Most organisations are approving AI agents through processes built for software or for people, and neither fits a system that holds credentials, makes decisions and acts on production data without a person in every step. Agent governance and risk is the discipline of deciding which agents may exist, what each is allowed to decide and touch, who is accountable for it, and how its risk is assessed, accepted and reviewed over its life. This pillar page gives the overview of the field: core concepts, the risks governance has to manage, the controls to put in place by maturity, roles and ownership, and how the work maps to the NIST AI RMF, ISO/IEC 42001, the EU AI Act and OWASP. It is written for CISOs, GRC and risk teams, AI governance leads, IAM and NHI owners, and the architects who sign off agent deployments. Each section summarises and links to the NHI Mgmt Group guide that goes deeper.
Key takeaways
- Govern the deployment, not the model. Risk depends on what an agent can touch, how much it decides alone and the context it runs in; the same model can be harmless as a drafting assistant and dangerous as an autonomous operator.
- Every agent needs an owner, an identity and an inventory entry. NIST AI RMF GOVERN 1.6 expects mechanisms to inventory AI systems; for agents the inventory must also record credentials, tools, data and autonomy level.
- Autonomy is a risk decision. OWASP's least agency principle and EU AI Act Article 14(3) both tie the strength of oversight to how much the system decides and does on its own.
- Accountability stays with people. Singapore's Model AI Governance Framework for Agentic AI states that humans remain ultimately accountable for agent behaviour; a governance model that cannot name the accountable person for an action has a gap.
- Risk acceptance must be revisited on change. A new model, prompt, tool or data source changes an agent's risk; tie re-assessment to change management rather than to an annual cycle.
What the field covers
Agent governance and risk sits above two runtime disciplines. Agent identity and access provides the identities, credentials and authorisation that make governance enforceable; agent controls and monitoring enforces decisions on each action and produces evidence. Governance decides what those layers should enforce and checks that they do. See the Agent Controls and Monitoring Guide and the Agent Identity and Access Guide.
- Policy: what agents may be built or bought, which data and actions are off limits, and the minimum controls by risk tier. See the Agentic AI Security Policy Template.
- Inventory and ownership: a register of agents, including those embedded in SaaS products and coding tools, each with an accountable owner.
- Risk assessment and threat modelling: scoring an agent before it goes live and modelling how it can be attacked or misbehave.
- Autonomy and oversight decisions: assigning an autonomy level per action class and the human oversight that goes with it.
- Compliance and evidence: mapping agent controls to the EU AI Act, NIST AI RMF, ISO/IEC 42001, data protection and sector rules, and keeping audit trails that stand up.
- Third-party and supply chain risk: agent platforms, models, tools and MCP servers supplied by others.
- Executive and board reporting: translating agent risk into business impact and decisions.
Broader AI governance (model risk, fairness, AI ethics boards, AI use policies) is covered in the AI Governance Guide. This page concentrates on what changes when the AI system acts.
Core concepts
Agency, autonomy and blast radius
Three variables drive agent risk. Agency is what the agent can touch: tools, scopes, systems and data. Autonomy is how much it decides and acts without a person. Blast radius is the worst plausible effect of a wrong action, set by the credentials it holds and the reversibility of what it can do. Governance bounds all three. A low autonomy level does not excuse broad permissions, because an approval gate can be rubber-stamped. See the AI Agent Autonomy Levels Framework.
Least agency
The OWASP Top 10 for Agentic Applications 2026 extends least privilege into least agency: avoid unnecessary autonomy, because deploying agentic behaviour where it is not needed expands the attack surface without adding value. In governance terms the first question for any proposal is whether the task needs an agent at all, or whether a deterministic workflow or a suggest-only assistant would do.
The agent as an accountable non-human identity
An agent that acts with a borrowed human token or a shared service account cannot be governed: its actions cannot be attributed, its access cannot be reviewed separately and it cannot be revoked without collateral damage. Governance therefore requires each production agent to have its own identity, a named human owner, a stated purpose and documented delegation (whom it acts for). This is the same lifecycle discipline applied to other non-human identities, with autonomy added. NIST's NCCoE has an exploratory project on software and AI agent identity and authorisation that frames the problem the same way. See the Agentic AI Identity Guide.
