Agentic AI describes systems that pursue a goal across multiple steps, choosing their own actions along the way — calling tools, reading results, deciding what to do next — rather than producing a single response to a single prompt. The shift that matters for governance is not autonomy in the abstract. It is that the system now takes actions, and actions have consequences a response does not.
What changes when a model becomes an agent
A chat completion is a request and a reply. Whatever risk it carries is contained in the text. An agent holds credentials, reaches systems, writes to records and decides for itself what to do next. Three governance properties break at that transition.
The principal becomes ambiguous. Authorization models assume a person is accountable for an action. When an agent acts on a borrowed credential, the audit record names the person, not the actor. Agent authority scope is the correction.
The blast radius stops being the response. A successful prompt injection against a chatbot produces bad text. Against an agent with tool access it produces actions, which is why indirect prompt injection became a serious class of attack only once agents arrived.
Review moves to before the action. Detecting a transfer after it executes is not governance. That is the argument behind runtime governance.
How it differs from automation, and from a copilot
Automation follows a fixed path: the same steps every time, and a failure is a bug. An agent chooses its path, so two identical requests can produce different action sequences, and a failure may be a reasonable decision made on bad input. Testing a fixed path proves it works. Testing an agent samples a distribution.
A copilot suggests and a person acts, which keeps the human in the authorization chain. An agent acts and a person reviews, which removes them from it unless the system puts them back deliberately — see human in the loop.
Governing it in practice
Three controls carry most of the weight. An identity for the agent itself rather than a credential borrowed from its launcher. A scope that narrows as work is delegated, which is what stops an agent chain becoming a privilege escalation path — see A2A. And enforcement at the point of the call, covering both model requests and MCP tool calls, because an agent governed on one and not the other is governed on neither.
The regulatory position is sparser than most assume. US bank supervisors explicitly excluded generative and agentic AI from model risk management scope in SR 26-2, which relocated the obligation onto the institution rather than removing it. Practical detail is in the AI agent governance guide, the agent governance approach and the agentic governance documentation.
Related terms
Agent authority scope · A2A · Human in the loop · Runtime governance · Full glossary
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs