guardrails; humans review exceptions and outcomes | High-volume operations, remediation | Level 3 plus continuous monitoring, enforced guardrails, fast rollback, circuit breakers and a named owner for agent behaviour |

The value of the table is speed. Most agents in a typical portfolio sit at Levels 1 and 2. Keeping their controls light removes the reason teams build "shadow agents" to get around a slow review, so the governance effort goes to the few Level 3 and 4 agents that can do real damage.

Five controls to put in place before an agent touches production data

Policies set intent; runtime controls make it real. Drawing on a NIST concept paper on AI agent identity (February 2026) and current practice, these five controls give the most protection for the effort:

1. One identity per agent. No shared service accounts. Every production agent gets its own identity that can be attributed, using standards your identity team already knows (OAuth 2.x, OpenID Connect, SCIM for lifecycle management).
2. A named human owner. Every agent has an accountable person who approves its scope and answers for its behaviour.
3. Short-lived, task-scoped credentials. Replace standing API keys with tokens limited to one task, resource and action, and make sure you can revoke a misbehaving agent within minutes.
4. Delegation you can prove. When an agent acts for a user, the record shows both the person who authorised it and the agent that acted. The IETF Identity Assertion Authorization Grant draft is one emerging way to do this.
5. Tamper-evident audit records. Log what the agent was allowed to do, what it did and which resources it touched, so incident response can rebuild the chain in hours, not weeks.

How the EU AI Act timeline affects your agent roadmap

For European organisations, the regulatory clock moved but did not stop. Under the Digital Omnibus on AI agreed in May 2026, high-risk obligations for stand-alone Annex III systems (such as recruitment and credit scoring) move from 2 August 2026 to 2 December 2027, and to 2 August 2028 for AI embedded in regulated products (Gibson Dunn, 27 May 2026; see also the European Commission AI Act timeline). The Article 50 transparency duties, including telling people they are dealing with an AI system, have applied since 2 August 2026.

The extra time is useful because building an agent inventory, classifying agents and wiring identity controls takes several quarters. An agent that screens candidates or approves credit is likely to be high-risk whatever its autonomy level, so record the regulatory classification next to the autonomy level in your agent register.

A 90-day plan for IT leaders

• Days 1–30: inventory. Ask your top 20 SaaS vendors which agent features are live or planned in your tenant, and list the agents your own teams have built. Record owner, data accessed and autonomy level.
• Days 31–60: classify and close the gaps. Apply the four-level table. Move Level 3 and 4 agents off shared accounts and long-lived keys first.
• Days 61–90: make it routine. Add a "capability change" trigger to vendor management, add agent scenarios to incident response playbooks, and report the agent register to the risk committee every quarter.

For wider context on the trends shaping IT agendas this year, see our briefing 6 Trends Shaping IT in 2026.

Frequently asked questions

What is an AI agent governance framework?

It is the set of policies, roles and technical controls that decide what AI agents may access and do, who is accountable for them and how their actions are monitored. Effective frameworks scale controls to each agent's autonomy instead of applying one rule to all.

How is AI agent governance different from general AI governance?

General AI governance focuses on models and outputs: bias, accuracy, acceptable use. Agent governance adds actions. Agents hold credentials, call systems and change data, so identity, authorisation, rollback and audit become central.

Who should own AI agent governance?

Shared ownership works best: the CIO or CISO owns the framework and controls, a named business owner is accountable for each agent, and legal and risk teams own the regulatory classification. A single register connects all three.

Do agents embedded in SaaS products need governing?

Yes. They act with your data and your users' authority. Treat a vendor release that adds write or send capabilities as a change that needs review, just like a new purchase.

Does the EU AI Act delay mean we can wait?

No. High-risk obligations now start in December 2027 (Annex III) and August 2028 (Annex I), but transparency duties already apply, and the inventory and identity work behind compliance takes months.

Topics: agentic AI, EU AI Act

Related articles

• AI Agent Audit Trail: What to Log So You Can Explain Every Action – What an AI agent audit trail must capture to explain any action: identity, delegation, tool calls, approvals, retention and tamper-evidence.
• Human in the Loop for AI Agents: Which Actions Need Approval – Human in the loop for AI agents: the five actions that need approval and how to design approvals people actually review.
• Enterprise AI Agents Enter Production: Advanced Models Drive Autonomous – Major cloud providers are launching production-ready AI agent platforms powered by sophisticated models like GPT-6 variants and Claude Opus 5.5, marking a fundamental shift from experimental AI to…

How Clateway can help

• Technology and cyber board advisory – Independent technology and cyber expertise for boards and supervisory boards: advice on management's plans, NIS2 accountability, AI governance and director…
• AI agents for IT, security and compliance – An AI workforce for technology leaders: agents such as an Information Security Officer, SOC analyst or architecture reviewer that read your data and propose…
• AI governance for the enterprise – Use AI safely across your organisation: guardrails per company, private AI routing, zero data retention, AI activity logs, rate limits and an AI kill switch.