Purpose
This publication defines rating considerations for agentic AI systems that can plan, invoke tools, access enterprise resources or take actions with varying degrees of autonomy. Agentic systems extend governance beyond model output quality because authority, identity, permissions and action execution become part of the control environment.
Governance object
An agentic AI assessment should define the agent, model or models, orchestration layer, tools, credentials, data sources, execution environment, delegated authority, human approval points and operating period. A rating cannot be interpreted reliably if these elements are allowed to change materially without review.
Core governance domains for agents
| Control area | Governance requirement | Evidence examples |
|---|---|---|
| Identity | Each production agent or governed agent class has a persistent identity and accountable owner. | Agent registry, system identifier, ownership record. |
| Delegated authority | Authority is explicitly granted, bounded and revocable. | Authorization policy, delegation record, approval workflow. |
| Tool access | Tools and data are restricted to least-privilege requirements. | Permission sets, API scopes, access-control configuration. |
| Action boundaries | High-impact or irreversible actions are constrained by policy and approval rules. | Guardrails, transaction limits, human approval gates. |
| Observability | Actions, tool calls and material decisions are recorded at sufficient fidelity. | Execution logs, audit trail, event history. |
| Containment | The organization can suspend, isolate or revoke the agent’s authority. | Kill switch, credential revocation, containment procedure. |
| Change control | Material changes to models, prompts, tools, permissions or workflows are governed. | Change record, approval, regression testing. |
Identity and accountability
Agent identity should be distinct from the human or service account through which an action is executed where technically feasible. The governance record should permit reconstruction of which agent acted, under whose authority, using which permissions and against which system state. Shared or opaque credentials can materially weaken accountability.
Delegated authority
Authority should be expressed as a controlled grant rather than inferred from technical capability. The organization should define which actions the agent may perform, which require human approval, which are prohibited and how authorization changes are approved. Delegation should be time-bounded or reviewable where appropriate and capable of immediate revocation.
Tool and data access
Agentic systems can combine capabilities that were historically separated across applications. Governance should therefore evaluate the aggregate effect of tool access. An agent with individually reasonable permissions can create material risk if it can chain tools to access sensitive data, modify records, initiate transactions or communicate externally without appropriate controls.
Action boundaries and human oversight
Human oversight should be tied to decision impact rather than inserted as a nominal approval step. High-impact, irreversible, financial, legal, safety-sensitive or externally consequential actions may require stronger approval, transaction limits or dual control. The evidence should demonstrate that the oversight mechanism can meaningfully prevent or stop action.
Observability and reconstruction
Auditability requires sufficient records to reconstruct material actions and control decisions. Logs may need to capture agent identity, system version, tool call, parameters, permission state, time, result, approval state and any exception or containment action. Logging should be designed to support investigation without creating unnecessary exposure of sensitive data.
Containment and incident response
An organization should be able to constrain an agent when governance assumptions no longer hold. Containment can include revoking credentials, disabling tools, reducing permissions, isolating execution, requiring human approval or suspending the agent. Incident procedures should identify who has authority to act and what evidence must be preserved.
Third-party and model dependencies
Agentic systems can rely on external models, APIs, tools and data services. Governance should record material dependencies, contractual controls, data flows, service changes and fallback arrangements. A significant provider change can alter the system’s risk profile even when the organization’s own code has not changed.
Rating implications
Agentic systems increase the importance of cybersecurity governance, enterprise architecture and operational governance within the rating framework. Weaknesses in identity, authorization, observability or containment may constitute material conditions because they affect the organization’s ability to establish who acted, under what authority and with what ability to intervene.
Research status and limitations
This publication establishes governance considerations for agentic AI systems. Technical architectures are evolving and implementation patterns may require system-specific controls beyond those described here.