Tag: agentic AI governance
-
What is Agentic AI Judgment Tier? Signature, Not the Steps
Agents now run more than 90 percent of their work steps without a person stepping in. The agentic AI judgment tier is what stays with a human: intent, done, gates, risk, controls and escalation. It sits with whoever owns the outcome.
-
Agentic AI Payoff: Govern the Loop, Not the Spend
One of the largest asset managers in the world says AI has delivered zero financial payoff outside tech. The model was never the missing piece. The harness was. I lay out the six layers that turn token spend into a margin the CFO can see.
-
Internal AI Agents: Fix the Permissions First
Large companies are scaling internal AI agents first and the ones that work share one habit: they cleaned up permissions before the first connection, not after the first incident.
-
Agentic AI Insider Risk: It Is Governance, Stupid, Not the LLM
Satya Nadella just said to treat every AI model as an insider risk. I agree, and I map his seven principles to the controls I already use, with one contained and one catastrophic deployment.
-
Thinkers360 Top Voice: North America 2026
What is the Thinkers360 Top Voice award? The Thinkers360 Top Voice award is a yearly list of experts whose writing on the Thinkers360 platform had real impact. This year’s North America list names about 50 people, and I am one of them. The award covers work published from October 1, 2025, to September 30, 2026.…
-
Agentic AI Definition of Done: Done Is a Pass Rate
An agentic AI definition of done is a measured pass rate on real tasks, signed by one named person. Three anonymized cases show what happens with and without one.
-
Agentic AI RACI Matrix: Governance Owns the Autonomy
What is an agentic AI RACI matrix? An agentic AI RACI matrix is a one-page chart for an agentic AI project. It names who is Responsible, Accountable, Consulted and Informed for every activity in the lifecycle. The chart runs from the first intent statement to the decision to expand or roll back autonomy. It differs…
-
Agentic AI Memory: You Cannot Govern It. Yet.
What is agentic AI memory? Agentic AI memory is what an agent carries from one session into the next. Not the context window, because that empties when the session ends. It is the notes, files and stores the agent writes so the next run starts knowing what this one learned. Anthropic calls the pattern structured…
-
Agentic AI Architecture Map
Every post on agenticaiarch.com: by the six-layer architecture that decides outcomes, and by the Five-Stage Roadmap an agent program moves through. Click any post to open it: Six-Layer Agentic AI Architecture Pillar: What Is Agentic AI Architecture? Pillar & Foundations The map itself, the vocabulary, and the definitions everything else hangs on What Is Agentic…
-
Agentic AI Incident Record: Record It During, Not After
What is an agentic AI incident record? An agentic AI incident record is the account of one agent run that went wrong, written while the run is still going. It captures the failing step, the state at that moment, and the steps that led there. It also captures the decision to stop or resume.…
-
Agentic AI MCP Server Governance: Vet the Server, Not the Call
What is agentic AI MCP server governance? Agentic AI MCP server governance is the set of controls that decides which MCP servers an agent may connect to, who decides that, and what a user can change. It works at the server level, not the tool-call level. So the question moves from “was this call safe?”…
-
AI Agents Going Rogue? Nah, Bad Agentic AI Governance
What does AI agents going rogue mean? AI agents going rogue means agents chasing goals their operator never set, with access their operator never meant to grant. It is not a jailbreak, and it is not a bad answer. So it is a governance failure, and the harness is where it shows. The sandbox, the…
-
Agentic AI Egress Allowlist: Stop It Calling Out
What is an agentic AI egress allowlist? An agentic AI egress allowlist is a short list of outside hosts an agent may call. The network blocks every other host by default. So the list sits outside the agent, and no prompt can talk its way past it. You cannot stop an agent thinking. You can…
-
Agentic AI Governance Controls: 10 Questions, 10 Answers
What are agentic AI governance controls? Agentic AI governance controls are the checks built around an AI agent that decide what it may do. Some only guide the agent. Others can stop it. You cannot govern an agent with a policy document. You can govern it with controls around it. New here? I publish one…
-
Agentic AI Human-in-the-Loop Gate: Gate What Matters
What is an agentic AI human-in-the-loop gate? An agentic AI human-in-the-loop gate is a checkpoint in the harness. It pauses one class of agent action until a named person approves it. The gate sits on the action, not on the prompt. So it fires only when the agent tries to do something that matters. New…
-
Agentic AI Branch Protection: The Agent That Wrote It Cannot Approve It
What is agentic AI branch protection? Agentic AI branch protection is a rule on the repository that stops any pull request from merging until someone other than its author approves it. The agent that wrote the change cannot approve it. That rule lives in GitHub, not in the agent, so the agent cannot talk its…
-
Agentic AI Credential Scoping: One Key, Not Yours
What is Agentic AI credential scoping? Agentic AI credential scoping is the practice of giving an agent its own short-lived, narrow credential instead of the developer’s. The agent gets one key, cut to one job, that expires. It never gets yours. Yesterday’s post was about the rule the developer cannot edit. This one is about…
-
What Is an Agentic AI Managed Setting? A Rule the Developer Cannot Edit
Agentic AI managed settings are the permission rules an administrator sets above the developer. No project file, local file, or command-line flag can loosen them. That is the whole idea. The rest of this post is the how. Last week I wrote about the circuit breaker and prompt injection. Both of those assume the rules…
-
Keeping Agentic AI Systems Safe From Prompt Injection
Agentic AI prompt injection is what happens when an agent reads content that contains instructions and then follows them as if you had given them. The content can be a web page, an email, a PDF, a support ticket, or the result of a tool call. You asked the agent to do one job. Then…
-