Risk tiering
Not every agent merits the same process. A practical tiering uses four inputs: data sensitivity, reversibility and value of actions, exposure to untrusted content, and autonomy level. Low tiers go through a lightweight registration; high tiers need a full risk assessment, a threat model, defined approval gates and sign-off by a risk owner. See the AI Use Case Risk Tiering Guide.
| Tier | Typical agent | Governance required |
|---|---|---|
| Tier 1: assistive | Drafts, summarises or searches; read-only on non-sensitive data; a person acts on output | Inventory entry, owner, acceptable use, logging |
| Tier 2: supervised action | Makes reversible changes (tickets, branches, records) with human review | Plus own identity, scoped credentials, risk assessment template, tool allowlist |
| Tier 3: autonomous action | Acts without per-action approval within bounds, or touches personal or financial data | Plus threat model, approval gates for irreversible actions, budgets, baselining, tested kill switch, security testing before release |
| Tier 4: high consequence | Irreversible or regulated decisions (payments, access changes, decisions about people), or EU AI Act high-risk use | Plus executive risk acceptance, legal review, DPIA where personal data is processed, regulator-grade audit trail, periodic independent review |
Risk assessment and threat modelling
Risk assessment asks how likely and how severe harm is for this deployment; threat modelling asks how it could happen. For agents both must cover the model, prompts and memory, tools and their credentials, data sources the agent reads (which may carry injected instructions), other agents it talks to, and the humans who approve its actions. CSA's MAESTRO framework structures this across seven layers, from foundation models to the agent ecosystem, with security and compliance as a layer spanning the others. See the AI Agent Threat Modelling Guide and the Agentic AI Risk Assessment Template.
Main threats
From a governance view the threats are risks the organisation has to own, not only attacks to block. The technical detail is in the Agent Threats and Attacks Guide; the business framing is in the Top 10 AI Agent Security Risks for CISOs.
| Governance risk | How it shows up | Related OWASP agentic risk | Governance control |
|---|---|---|---|
| Unowned and unknown agents | Agents built in low-code tools, SaaS features or coding assistants with no registry entry | ASI10 Rogue Agents | Mandatory registration, discovery, owner attestation |
| Over-scoped or borrowed credentials | Pilot agents promoted to production on a developer token or admin key | ASI03 Identity and Privilege Abuse | Identity standard per tier; access review of agent entitlements |
| Untrusted content driving actions | Agents that read email, web or tickets and also hold write or send rights | ASI01 Agent Goal Hijack | Risk assessment rule: separate reading untrusted content from high-impact actions |
| Supply chain exposure | Third-party tools, MCP servers, skills and models that can be malicious or later compromised | ASI04 Agentic Supply Chain Vulnerabilities | Approved tool and server list; supplier assessment; contract clauses |
| Oversight that does not work | Approvals clicked through, or nobody empowered to stop an agent | ASI09 Human-Agent Trust Exploitation | Defined approvers with authority; approval metrics reviewed |
| Cascading and multi-agent failure | One agent's error propagates through others at machine speed | ASI07, ASI08 | Blast-radius limits in design review; inter-agent trust rules |
| Regulatory and data protection exposure | Agents processing personal data in ways no DPIA anticipated | Not an OWASP item | DPIA trigger in registration; record of processing updated |
| Missing evidence | No attributable audit trail when a regulator, auditor or court asks | Not an OWASP item | Logging and retention standard by tier |
The OpenAI and Hugging Face Breach 2026 shows a governance failure as much as a technical one: an evaluation was run with reduced cyber refusals and without production safety controls, in an environment that could reach internal systems, and early warning signs were judged not to need stopping the run. High-risk runs need explicit risk acceptance, a defined stop authority and stop criteria agreed in advance.
Key controls by maturity
NHI Mgmt Group's NHI Governance Maturity Model uses five levels, from ad hoc to optimised. The same progression applies to agents. See the Agentic AI Identity Maturity Model.
| Level | What agent governance looks like | Next step |
|---|---|---|
| 1. Ad hoc | Teams adopt agents independently; no register; agents run on personal or shared credentials | Publish a short policy and require registration of every production agent |
| 2. Developing | Register exists but is incomplete; owners named for known agents; risk assessed case by case | Introduce risk tiers and a standard assessment template; start discovery of embedded and shadow agents |
| 3. Defined | Tiered process with minimum controls per tier; own identity per production agent; threat models for high tiers; approved tool list | Link re-assessment to change management; review agent entitlements on a schedule |
| 4. Managed | Control metrics reported to a governance forum; autonomy changes need evidence; audit trails tested against regulatory requirements | Automate evidence collection and demotion on anomaly |
| 5. Optimised | Risk appetite for agents set by the board; autonomy adjusted on measured behaviour; lessons from incidents and red teaming feed policy | Benchmark externally; independent assurance |
A practical rollout
- Set the policy floor: a one-page rule set covering registration, own identity, prohibited data and actions, and who may approve a new agent. Adapt the Agentic AI Security Policy Template.
- Build the register: start from the agents teams declare, then discover the rest from identity provider app registrations, OAuth grants, API key inventories, AI gateway logs and SaaS admin consoles. See the AI Register and AI Inventory Template.
- Tier and assess: apply the tiering to every registered agent. Pilot the assessment on three to five agents of different tiers, adjust the template, then make it mandatory for new deployments. See the AI Agent Risk Assessment Template.
