Only 13% of organizations think they have the right AI agent governance in place, Gartner reported in April 2026. AI governance for agentic AI is six controls built into where agents run: identity, permissions, approvals, audit, data ownership and model choice.
Only 13% of organizations think they have the right AI agent governance in place, Gartner reported in April 2026. AI governance for agentic AI is a system of controls built into where the agents run: who the agent is, what it may touch, what waits for a person, what gets logged, who owns the data and which model does which job. A chat window over someone else's agent cannot supply those.
Governance here means the controls that decide what an AI agent can do, prove what it did and let a person stop it. A policy document describes those controls. A governance system enforces them on every action, whether or not anyone is watching. We have run AI agents in production at Kief Studio for a year and a half on our own system, LTFI, and the difference between the two has been the single most important design question.
The question matters now because the market is filling with lookalikes. After a year of agent demos, a new wave of products adds a chat interface or a thin layer on top of a free open-source agent framework and calls it governed. Some of those frameworks are excellent building blocks. The governance, though, has to live in the system the agent acts through, and that is what this piece is about.
AI governance for agentic AI is the set of controls, built into the system the agents run in, that covers six things: identity, permissions, approvals, audit, data ownership and model choice. Each one answers a question a business owner, an auditor or a client will eventually ask.
| Part | The question it answers | What it looks like when it is real |
|---|---|---|
| Identity | Who is the agent acting as? | Each agent and each person has its own identity; no shared logins |
| Permissions | What may it touch? | Access scoped per seat and per agent, changed only by a person |
| Approvals | What waits for a yes? | Sending, posting, spending and scheduling stop at a gate |
| Audit | Who asked, who did it, who approved it? | A log written by the system, not by the agent describing itself |
| Data ownership | Whose data is it, and can it leave with you? | Your records on your own server, exported if you go |
| Model choice | Which model does which job? | Models chosen per task and swappable without rebuilding |
None of this is new thinking. The NIST AI Risk Management Framework's GOVERN function says "accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks". Gartner's six steps for managing agent sprawl include defining agent identity, permissions and life cycle. What agents change is the speed. A person makes a few dozen decisions an hour. An agent can make hundreds, so the controls have to run on every action instead of in a quarterly review.
A wrapper cannot govern what it does not control. If the agent, its credentials and its tools run somewhere else, a chat window or thin layer on top sees the request and the reply, but not every action the agent took in between.
A wrapper, in the sense I mean, is a product whose core is someone else's agent or someone else's chat window, with a new interface and a policy page added. It can be useful. It can also look governed in a demo, because the demo shows the conversation. Governance lives in what happens after the conversation: which records were read, which system was written to, which credential was used and whether a person said yes.
The breach data points the same way. IBM's 2026 Cost of a Data Breach study found that more than 20% of organizations reported a breach targeting AI models or applications, and the most common causes were weaknesses in the systems around the model: compromised APIs, applications or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%). The model was rarely the weak point. The plumbing around it was.
Security researchers name the same pattern. The OWASP GenAI Security Project's Top 10 for Agentic Applications, released in December 2025 with input from over 100 security researchers and practitioners, highlights agent behavior hijacking, tool misuse and exploitation, and identity and privilege abuse. Every one of those happens at the level of what the agent can reach and act on. A layer that only sees the chat cannot stop them.
This is not a case against open source. Free open-source agent frameworks are a normal and healthy part of how software gets built. The point is narrower: AI governance for agentic AI has to be designed into the whole system, from identity to audit, and a thin layer added afterward inherits whatever the underlying agent was allowed to do.
Every agent should act under its own identity with only the access its job needs, and every person's seat should be scoped the same way. If an agent borrows a person's login, nobody can tell afterward who did what.
Identity comes first because everything else depends on it. An approval means nothing if you cannot tell which agent asked for it, and a log means nothing if every action is recorded under one shared account. The definition is laid out in what a non-human identity is for an AI agent: its own login, a named owner, a list of what it may touch and a way to revoke it.
Permissions follow from identity. In our October webinar, Brian Gagne walked through a company's settings live: this person may use outreach, projects and files, but may not change company policies or add people. His example stuck with the audience: does your social media person need your financials? Probably not. A contractor who needs the files can get them without access to the AI system at all. Scoping each seat this way is ordinary least privilege, applied to people and agents alike.
For a Massachusetts business, none of this is optional in spirit. If you hold residents' personal information, your written information security program under 201 CMR 17.00 already has to say who can reach that data, and an agent that can read it is one more party on that list. We cover the state rules that apply to agents in Massachusetts AI regulations for business.
Anything that leaves the company or cannot be undone should wait for a person's approval, and the system, not the agent, should record who asked, which agent did the work and who approved it. Approvals without a record are a habit; with a record, they are governance.
Our default lines have held for a year and a half. Briefs, summaries, research, drafts and record keeping go ahead. Sending email, posting and publishing, messages to clients, spending and scheduling wait for a person's yes. Rules and permissions, who approves what, passwords and keys, deleting and money are person-only. Each company sets its own lines. The important design choice is the last column: an agent can never change who approves what, and only a person can confirm a rule.
