Lesson 4 of 12 · Governance
Put governance and risk controls in front
Governance is not a compliance form you fill in after the prototype works. It is the product requirement that defines what the agent is allowed to do, under which conditions, and how the enterprise proves that it did the right thing.
Classify by autonomy
Agentic AI changes your risk profile because it can act. A practical way to govern agents:
- Read-only: retrieve, summarize, explain.
- Recommend: propose actions, drafts and decisions.
- Act with approval: execute after human confirmation.
- Act autonomously: execute without humans, only in narrow domains.
Most enterprises should spend meaningful time at levels 2 and 3 before level 4.
Non-negotiable capabilities
- Data handling: personal data, retention, residency, encryption, minimization.
- Access control: least privilege, scoped tokens, just-in-time access.
- Auditability: immutable logs of inputs, tool calls, outputs and approvals.
- Policy enforcement: hard rules that prevent forbidden actions.
- Escalation paths: how the agent fails safely.
Agents should be powerful inside boundaries and powerless outside them.
Check your understanding
3 questions. Pick an answer for each, then check. Nothing leaves your browser session.
1. Where should most enterprises spend meaningful time before autonomy?
2. When should governance be designed?
3. Which of these is one of the non-negotiable governance capabilities?
Answer every question to check.