- Threat model high tiers using a workshop format and record the controls each threat requires. See the AI Agent Threat Model Template.
- Bind decisions to change management: a new model, system prompt, tool, data source or autonomy level re-opens the assessment. Keep the previous approved configuration as the rollback target.
- Map once, report many: build one control set and map it to each framework you answer to, rather than parallel programmes. See the Agentic AI Compliance Guide.
- Report to leadership with a small set of metrics and the top residual risks, each with an owner and a decision requested.
Decision guidance
- Agent or workflow: if the steps are known and stable, a deterministic workflow with a model call inside is easier to govern than an agent that plans its own steps. Choose an agent when the task genuinely needs planning over open-ended inputs.
- Build or buy: a bought agent inside a SaaS product shifts engineering effort to the supplier but not accountability; you still need the register entry, the identity and scope review, contractual logging and the right to switch it off. See the Embedded AI in SaaS Guide.
- Central or federated governance: small organisations can run one review by the security lead and a business owner. Large organisations usually set policy and tiers centrally and let business units approve Tier 1 and 2 agents, keeping Tier 3 and 4 with a central risk forum.
- Existing committee or new one: extend an existing AI review or architecture board where it has security and identity representation; create a new forum only if none can take Tier 3 and 4 decisions. See the AI Ethics Board and AI Review Committee Guide.
Roles and ownership
NIST AI RMF GOVERN 2.1 expects roles, responsibilities and lines of communication for mapping, measuring and managing AI risk to be documented and understood. For agents, the split below works in most organisations.
| Role | Accountable for | Decides |
|---|---|---|
| Board or executive risk committee | Risk appetite for autonomous systems | Tier 4 acceptance; limits on autonomy in regulated processes |
| CISO | Agent security policy, minimum controls per tier, incident authority | Exceptions to policy; fleet-wide stop |
| AI governance lead or risk function | Register, tiering, assessment process, framework mapping | Tier assignment; when re-assessment is required |
| Agent owner (business or product) | Purpose, residual risk, ongoing operation | Tier 1 to 3 risk acceptance within appetite; restart after incidents |
| IAM and NHI team | Agent identities, credential standards, access reviews of agent entitlements | Credential type and lifetime per tier |
| Privacy and legal | DPIAs, records of processing, AI Act classification, contracts | Whether a use case is high-risk or needs notification to affected people |
| Procurement and third-party risk | Supplier assessment of agent platforms, models and tools | Approved supplier and tool list |
Under the EU AI Act, deployers of high-risk systems must assign human oversight to people with the necessary competence, training and authority (Article 26(2)); the governance model should name those people per agent, not per team.
Detection and measurement
Governance needs its own metrics, separate from SOC detections, to show whether the programme is working. NIST AI RMF MANAGE 4.1 expects post-deployment monitoring plans, including change management and decommissioning. Measure:
- Register coverage: discovered agents (from identity provider, OAuth, API key and gateway sources) that are registered with a named owner, as a share of all discovered agents.
- Assessment currency: share of Tier 2 to 4 agents whose risk assessment post-dates their last model, prompt or tool change.
- Own-identity rate: share of production agents with their own identity rather than human or shared credentials.
- Entitlement review completion: share of agent entitlements reviewed in the last cycle, and entitlements removed as a result.
- Exceptions: number and age of open policy exceptions for agents.
- Orphaned agents: agents whose owner has left or whose project has ended, and time to decommission them.
Common failure patterns
- Governing the model instead of the deployment. Approving "use of model X" says nothing about the tools, credentials and data an agent built on it will hold.
- A register that only lists what teams declare. Embedded SaaS agents, coding assistants and low-code automations are found only by looking at OAuth grants, API keys and gateway traffic.
- One-time approval. An agent assessed at launch and then given new tools or a new model is a different system running on an old approval.
- Accountability that ends at a team name. When an agent misbehaves out of hours, "the data platform team" cannot make a stop decision; a named person with delegated authority can.
- High-risk experiments outside governance. Evaluations, red team runs and proofs of concept are often exempt from production controls, as the OpenAI and Hugging Face Breach 2026 showed; they need the same risk acceptance and stop criteria.
- Parallel compliance programmes. Separate spreadsheets for the AI Act, ISO/IEC 42001 and data protection drift apart; one control set with mappings stays consistent.