Many organizations are leaning on controls they assume are already there. KPMG's September 2026 survey of large companies found that the share of organizations building controls into their agents alongside monitoring and evaluation procedures fell to 30% from 43% two quarters ago, as many are relying on guardrails already in place. In the same survey, 73% of leaders said they felt confident in their governance. Confidence and controls moved in opposite directions.
Policies on paper are spreading faster than enforcement. Stanford's 2026 AI Index reported that the share of businesses with no responsible AI policies in place fell sharply from 24% to 11%, and AI-specific governance roles grew 17% in 2025. That is real progress. A policy only governs an agent, though, when the system the agent works in checks it on every action. Watching the whole run, not just each click, is the subject of checking the sequence rather than each click.
Written rules belong in the governance system because that is the only place every agent reads them every time. A rule kept in a document or a single person's prompt is followed when someone remembers it.
Brian's example in the webinar was a press release: the company decides every release must include certain facts, writes that down once, and from then on every AI teammate that drafts a release or a newsletter includes them. The same applies to brand voice, claims a company never makes and anything a client contract requires. Brian opened the session on exactly this point: a brand takes years of care to build, and output that ignores it does damage quickly.
Rules also make checking possible. When the rules are written down in one place, one AI teammate's work can go to another to check it against those rules before it counts as done. In our system, those checks can run on a different model from the one that wrote the draft, which catches mistakes a single model tends to repeat. A person still reads anything that leaves.
There is a subtle governance point here. A rule set by a person and a note an agent saved for itself are different things, and the system should treat them differently. In LTFI, only a person confirms a rule. Lessons the AI teammates pick up along the way are kept separately, where people can review them, so a learned note never quietly becomes policy.
The business should own its data outright and be able to take it when it leaves, and it should choose which model does which job rather than inheriting one vendor's model. Both are governance questions, because both decide who holds power over the system later.
Data ownership is the part buyers most often skip. The NIST AI RMF's GOVERN 1.7 calls for "processes and procedures are in place for decommissioning and phasing out AI systems safely". For a small or mid-size business, that means a plain answer to a plain question: if we stop, what do we get back, in what format and how fast? The contract language that decides it is covered in vendor contract exit terms.
Model choice is the newer question. Models improve and change every few months, and each is good at different things. A governed system lets the business assign a model per job, such as a fast one for quick checks and a stronger one for research or planning, and swap a model without rebuilding the workflow. It also lets a company with sensitive work run its own local model. That is the logic behind owning the workflow and renting the model, and it is why AI governance for agentic AI should never depend on a single AI provider.
LTFI handles AI governance for agentic AI by building every control into one system: identity, scoped permissions, approval lines, a full log, written rules, data ownership and model choice, on a dedicated server Kief Studio runs for each company. Nothing is bolted on top of someone else's agent.
LTFI is an agentic business operating system: the CRM, projects, content, sites, security and AI staff in one place. It was meticulously built from scratch by Kief Studio as one whole system, and it has been in live production for a year and a half. Here is how each part of governance shows up in it:
Kief Studio runs it for each company as the team that built it, from Central Massachusetts, with clients from Worcester outward. What a year and a half of running it taught us is in agentic AI in production: what we learned, and the questions to put to any provider, including us, are in questions to ask an agentic AI provider.
If you want to see the controls working, there is a walkthrough at ltfi.ai, and the October 23 session is on the webinar replay page. Wherever your business is, we can set LTFI up remotely, as we have for clients around the world for more than 13 years; in Worcester, Shrewsbury and the nearby towns, we can also do it in person.
It includes six parts built into the system the agents run in: identity, permissions, approvals, an audit log, data ownership and model choice. Together they decide what an agent may do, prove what it did and let a person stop it.
A policy is necessary but not enough. A written policy says what should happen; agents act hundreds of times a day, so the system they work in has to enforce the policy on every action and record that it did.
A chatbot answers; an agent acts. Governing an agent means controlling which records it can read, which systems it can change, which credentials it uses and what waits for a person, not only what it says in a reply.
Yes, if the governance comes built into the system rather than added later. The controls that matter most, scoped permissions, approval lines and a log, are design choices, and a small business benefits from them as much as a large one.
You should get it back in a usable format, on a timeline written into the contract, and the provider should delete its copy. Ask for this before signing, because exit terms are hardest to negotiate after the data is already in.
62% of large organizations were building, deploying or developing AI agents in September 2026, KPMG found. After a year and a half of agentic AI in production on LTFI, our lessons are about approval lines, logs, written rules, cost, drift and people.
The cost to hire an AI consultant starts above a wage: the Bureau of Labor Statistics put the median management analyst at $48.97 an hour in May 2025. How hourly, project, retainer and fractional models compare, what moves the price, and seven questions to ask first.
Custom website cost for a small business depends on the path: DIY builder, freelancer, agency or managed. The Bureau of Labor Statistics puts the May 2025 median Worcester web developer wage at $38.86 an hour. Dated ranges per path and what moves a quote.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
