--- title: "Agentic AI Governance: how to effectively manage AI that can act" description: "Agentic AI governance: how to effectively manage AI agents by addressing autonomy, risk, compliance, accountability, and control." image: https://newsroom.kireygroup.com/hubfs/Data%26AI_17.png --- [kireygroup.com](https://www.kireygroup.com/) [![](https://newsroom.kireygroup.com/hubfs/item-2020-dicembre/logo-Blog-v2.svg)](https://newsroom.kireygroup.com/en/news) - [Ita](https://newsroom.kireygroup.com/news/agentic-ai-governance-come-gestire-al-meglio-un-ai-in-grado-di-agire?hsLang=it) - Eng - [Esp](https://newsroom.kireygroup.com/es/news/gobernanza-de-la-ia-agentica-como-gestionar-de-forma-eficaz-una-ia-que-actua?hsLang=es) [Kireygroup.com](https://www.kireygroup.com/) # Get your daily dose of tech! ## We Shape Your Knowledge # [Inference Costs: how to prevent AI agents from driving costs up exponentially](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) Artificial intelligence has an innovative side, but it also comes with a bill to pay. And in recent ... [Read more](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) 18 MIN READ 23 October 2026 ### Latest News - [Inference Costs: how to prevent AI agents from driving costs up exponentially](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) - [Kirey Advisory at the ABI Lab workshop on Processes, Operations and Organization](https://newsroom.kireygroup.com/en/news/kirey-advisory-at-the-abi-lab-workshop-on-processes-operations-and-organization?hsLang=en) - [Kirey Strengthens Its SAP Presence: Mind The Value Achieves Reselling Partner Status](https://newsroom.kireygroup.com/en/news/kirey-strengthens-its-sap-presence-mind-the-value-achieves-reselling-partner-status?hsLang=en) - [The Dark Side of Multicloud: how to prevent workload placement from generating technical debt](https://newsroom.kireygroup.com/en/news/the-dark-side-of-multicloud-how-to-prevent-workload-placement-from-generating-technical-debt?hsLang=en) - [Shadow AI: 4 out of 5 employees use tools not governed by the company](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) - [Legacy modernization in banking: discover the true cost of legacy systems](https://newsroom.kireygroup.com/en/news/legacy-modernization-in-banking-discover-the-true-cost-of-legacy-systems?hsLang=en) - [Artificial Intelligence](https://newsroom.kireygroup.com/en/news/tag/artificial-intelligence) / # Agentic AI Governance: how to effectively manage AI that can act #### Kirey [![](https://newsroom.kireygroup.com/hubfs/it.svg)](https://newsroom.kireygroup.com/news/agentic-ai-governance-come-gestire-al-meglio-un-ai-in-grado-di-agire?hsLang=it)    [![](https://newsroom.kireygroup.com/hubfs/ES.svg)](https://newsroom.kireygroup.com/es/news/gobernanza-de-la-ia-agentica-como-gestionar-de-forma-eficaz-una-ia-que-actua?hsLang=es) 10 MIN READ 10 September 2026 - Share on: - - - - [All](https://newsroom.kireygroup.com/news?hsLang=en) - Categories + - [Corporate](https://newsroom.kireygroup.com/en/news/tag/corporate) - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) - [Events/Webinars](https://newsroom.kireygroup.com/en/news/tag/events-webinars) - [Cloud](https://newsroom.kireygroup.com/en/news/tag/cloud) - [Data Value](https://newsroom.kireygroup.com/en/news/tag/data-value) - [Innovation](https://newsroom.kireygroup.com/en/news/tag/innovation) - [Artificial Intelligence](https://newsroom.kireygroup.com/en/news/tag/artificial-intelligence) - [Monitoring](https://newsroom.kireygroup.com/en/news/tag/monitoring) - [DevSecOps](https://newsroom.kireygroup.com/en/news/tag/devsecops) - [Software Development](https://newsroom.kireygroup.com/en/news/tag/software-development) - [Corporate Social Responsibility](https://newsroom.kireygroup.com/en/news/tag/corporate-social-responsibility) - [Advisory](https://newsroom.kireygroup.com/en/news/tag/advisory) - [Data Privacy](https://newsroom.kireygroup.com/en/news/tag/data-privacy) - [Accessibility](https://newsroom.kireygroup.com/en/news/tag/accessibility) - [Automation](https://newsroom.kireygroup.com/en/news/tag/automation) - [Digital Banking](https://newsroom.kireygroup.com/en/news/tag/digital-banking) - [Use case](https://newsroom.kireygroup.com/en/news/tag/use-case) - [Welfare & Social Services](https://newsroom.kireygroup.com/en/news/tag/welfare-social-services) - [Press & PR](https://newsroom.kireygroup.com/en/news/tag/press) For years, companies have been asking themselves how to govern AI-generated responses. **But what happens when artificial intelligence starts to act?