What Is Agentic AI Context Caching? Stop Resending the Codebase
What Is Agentic AI Context Caching? Agentic AI context caching is the runtime control that lets an agent pay once to process a large, stable block of context. On every later turn, the agent reuses the provider’s stored computation at about a tenth of the price. The block is usually the system prompt, the tool…
-
Agentic AI Case Study: Uber’s Software Factory, Mapped to the Roadmap
Uber has published the most complete public account so far of what it costs to run agents across an entire software organization, and the number that matters is not the adoption number. Between February and mid-August 2026, weekly agentic requests at Uber grew 9.4 times and weekly active users grew seven times, while total AI…
-
Enterprise Agentic AI roadmap for 2027
An enterprise agentic AI roadmap for 2027 is a governance plan with an architecture inside it. For a Fortune 1000 company it is the year the weakest production agent climbs from Piloted to Governed, and the best one earns Assured, one exit gate at a time. This is the fall 2026 edition, the one about…
-
What Is Agentic AI Context Compaction? Decide What Goes
Agentic AI context compaction is the step in an agent’s runtime loop where the harness takes a conversation that is nearing the context window limit, has the model write a summary of it, and restarts the loop with that summary in place of the original history. Everything before the summary is gone from the model’s…
-
Agentic AI SDLC vs Traditional SDLC: What Changes
An agentic AI SDLC is a software development lifecycle in which AI agents, not developers, execute the work inside each phase, and humans move to setting intent, approving plans, reviewing outcomes and governing the loop. That one sentence is the whole difference from the lifecycle most enterprises still run. In a traditional SDLC a person…
-
What is Agentic AI Hook? Control an Agent Cannot Talk Its Way Past
Definition: An agentic AI hook is deterministic code that runs at a fixed point in an AI agent’s loop and returns one of three answers: allow the action, block it, or stop and ask a named human. It is the one control in the agentic SDLC that decides an outcome instead of influencing one. Everything…
-
The AI-Native SDLC Playbook, Staged on the Five-Stage Agentic AI Roadmap
What an AI-Native SDLC Roadmap Sequences An AI-native SDLC roadmap is the order in which an enterprise adopts the plays of an AI-native software development lifecycle — intent files, plan mode, hooks, agentic code review, continuous evals, self-closing maintenance loops — so that each play arrives only after the controls it depends on already exist.…
-
Agentic AI Governance: Managing the Harness Across the Five-Stage Roadmap
What Agentic AI Governance Actually Governs Agentic AI governance is the discipline of controlling what an AI agent is allowed to do, verifying what it actually did, and proving both to an auditor — and in 2026 the object of that governance is no longer the model. It is the harness. The industry has converged…
-
The Governance Gap in Agentic AI
Bill Gates published a roughly 6,000-word essay this week arguing that even under the best circumstances, the transition to the AI era will be one of the most turbulent periods in human history — and that there is no plan for the social, political, and economic upheaval it will cause. His framing is binary: AI…
-
How the CxO Shakeout Rewires IT Services Firms
The CxO power shakeout over agentic AI will force IT services and consulting companies to rebuild their sales, marketing, and delivery model around business executives — CFOs, COOs, CMOs — instead of the CIO and CTO organizations they have sold to for thirty years, and to staff those accounts with deep domain experts rather than…
-
Enterprise Agentic AI Vision 2030
Enterprise agentic AI is not arriving in a straight line. It’s a J-curve: a rough two years of pilots and cancellations, then a scramble to scale, then — if the forecasts hold — an operating model that looks nothing like the IT services industry of 2025. Most analysts, academics and IT services leaders agree on…
-
Agentic AI Sandbox Isolation: The Control Behind 2026’s AI Escapes
Sandbox isolation is the enforced separation between where an AI agent is allowed to experiment and where production data, other companies’ systems, and the open internet live. In July 2026, two frontier AI labs learned, in public, what happens when that separation is stated in a policy instead of built into the infrastructure. I have…
-
Agentic AI Performance Metrics: The 10 That Matter
Measuring an AI agent requires a second set of KPIs, separate from the business metrics you already track, because a domain KPI reports the joint output of the agent, the humans correcting it, and an environment that moved on its own — and cannot tell you which of the three did the work. The ten…
-
Agentic AI Just Undid 30 Years of IT Discipline
Vibe coding is having its moment. But last July during a Vibe coding event, an AI agent deleted a live production database during a declared code freeze, then told its user that rollback was impossible. It wasn’t. That is not a model failure. It is a missing dev/prod boundary, a missing approval gate and a…
-
Agentic AI Lesson: Governed Scales, Headcount-First Gets Rolled Back
Agentic AI is software that takes a goal, plans the steps, uses tools and takes action toward an outcome with limited human supervision — not a chatbot that only answers questions. I picked two 2025–2026 banking deployments from public reporting because they ran the same play in the same industry and landed in opposite places.…
-
Why Agentic AI Budgets Are Surging in 2026 — and the Fix
Agentic AI budgets are breaking in 2026, and not because the models are bad. They are breaking because enterprises are deploying agents without mapping token spend to projects and outcomes. Agentic AI cost attribution is the practice of tagging every token an agent consumes to a named project, workflow, and owner, so that spend can…
-
Agentic AI: Why cloud platform choice matters more than you think
Which cloud platform to choose for Agentic AI? This isn’t purely an AI question. It’s an infrastructure question — and both Amazon and Google have built managed services specifically designed to operationalize this loop. That matters a great deal for risk, compliance and governance teams who are trying to figure out how to let AI…