AI Agent Governance: A Practical Framework for the 60% Who Don't Have One Yet

Enterprise AI agent adoption has outrun governance by a wide margin — recent industry data puts embedded-agent penetration at 80% of new enterprise apps, while 60% of organisations running agents have no formal governance for them. If you're in that 60%, here is a starting framework that doesn't require a six-month policy project before you can act.

Start With an Inventory, Not a Policy Document

You cannot govern what you don't know exists. Before writing any policy, build a simple register: every AI agent running in your organisation, what system it touches, what data it can access, what actions it can take autonomously, and who owns it. Most organisations we work with are surprised by how many agents already exist once they actually look — spun up by individual teams, embedded in SaaS tools, or added as a 'smart' feature nobody flagged as an agent.

Define Three Tiers of Autonomy, Not One Blanket Rule

• Tier 1 — fully autonomous: low-risk, reversible actions (drafting a reply, summarising a document) with no sign-off required
• Tier 2 — human-checkpoint: actions with real consequences (sending customer communications, modifying records) that require a human approval step before execution
• Tier 3 — human-led, agent-assisted: high-stakes actions (financial transactions, system configuration, anything customer-facing at scale) where the agent prepares a recommendation but a human decides

Logging Is Not Optional — It's the Governance

Every agent action should be logged with enough detail to reconstruct what it saw, what it decided, and why — not for compliance theatre, but because when something goes wrong (and eventually something will), the difference between a 20-minute investigation and a week-long forensic exercise is whether you built this in from day one.

This does not need to be perfect on day one. A basic inventory, a three-tier autonomy policy, and consistent logging gets most organisations to a materially safer position than where the current 60% sit today — and it's a foundation you can layer formal compliance requirements onto later, rather than trying to build both at once.