Standards and frameworks
| Framework | Status | Where agent governance sits |
|---|---|---|
| NIST AI RMF 1.0 (AI 100-1) | Voluntary; released 26 January 2023; NIST states it is being revised | GOVERN 1.6 inventory; GOVERN 2.1 roles; GOVERN 6.1 third-party risk; MAP 1.1 intended purpose and context; MANAGE 2.4 deactivation; MANAGE 4.1 post-deployment monitoring |
| NIST AI 600-1 Generative AI Profile | Released 26 July 2024 | Generative AI risks and actions mapped to the AI RMF functions |
| ISO/IEC 42001:2023 | Published December 2023; certifiable management system standard | AI management system (AIMS) using Plan-Do-Check-Act; policies, objectives, risk and impact processes that cover agents as AI systems |
| EU AI Act (Regulation (EU) 2024/1689) | In force; Annex III high-risk obligations apply from 2 December 2027 and Annex I from 2 August 2028 per the timeline as amended by the Digital Omnibus on AI; Article 50 transparency from 2 August 2026 | Article 14 oversight proportionate to autonomy; Article 26 deployer duties, including competent overseers, monitoring, suspension and log retention of at least six months |
| OWASP Top 10 for Agentic Applications 2026 | Published December 2025 | Risk vocabulary ASI01 to ASI10; least agency |
| IMDA Model AI Governance Framework for Agentic AI (Singapore) | Launched 22 January 2026 | Four dimensions: bound risks upfront, keep humans accountable, technical controls across the lifecycle, end-user responsibility |
| CSA MAESTRO | Published February 2025 | Seven-layer threat model for agentic systems |
| NIST SP 800-53 Rev. 5 | Current | PM-5 System Inventory, PM-9 Risk Management Strategy, RA-3 Risk Assessment, CM-8 System Component Inventory, AC-2 Account Management, SA-9 External System Services, SR-3 Supply Chain Controls and Processes |
| NIST CSF 2.0 | Current | GV.PO-01 policy, GV.RR-02 roles and authorities, GV.RM-01 risk objectives, GV.SC-01 supply chain programme, GV.OV-01 strategy review, ID.AM-02 inventories of software and services, ID.RA-01 vulnerabilities identified |
In ISO/IEC 27001:2022 terms, agents belong in the asset inventory (A.5.9), role definitions (A.5.2) and supplier relationship controls (A.5.19). See the NIST AI RMF Guide, the ISO/IEC 42001 Guide and the EU AI Act Compliance Guide.
Where to go next (all guides in this category)
Strategy and the risk landscape
- Agentic AI Security Guide: threats and controls across the agent stack, the starting point for the whole topic.
- Top 10 AI Agent Security Risks for CISOs: the business view of agent risk with the question to ask your teams for each.
- AI Agent Autonomy Levels Framework: published autonomy schemes compared and the controls that belong at each level.
Risk assessment and threat modelling
- Agentic AI Risk Assessment Template: scoring agents before they go live.
- AI Agent Risk Assessment Template: scoping autonomy, access and controls for a single agent.
- AI Agent Threat Modelling Guide: running a practical threat modelling workshop for agents.
- AI Agent Threat Model Template: assets, threats and controls in a reusable format.
Policy, compliance and evidence
- Agentic AI Security Policy Template: numbered policy sections ready to adapt.
- Agentic AI Compliance Guide: mapping agent identity controls to the EU AI Act, NIST AI RMF and ISO/IEC 42001.
- AI Agent Audit Trails for Regulators Guide: logging evidence that stands up to regulators and auditors.
Practitioner checklist
- A short agent policy is published, covering registration, own identity, prohibited data and actions, and approval authority.
- Every production agent is in the register with a named owner, purpose, tools, data, credentials and autonomy level per action class.
- Discovery runs against identity provider, OAuth, API key and gateway data to find unregistered agents.
- Agents are tiered, and Tier 3 and 4 agents have a current risk assessment and threat model.
- Model, prompt, tool, data source and autonomy changes trigger re-assessment through change management.
- Agent entitlements are included in access reviews, with orphaned agents decommissioned.
- Stop authority and stop criteria are named per agent, including for evaluations and proofs of concept.
- Third-party agent platforms, tools and MCP servers pass supplier assessment before use.
- One control set is mapped to the EU AI Act, NIST AI RMF, ISO/IEC 42001 and data protection duties.
- Governance metrics and top residual risks are reported to a named forum at least quarterly.
Standards and references
- NIST: AI 100-1 Artificial Intelligence Risk Management Framework (AI RMF 1.0)
- ISO: ISO/IEC 42001:2023 Artificial intelligence management system
- European Commission AI Act Service Desk: Article 26 Obligations of deployers of high-risk AI systems
- European Commission AI Act Service Desk: Timeline for the implementation of the EU AI Act
- OWASP GenAI Security Project: Top 10 for Agentic Applications for 2026
- Singapore MDDI: Model AI Governance Framework for Agentic AI
- Cloud Security Alliance: Agentic AI Threat Modeling Framework MAESTRO
- NIST NCCoE: Software and AI Agent Identity and Authorization
Related NHI Mgmt Group resources: Agent Controls and Monitoring Guide · Agent Identity and Access Guide · NHI Governance Maturity Model · AI Governance Guide. This guide summarises regulatory requirements for security practitioners and is not legal advice.