** Investments in Agentic AI solutions continue to be substantial. According to [EY’s AI Pulse Survey](https://www.ey.com/en_us/insights/emerging-technologies/pulse-ai-survey), approximately one-third of companies expect to **invest more than $10 million in artificial intelligence in 2026**, to give agents an increasingly central role in executing business processes. The enthusiasm is understandable: many see AI as **the future** ***operating system*** **of the enterprise**, but this also brings new responsibilities. When a system not only generates content but also makes decisions, interacts with other systems, and performs actions that impact the business, **governance becomes an absolute priority.** Key Points - The agentic paradigm introduces **new risks** compared with generative AI because of its ability to make decisions and execute actions. - Building an Agentic AI governance model means addressing **compliance, security, accountability, and oversight** across the entire ecosystem. - Governance must accompany **the agents’ lifecycle**, from design through continuous monitoring and, eventually, decommissioning. ## Why Agentic Systems Change the Rules of AI Governance For years, AI governance has focused on model outputs: given a prompt and a response, it was necessary to verify **accuracy, transparency, bias, and regulatory compliance**. The final decision remained with a professional, who would act based on their own experience and the AI model’s output. With agentic systems, the paradigm changes because these software systems: - plan activities; - call tools; - use credentials; - access data; - use APIs and corporate services; - collaborate with other agents within workflows; - execute sequences of actions to achieve a goal. Complicating the picture further is **the issue of accountability**. When an agent makes decisions and executes actions, **who is responsible?** The accountability chain becomes longer, involving not only those who developed the model, but also those who integrated and configured the solution and, above all, **the company that decides to entrust it with specific activities.** AI governance in an agentic context therefore cannot be limited to verifying the reliability of the model on which solutions are based. It must also monitor in real time **what the agent is authorized to do**, which resources it can use and when it must stop, while also establishing robust accountability models. ## The New Risks of the Agentic Era Autonomy and the ability to act represent **the main points of discontinuity between agentic systems and generative AI**. Managing them effectively requires considering new categories of risk, including **the agent’s interaction with the external ecosystem**. - **Loss of control over task execution** An agent can chain together dozens of actions. If objectives and constraints are not defined correctly, errors can propagate and become extremely difficult to detect. - **Excessive permissions and authorizations** Agents access APIs and databases to perform their tasks. It is essential that the privileges granted never exceed what is strictly necessary. - **New cyber risks** The more an agent is connected to systems, data and applications, the greater the number of points an attacker can attempt to exploit for their own benefit. - **Unpredictable behavior in multi-agent systems** Interactions between agents, even when governed by deterministic logic, can produce unexpected effects. It is necessary to define not only rules, but also **monitoring and arbitration mechanisms** capable of detecting unforeseen effects in real time. - **Difficulty in auditing and establishing accountability** Reconstructing who made a decision, which information they used and why they executed a particular action can be extremely complex within ecosystems that orchestrate **hundreds of different software agents, often developed by different vendors** and interconnected with one another. ## Shared Responsibility: The Three Levels of Accountability Accountability in agentic ecosystems operates across three distinct levels: technology, corporate governance, and individual operational roles. 1. **Technological ecosystem** Each actor is responsible for their own area of responsibility. The model provider is accountable for its capabilities and technological limitations; those who develop and integrate the solution are responsible for the architecture and control mechanisms implemented at the company’s direction; the company itself retains ultimate responsibility for how the solution is used, deciding its objectives, level of autonomy and the responsibilities of the professionals involved. 