AI agent governance

AI agent governance: control what your agents can see, do and know

AI agent governance is how a company decides which agents may act, with whose permissions, in which systems, from which instructions, and how every action is recorded.

One agent is easy to keep an eye on. Ten agents across five teams, each with its own connections and instructions, are not. The more agents a company lets loose, the more these decisions have to be made in one place instead of agent by agent.

Why it matters now

More agents, more that can go wrong

Agents act

They do things, not just answer

An assistant writes a reply for you to read. An agent updates the CRM, files a ticket, drafts the invoice reminder and moves on to the next step. A mistake is no longer a bad answer, it is a changed record.
Agents multiply

Every team builds its own

Once one team has an agent that works, the next team builds one too, with its own connections and its own instructions. Within months nobody has a list of which agents exist and what they can reach. These are shadow AI agents.
Agents hold keys

Often with more access than any person

The quickest way to connect an agent is a shared API key or an admin account. Then the agent can see and change everything that key allows, whoever is asking it.
Agents leave no trail

Nobody can say what happened

When a customer record changes or a draft goes out, the question is who asked, which agent did it and on what instructions. Without one log, the answer is spread across every tool or missing.
The five controls

Five things every company has to decide for its agents

1 · Identity

Whose permissions does the agent use?

The agent should act as the person who asked it, with that person’s permissions in each system. Never as a shared admin account that can see everything.
2 · Access

Which systems and tools can it reach?

Decide per group which systems an agent may use, and whether it may only read or also write. Finance agents reach finance, sales agents reach sales.
3 · Context

Which instructions does it work from?

An agent is only as good as the instructions it follows: how your company writes an offer, handles a return or answers a customer. Keep them as shared skills, the same version for everyone, updated in one place.
4 · Guardrails

What may it never do?

Rules that hold whatever the agent is asked, for example that nothing is sent without a person approving it, or that payroll data is never read. Set once, applied to every agent.
5 · Audit trail

What did it actually do?

Every call logged: who asked, which agent, which system, what was read or changed, and when. One log for all agents, which IT and compliance can search and export.
With Deployed OS

One control layer for every agent

Deployed OS sits between your company and the AI tools your people and their agents use. The five controls are set there once and apply wherever the agent runs. See the systems it connects to in our MCP connector directory, and why a single gateway matters in what is an MCP gateway.

Identity
Each person connects with their own login, so every agent acting for them sees what that person may see and nothing more.
Access
Admins decide which groups get which systems. A group without access never sees the connection.
Context
The company’s skills sit in one place and reach every person’s AI tool, so agents work from the same instructions.
Guardrails
Company rules apply in Claude, ChatGPT and Copilot alike, whichever tool the agent runs in.
Audit trail
Every call is logged with the person who asked. The log can be exported.
Checklist

Before you let an agent loose

  1. Does the agent act as the person who asked, or as a shared account?
  2. Which systems can it reach, and can it write or only read?
  3. Which instructions does it follow, and who owns them?
  4. What may it never do, whatever it is asked?
  5. Does a person approve before anything is sent or changed?
  6. Where is every action logged, and who can see the log?
  7. Who decides when a new agent gets access to a new system?
  8. Do you have a list of every agent in use today?

If several answers are “we don’t know”, start there. Read also is your data safe in Claude and why AI agents fail in production.

Guides

Go deeper, one control at a time

AI agent permissions

AI agent permissions: let agents act as the user, never as admin

AI agent permissions decide what an agent may read and change in each system it reaches. The safest default is simple: the agent acts with the permissions of the person who asked it, and nothing more.
AI agent audit trail

AI agent audit trail: a record of everything your agents do

An AI agent audit trail is a record of every action an agent takes: who asked, which agent acted, in which system, what it read or changed, and when.
Shadow AI agents

Shadow AI agents: how to find them and bring them in

Shadow AI agents are agents that teams set up on their own, with their own connections and keys, outside any central overview. They are the agent version of shadow IT.
AI agent monitoring

AI agent monitoring: what to watch once your agents are running

AI agent monitoring is keeping an eye on what your agents actually do once they are in use: who uses them, which systems they reach, what they change, and what your rules stop.
FAQ

Questions about AI agent governance

AI agent governance is how a company decides which AI agents may act, with whose permissions, in which systems, from which instructions and under which rules, and how every action is recorded. It is set in one place instead of agent by agent.

Because agents act instead of only answering. They change records, draft messages and move work forward, often with broad access. The more agents a company runs, the more it needs one place to decide what they may do and to see what they did.

AI governance covers policy, risk and compliance for AI in general. AI agent governance is the practical part for agents that act: their identity, their access to systems, the instructions they follow, the rules they cannot break and the log of what they did.

For most work, the user’s. When an agent acts with the permissions of the person who asked, it can never see or change more than that person could. A shared admin account gives every user the agent’s full access.

A record of every action an agent takes: who asked, which agent, which system, what was read or changed, and when. It lets IT and compliance answer what happened without collecting logs from every tool.

Agents that teams set up on their own, with their own connections and keys, outside any central overview. They are the agent version of shadow IT, and the first step to govern them is a list of which agents exist and what they can reach.