Everything hopeful in this cluster rests on this page. Agents are worth deploying because they act; they are worth governing for exactly the same reason. A chatbot’s worst output is a wrong paragraph a person can catch. An agent’s worst output is a completed action: the email sent to the wrong client, the record overwritten, the subscription bought a thousand times. None of this argues against agents, my own business runs on them; it argues for deploying them the way you would onboard a capable new employee: defined duties, limited keys, supervision, and probation.
Gartner’s widely reported prediction that over 40% of agentic AI projects will be cancelled by the end of 2027, on cost and unclear value, is best read as a control failure forecast: unbounded scope and unmeasured value are governance gaps before they are technology ones.
The six controls
- Bounded permissions. The agent gets the narrowest tool access that does its one job: read before write, draft before send, its own workflow and nothing adjacent. Capability and blast radius are both set here, which makes this the deployment decision that deserves the meeting.
- Approval gates at the points of consequence. Anything leaving the firm, changing a client record, or moving money passes a human until autonomy is earned for that specific step, on evidence. Drafts-for-approval is the correct starting posture for every new agent: it proposes, a person disposes.
- Complete action logs. Every step the agent took, when, with what input and result, inspectable after the fact. This is what turns an incident into a correction rather than a mystery, and it is what a regulator or auditor will ask to see. If it is not logged, it did not happen defensibly.
- Caps. On spend, on volume, on rate. Agents can fail by succeeding too much: a loop that sends, buys or calls repeatedly. Hard limits enforced outside the agent, so no confused reasoning can exceed them.
- A tested stop. One switch that halts the agent, known to more than one person, actually tried. The time to discover the off switch does not work is not during the incident.
- A named owner. One person accountable for what the agent does, its reviews and its evidence, mapped to your existing accountability regime. For regulated firms this lands inside SM&CR, and the wider governance cluster shows the full frame around it.
What regulators expect
Nothing agent-specific, which is the trap: the existing rules apply in full.
- The FCA holds firms to outcomes however produced; “the agent did it” is not a sentence its framework recognises.
- UK GDPR governs the client data agents touch, and restricts solely automated decisions with legal or similarly significant effects: a human must genuinely decide, not rubber-stamp.
- Record-keeping obligations extend naturally to agent actions: the log is your suitability evidence chain with a new author in it.
The practical reading: an agent deployment must be explainable to your regulator in the same sentence structure as a staffing decision. Who does it report to, what may it do alone, how do you know it is behaving, and what happened the last time it was wrong.
The failure modes to design against
Named plainly, because each has a control above as its antidote:
- Scope creep. The useful agent quietly granted more access than anyone decided; antidote: bounded permissions, widened only by recorded decision.
- Silent degradation. Behaviour drifting after a model or process change nobody re-tested; antidote: the owner’s review cadence and re-testing on change.
- Runaway loops. Caught by caps, or caught by invoices; antidote is choosing which.
- Accountability fog. Everyone assuming someone else reviews the logs; antidote: one named owner.
- Vendor opacity. Agentic products whose actions cannot be inspected at all; antidote: the four vendor questions in the FAQ, asked before purchase.
Where I fit in
The six controls are not my advice; they are my operating conditions. Every agent in my own estate runs under written bounds, logged actions, spend caps and human gates, checked by automated weekly security testing, and that machinery is what the Software Factory installs for clients as standing features rather than add-ons. If agents are already in your firm, sanctioned or otherwise, an Automation Audit will map them against these controls and tell you plainly where the gaps are.