2. **Corporate organization** At the corporate level, clear governance is essential. In practical terms, it must be clear who **defines policies, approves use cases, assigns authorizations and access levels** and decides when an activity requires human intervention. These decisions should be entrusted to **a cross-functional governance body** (risk, compliance, security and business), rather than to a single function such as IT, in order to balance operational needs with legal and reputational risks. 3. **Clearly defined roles and responsibilities** A fundamental part of governance is defining **who monitors the agent’s behavior and periodically reassesses its permissions and levels of autonomy**, who ensures the traceability of its actions, and who has the authority to suspend it in the event of anomalous behavior. Finally, it is necessary to establish who trains professionals **to recognize the agent’s limitations**. ## Not Just Compliance: Agent Governance Goes Beyond Regulatory Requirements It may be tempting to think that investing in AI governance is solely about ensuring compliance. To some extent, this is true: the European AI Act, to cite a current example, introduces stringent obligations for AI systems, particularly high-risk systems, including **human oversight, traceability and risk management throughout the entire lifecycle**. This is complemented, for example, by the requirements of the **ISO 42001 standard**, which provides a structured framework for policies, risk assessment and continuous improvement, **applicable beyond European borders as well**. Reducing governance to a **compliance exercise would, however, be a mistake in perspective**. An agent operating with excessive permissions and without adequate controls exposes the company to risks that go beyond sanctions and include concrete operational damage, security incidents and reputational repercussions. **Regulatory compliance, in this sense, is the minimum threshold, not the goal.** ## Governance Covers the Entire Agent Lifecycle A common mistake is to think of agentic system governance as a set of controls and processes to be applied **once the system is already ready for production**. 1. The critical moment for preventing risks comes much earlier, particularly during the design phase, when **objectives, constraints, the data the agent will be able to access,** and the level of autonomy granted are defined. 2. During development and testing, governance translates into **security checks, simulations of adverse scenarios, and validation of control mechanisms** before the agent interacts with real systems or data. 3. During deployment, **authorizations, minimum necessary permissions, and thresholds for human intervention** come into play. 4. In day-to-day operations, governance must be supported by **continuous monitoring**, periodic audits, the reassessment of permissions, incident management, and the ability to detect and correct deviations from the original objectives. 5. Finally, decommissioning also requires attention: it is necessary to **properly revoke credentials and access, verify that no business process depends** on the decommissioned agent, and retain the documentation needed for future audits. Designing governance as a continuous cycle, rather than as an initial control, is what distinguishes **mature agent adoption from a risky implementation**. ## Kirey: Innovating with AI Without Losing Control Digital transformation requires not only new technologies, **but also a new way of governing them**. When AI ceases to be a simple support tool and becomes an integral part of business processes, companies need a partner capable of supporting them **in defining an effective governance model**. Without one, they risk facing compliance issues, new vulnerabilities, undefined responsibilities, and the **loss of control over automated processes**. At Kirey, we help companies transform [artificial intelligence](https://www.kireygroup.com/en/products/artificial-intelligence) from a collection of experiments and isolated initiatives into the **next** ***operating system*** **for the entire organization**. We stand alongside them to unlock its full potential, without losing sight of key issues such as control, security, compliance, and risk management. **The design and implementation of governance models for agentic AI are precisely aimed at this goal.