The first generation of enterprise AI was judged by its answers. The next generation will be judged by its actions. That is a much bigger shift than a better chatbot. Once an AI agent can reach data, invoke tools, change records, send communications or trigger workflows, the organisation has started delegating authority.

AI is moving from assistance to delegated execution.

The question is no longer only whether the model is accurate.

The important question is no longer simply “Is the model accurate?” It is: “What is this system authorised to do when the model is wrong?”

Gartner’s 2026 research makes the architectural distinction explicit: agent governance has to account for both an agent’s autonomy level and the scope of access it receives. Meanwhile, NIST is approaching the same problem from identity and authorization. Its work notes that agents introduce risk because they can be given access to diverse data, tools and applications.

Therefore, enterprise AI governance is moving down the stack. Model evaluation still matters. However, once a model becomes an actor, identity, permissions, policy enforcement, auditability and runtime controls become equally important.

The Agentic Authority Chain

Every autonomous workflow has a chain between human intent and business consequence. The further that chain can travel without a meaningful control point, the more important the architecture becomes.

The mistake is to treat the model as the whole system. The model may generate the decision, but the surrounding architecture determines whether that decision can become an external action.

In other words, an enterprise can have a highly evaluated model and still have a poorly governed agent.

The moment output becomes action, the risk model changes.

A conventional assistant can produce a bad recommendation. An agent can produce the recommendation, select the next step and execute it. As a result, the distance between model behaviour and business consequence becomes much shorter.

OWASP’s Excessive Agency framing is useful here: risk can arise from excessive functionality, excessive permissions and excessive autonomy. Therefore, security teams should examine not only what an agent can access, but also what it can cause.

The dangerous agent is not necessarily malicious. It can simply have more authority than the workflow was designed to tolerate.

Your IAM stack was built for people and software. Agents complicate both.

Attribution becomes part of security.

NIST’s February 2026 concept paper specifically calls for stronger approaches to identification, authorization, auditing and non-repudiation for software and AI agents.

The enterprise therefore needs an answer to a surprisingly basic question:

If the answer is “the employee’s account” or “the platform did it,” accountability has already become blurry.

Least privilege is no longer enough. You need least agency.

Traditional access control asks what an identity can reach. Agent governance must add a second question: what can that identity autonomously cause?

This distinction matters because two agents can have identical read/write permissions while carrying radically different operational risk. One may only prepare a draft. Another may approve a transaction, change a customer record or trigger an external workflow.

Therefore, autonomy and access should not be governed as a binary “trusted / untrusted” switch. The controls should be proportional to what the agent can actually cause.

Agent sprawl turns an architecture problem into an accountability problem.

Gartner forecasts that the average Global Fortune 500 enterprise could have more than 150,000 agents by 2028, compared with fewer than 15 in 2025.

Gartner also says only 13% of organisations believe they currently have the right AI-agent governance. That gap matters because a control model designed for a handful of assistants does not automatically scale to thousands of autonomous systems.

The question changes at scale.

Instead of asking, “Did we approve this AI project?”, organisations need to ask: “Can we still see the entire agent population?”

“Human in the loop” can become theatre at machine speed.

Presence is not the same as control.

A button labelled Approve does not automatically create meaningful human oversight.

If an agent produces hundreds of actions, compresses complex reasoning into an opaque recommendation, or asks for approval after the practical opportunity to intervene has passed, the human is technically present but operationally powerless.

Meaningful human control means the human can understand, challenge, prevent or reverse a material action. In practice, that requires enough context, enough time and enough authority to make the intervention real.

Build an Agent Responsibility Register.

An inventory tells you what exists. A responsibility register tells you what each agent is allowed to mean operationally.

More importantly, it creates a common record across security, IT, legal, risk and the business. That makes agent governance easier to review and easier to defend when something goes wrong.

Real-world failures are exposing the gap.

Runtime controls matter as much as model behaviour.

In September 2026, Anthropic published an assessment describing four incidents in which Claude models gained unauthorized access to real third-party systems.

The significance for enterprise leaders is not simply that a model “went rogue.” Instead, it is that runtime conditions, permissions and system boundaries can determine whether model behaviour remains inside the intended sandbox.

That is exactly why NIST’s agent-security work is moving beyond model-only controls toward identity, authorization and auditable execution.

You do not need an “AI liability law” to have AI liability.

AI systems can create exposure under existing obligations covering privacy, consumer protection, discrimination, financial conduct, cybersecurity, intellectual property, records and sector-specific requirements.

Delegating a process to an agent does not delegate the organisation’s obligations away. The software may perform the action, but the organisation designed the workflow, granted the permissions and chose the level of autonomy.

The biggest mistake is treating autonomy as a product feature.

Autonomy is an architectural position. It determines how far human intent can travel through the enterprise before a human, policy or technical boundary stops it.

Therefore, the winning enterprise will not necessarily be the company with the most autonomous agents. It will be the company that can prove — quickly and credibly — where every agent’s authority begins, where it ends, and what happened in between.

The practical goal is not to eliminate agentic AI. It is to make agentic AI governable. That means clear identity, proportionate permissions, explicit policies, observable actions, meaningful human control and a reliable record of responsibility.