The assumption every framework shares
Every major AI governance framework was written with the same picture in mind: a system takes an input, produces an output, and a human decides what happens next. Article 14 of the EU AI Act requires that high-risk systems be designed so that natural persons can oversee them, intervene, and interrupt. The ICO’s guidance on automated decision-making under UK GDPR turns on whether human review is meaningful. ISO 42001 organises its controls around the lifecycle of an identifiable system with a defined intended purpose. NIST’s AI Risk Management Framework asks organisations to map risk in the context of a system’s use. Different instruments, same assumption: somewhere in the process there is a checkpoint where a person can look at what the machine proposes before it takes effect.
Agentic AI removes the checkpoint. A multi-step agent plans, selects tools, acts, observes the result and re-plans — often dozens of times inside a single task, often in seconds. By the time a human could review anything, the actions have happened: the record is updated, the message sent, the API called. The frameworks are not wrong; they answer a different question. They tell you how to oversee a decision. Agents force the harder question — how to govern a process that makes its own decisions along the way.
Authority boundaries and delegation chains
Start with authority. A conventional system’s capability is its function: a credit model scores applications and does nothing else. An agent’s capability is the composition of every tool it can reach — and compositions are not enumerated in advance. A firm can authorise an agent to reconcile supplier invoices and discover that, to do the job, it can also read the vendor master file, write to the ledger and email counterparties. Frameworks ask deployers to document intended purpose. Agents require something the frameworks do not: a documented action space — every tool, scope and permission the agent holds, and the combinations it must never form.
Then delegation. Agents increasingly hand sub-tasks to other agents and to third-party services. Under the FCA and PRA’s Senior Managers regime, accountability attaches to a named individual — workable when the chain of delegation is visible. When an agent passes work to a sub-agent, which invokes a vendor tool, which calls a model hosted by a fourth party, the constraints the first agent operated under do not automatically travel with the task. No current framework specifies whether, or how, authority limits, data-handling restrictions and oversight obligations are inherited down a delegation chain. In practice, they usually are not.
Audit trails, kill-switches and liability
Audit is the third gap. Traditional audit trails capture what a system did. With agents, the risk sits in the intermediate steps: which tool was chosen, what parameters were passed, why one plan was abandoned for another, why a failed call was retried. Logging final outputs misses the point of failure. Logging everything raises questions the frameworks have not answered — how long reasoning traces should be retained, what evidential status they hold in a regulatory inquiry or a dispute, and whether non-deterministic traces can support the reproducibility an auditor expects.
Kill-switches are the fourth. Article 14 contemplates the ability to interrupt a system — colloquially, a stop button. Pressing it assumes stopping is safe. Halting an agent mid-workflow can leave state half-changed: a payment initiated but not recorded, a case opened but never assigned. “Stop” needs semantics. Does it mean halt all new actions, allow in-flight steps to complete safely, or roll back what has been done? The right answer differs by workflow, and no framework requires the deployer to define it before go-live.
Liability is the fifth. A single agentic deployment can involve a model provider, an agent-framework vendor, several tool vendors, an orchestration layer and the deploying firm. When a chained action causes harm, the allocation of responsibility across that chain is legally untested, and standard contracts rarely anticipate composition. FCA and PRA expectations on operational resilience and third-party risk offer a partial lens — treat each material tool as an outsourcing-style dependency — but they were not drafted with autonomous composition in mind.
Interim controls that work now
None of this is an argument for waiting. The gaps are nameable, and what can be named can be controlled — imperfectly, but demonstrably. These are the interim controls we specify when clients deploy agents inside a governed estate:
- Deny-by-default action spaces. An explicit allowlist of tools and scopes, with everything else refused. Irreversible actions — payments, external communications, record deletion — sit behind a human checkpoint regardless of how capable the agent is.
- Autonomy budgets. Hard caps on transaction value, step count, elapsed time and retries, with automatic escalation to a person when any budget is breached.
- Full-trace logging. Immutable capture of every tool call — inputs, outputs, timestamps — held separately from reasoning text, with a deliberate retention decision for each rather than a default.
- Defined stop semantics. A written, tested runbook per workflow stating whether “stop” means pause, safe-complete or roll back — exercised like a disaster-recovery drill, not filed like a policy.
- A mapped chain. Every model, framework and tool documented with its contractual owner before go-live, on the terms a regulated firm would apply to any material outsourcing.
These are interim controls in the honest sense of the word. They do not resolve the liability question, and they do not give reasoning traces settled evidential status. What they do is put the organisation in a defensible position: able to show a regulator what the agent could do, what it actually did, and what would have stopped it.
The Lab’s working positions
Our positions are deliberately provisional, but they are positions. First, govern the process, not the model: the unit of governance for agentic AI is the workflow and its action space, not the underlying model, and inventories — including the one built in a Sentinel engagement — should record it that way. Second, existing frameworks are necessary but not sufficient: the Article 14, ISO 42001 and NIST machinery should be extended, not abandoned, and firms should not wait for an agent-specific rulebook before acting. Third, oversight is an engineering artefact and should be tested adversarially: a kill-switch that has never been fired is a hypothesis, which is why our red-teaming work treats controls as targets. Fourth, agentic returns must be risk-adjusted: a deployment justified on headline automation savings, without pricing autonomy risk, is mispriced — the subject of the Lab’s ongoing risk-adjusted ROI research.
We revise these positions as the evidence changes, and we publish as the work matures — here and through our insights. Organisations facing these questions ahead of the rulebook do not need to face them alone: the Lab takes commissioned engagements to answer them against a specific estate, a specific workflow and a specific regulator.