** [Contact us](https://www.kireygroup.com/en/contact) to begin the journey toward more autonomous, secure, and well-governed AI together. - [Previous post](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) - [Read all posts](https://newsroom.kireygroup.com/en/news?hsLang=en) - [Next post](https://newsroom.kireygroup.com/en/news/context-engineering-the-art-and-science-behind-ai-agents?hsLang=en) ## Related posts: #### [Inference Costs: how to prevent AI agents from dri...](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) Artificial intelligence has an innovative side, but it also comes with a bill to pay. And in recent ... [Read more](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) 18 MIN READ 10 September 2026 #### [Context Engineering, the art and science behind AI...](https://newsroom.kireygroup.com/en/news/context-engineering-the-art-and-science-behind-ai-agents?hsLang=en) With the spread of LLMs, the discipline of prompt engineering emerged, studying the most effective w... [Read more](https://newsroom.kireygroup.com/en/news/context-engineering-the-art-and-science-behind-ai-agents?hsLang=en) 12 MIN READ 10 September 2026 #### [AI Act: what happens on 2 August 2026 and what cha...](https://newsroom.kireygroup.com/en/news/ai-act-what-happens-on-2-august-2026-and-what-changes-for-businesses?hsLang=en) 2 August 2026 has always been considered a key milestone in the AI Act implementation timeline. Foll... [Read more](https://newsroom.kireygroup.com/en/news/ai-act-what-happens-on-2-august-2026-and-what-changes-for-businesses?hsLang=en) 8 MIN READ 10 September 2026 #### Explore - [Home](https://www.kireygroup.com/) - [Competencies](https://www.kireygroup.com/en/competencies) - [Industries](https://www.kireygroup.com/en/industries) - [About Us](https://www.kireygroup.com/en/about-us) - [Tech&Partners](https://www.kireygroup.com/en/tech-partners) - [Careers](https://www.kireygroup.com/en/careers) - [Contact](https://www.kireygroup.com/en/contact) - [Corporate Social Responsibility](https://www.kireygroup.com/en/corporate-social-responsibility) - [Advisory](https://www.kireyadvisory.com/en) #### Policy - [Quality](https://www.kireygroup.com/oven/media/PKG-COMP-AL14-Quality-Policy.pdf) - [Security](https://www.kireygroup.com/oven/media/PKG-CIS-LG02-Security-Policy.pdf) - [Gender Equality](https://www.kireygroup.com/oven/media/PKG-COMP-LG03-Politica-per-la-parita-di-Genere-v2.pdf) - [Service Management](https://www.kireygroup.com/oven/media/PKG-COMP-AL45-Politica-per-la-gestione-dei-servizi.pdf) - [Environment](https://www.kireygroup.com/oven/media/PKG-COMP-AL44-Politica-Ambientale-Kirey.pdf) - [Health, Safety & Wellbeing](https://www.kireygroup.com/oven/media/PKG-COMP-LG02-Policy-on-health-safety-and-well-being-in-the-work-environment.pdf) - [ESG](https://www.kireygroup.com/oven/media/Policy-ESG-ENG-v1.pdf) - [Info on Data Processing](https://www.kireygroup.com/en/information-on-data-processing) #### Certifications - [ISO 9001:2015](https://www.kireygroup.com/oven/media/KIREY-S-R-L-9001.pdf) - [ISO/IEC 27001:2022](https://www.kireygroup.com/oven/media/KIREY-S-R-L-27001.pdf) - [PDR 125](https://www.kireygroup.com/oven/media/PDR-125-2022.pdf) - [ISO/IEC 20000-1:2018](https://www.kireygroup.com/oven/media/ISOIEC-20000-12018-ENG.pdf) - [ISO 14001:2015](https://www.kireygroup.com/oven/media/ISO-14001-2015-ENG.pdf) - [ISO 45001:2018](https://www.kireygroup.com/oven/media/CERTIFICATO-ISO-45001-KIREY-ENG.pdf) - [ISO 22301:2019](https://www.kireygroup.com/oven/media/ISO-22301-2019-ENG.pdf) #### Info **Kirey Srl** [info@kireygroup.com](mailto:info@kireygroup.com) Viale Francesco Restelli, 5 20124 Milano [kirey@pec.it](mailto:kirey@pec.it) **PI/CF**: 06729880960 **REA**: MI 1910802 **Tel**: +39 02 78625200 Capitale sociale 1.089.620,00  [![Linkedin](https://newsroom.kireygroup.com/hs-fs/hubfs/Linkedin.png?width=20&name=Linkedin.png)](https://www.linkedin.com/company/kireygroup/)   - [Privacy Policy](https://www.kireygroup.com/oven/media/Kirey-Privacy-ENG-policy-art-13.pdf) - [Cookie Policy](https://www.kireygroup.com/oven/media/Kirey-Cookie-Policy-ENG-1.pdf) - [Terms and Conditions](https://www.kireygroup.com/oven/media/Kirey-Website-Terms-and-Conditions-1.pdf) [![KIREY LOGO](https://newsroom.kireygroup.com/hs-fs/hubfs/KIREY_LOGO_PAYOFF_RGB_POS.png?width=200&height=72&name=KIREY_LOGO_PAYOFF_RGB_POS.png)](https://www.kireygroup.com/) © Copyright 2026 by Kirey