---
title: "Glossary: AI agent governance"
canonical_url: "https://tokenobserve.com/glossary/ai-agent-governance"
published: 2026-09-02
last_updated: 2026-10-21
---

# Glossary: AI agent governance

AI agent governance is the practice of deciding, outside the agent and before it acts, whether the authority it is about to exercise is authority somebody delegated to it, and of recording afterwards what it did with that authority in a form that survives the people who could edit it. What separates it from model safety, from observability and from identity management is where the decision sits: in the path the action must travel, where it can refuse, rather than in a policy document, a dashboard, or a nightly reconciliation.

## Also called

- agent governance
- agentic AI governance
- AI agent governance framework
- autonomous agent governance

## In practice

The definition is narrow on purpose, because most of what is sold under the name fails it. A system prompt asking a model to be careful is not governance; the model can be argued out of it, in text it was asked to read. A callback inside the agent’s own framework that checks an amount before calling a tool is enforced by the thing being governed, and it changes whenever somebody redeploys. A dashboard showing last month’s spend is reporting, not a control — it describes what happened after the money left. What distinguishes a control from all three is that the decision point sits outside the agent, in the path, and the agent cannot decline it.

The field is organised by when the decision falls. Before the action: whether the authority in play traces to a deliberate delegation and has not widened since. After it: what the agent did, taken from the record rather than from the agent’s own account of it. And across both: whether the control was running at the moment it was needed, which is a property of the record rather than of the policy.

Four adjacent systems each cover part of this. Identity answers who is calling, security tooling answers what is in the payload, a gateway answers where the request goes, and observability answers what the run looked like from inside; none of them settles the tie between the authority delegated for one particular call and the effect that call had on the business. The remainder decomposes into six controls: an agent inventory, action-level permissions that deny by default, a policy layer, spend and rate ceilings, a tamper-evident record of administrative acts, and a way of finding traffic that routes past the other five. The guide on this site that asks what AI agent governance requires takes all six at length, with the order to build them in and the acceptance test for each.

The regulatory anchors — EU AI Act Articles 12, 14 and 26, with the six-month log-retention floor in Article 26(6); ISO/IEC 42001; NIST AI RMF 1.0; and the OWASP LLM and agentic risk lists — set the evidence an operator must produce rather than the architecture that produces it, and a layer between agents and providers evidences nothing about training-data provenance, model cards or bias testing, records no hidden model reasoning, does not control what the calling application does with the text it receives, and reaches only what routes through it.

## Example: A support agent that can issue refunds

A support agent is given a read on the order database and a refund tool. Governance is what makes four things true at the moment it acts, none of which the agent controls: the refund tool is in its granted action set and the account-deletion tool sitting next to it in the same system is not; a refund above the threshold somebody chose is held for a named human rather than issued; that hold is bound to the exact refund amount and account, so approving £40 does not authorise £40,000; and the whole sequence — the request, the verdict, who approved it, what the refund system was afterwards observed to have done — is recorded where the person who ran the agent cannot amend it. Remove any one of the four and you still have a support agent that issues refunds. You no longer have an answer to the question a regulator, an auditor or a customer will ask: who decided this.

## Routinely confused with

AI governance: AI governance is the organisation-wide programme — risk classification, model procurement, impact assessment, policy, training, committee structure. Agent governance is the runtime subset that acts on individual actions while they are happening. One produces documents and decisions; the other produces refusals and records.

Model safety and alignment: Safety work changes what the model is disposed to do, and it is done by whoever trained it. Governance changes what the deployment permits, and it holds when the model’s disposition fails, which is the case to design for, since a model talked into ignoring its instructions has not stopped being able to call the tools it was given.

LLM observability: Observability answers what the system did and how good the answer was, and it is produced by the same process that did the thing. Governance answers whether it was allowed to and can refuse before the fact. A trace is a description; evidence is a description somebody other than the describer can check.