AI agent governance is plumbing, not policy

An AI policy says what an agent should do. The agent's login decides what it can do. When the two disagree, the login wins, and you find out after the incident.

That is the case for treating AI agent governance as plumbing. A policy is a document. Governance is a set of permissions, a log a named person reads, and one person who can pull the plug. Deloitte's survey, covered below, puts the share of companies with that second part in place at 21%.

Why a CFO should care before the tenth agent

An agent with a broad credential can move money or send an email under the company's name. The policy paragraph that forbids it stops none of that. The exposure is financial and reputational, and it grows with each system the agent can reach.

The cost runs the other way. Governance retrofitted across forty agents is a program: steering committee, consultant, budget line, two quarters. Governance written into the first agent is an afternoon, and agents two through ten inherit it.

A 200-person portfolio company writing its first agent spec this quarter holds an advantage a large enterprise has already lost. The window stays open while the count is small.

The operating model: four layers on one page

Policy says what should happen. Permissions determine what can happen. Logs show what did happen. An owner can stop what is happening. Governance is the last three, and each one has a concrete form.

1. Boundary. Write the scope as access rather than prose: the systems the agent reads, the systems it writes, the systems it cannot reach. Deloitte describes this as the decisions an agent can make on its own versus the ones that need a human. Put the second list behind a signature.

2. Credential. The agent gets its own login. A shared service account or a developer's personal token does not count. One login per agent makes the boundary enforceable, and revocation becomes one action instead of a hunt through shared keys.

3. Log. The agent records what it did in language a person who was not there can follow. Name the person who opens that log and the day of the week they open it. A log with no assigned reader is storage.

4. Owner. One name, attached to the approval gate and the off switch. That person can stop the agent without asking permission, knows the manual process for that day, and knows where queued work goes. A committee is not an owner.

The Monday test

For each agent in production, answer four questions in one sitting:

• Can you list it?
• Can you state what its login reaches?
• Can you open last week's log and follow it?
• Can you name who switches it off?

Four yes answers is a governed agent. Anything less is an agent running on trust, and the agent running on trust is the one that ends up in the incident report.

What Deloitte found

Andy Bayiates wrote up the survey for Deloitte Insights: 3,235 IT and business leaders across 24 countries.

Source facts: 21% say their organization has a mature governance model for agentic AI. 74% expect their company to use agents at least moderately by 2027, 23% expect extensive use, and 5% expect agents as a core component of operations. Deloitte lists the missing capabilities as clear boundaries for which decisions an agent makes alone, real time monitoring that flags anomalies, and audit trails that capture the full chain of agent actions.

My read: those three missing capabilities are the boundary, the log and the owner. The distance between 21% and 74% is plumbing work that most respondents have scheduled after the rollout instead of inside it.

The page that survives the first incident

Build the boundary, credential, log and owner into agent one, and the second agent takes a day to govern instead of a quarter. Build it later and the first incident writes the governance program for you, with a consultant's name on the invoice.

If you are between your first and fifth agent, I will send the one-page version of this checklist, the four sections laid out for whoever signs off before launch. Message me with "agent sheet" and it is yours.