Before the twentieth agent: the questions every review will ask

The first AI agent in an organisation gets approved on enthusiasm. Someone built it, it does something useful, and the people who have to say yes know exactly who to ask if it misbehaves. The tenth is harder. By the twentieth, the review that used to take an afternoon takes a month, because nobody can say with confidence what is running, what it reaches and what has changed since it was last looked at.

Governance is not what slows agents down. Not having it is.

Four questions that come back every time

Whether the review is run by security, by an auditor or by a business owner who has to sign off a budget, it comes down to the same four questions.

• What exists? A list of agents, each with an owner, a purpose and the process it serves. If the list has to be assembled by asking around, it is already out of date.
• What can each one reach? The data it reads, the systems it writes to and the identity it runs under. “It uses the maker’s account” is an answer, but not a good one.
• Who said yes, and to what? The approval, the conditions attached to it and the version it applied to. An agent that has been changed twenty times since approval has, in practice, never been approved.
• What has changed? New connectors, new instructions, a wider audience. Change is normal; invisible change is the problem.

Answer them by design, not by investigation

The difference between organisations that scale their use of agents and those that stall is rarely the quality of their policies. It is whether the four answers exist as a by-product of how agents are built, or have to be reconstructed each time somebody asks.

By design means a few concrete things. Every agent is registered before it goes live, with an owner who is a person, not a team mailbox. Access is granted to the agent’s own identity, scoped to what the process needs, so that the question of reach has a factual answer. Approval is recorded against a version, and a material change starts a short review rather than a long one. And the whole picture is visible in one place, so a reviewer looks it up instead of sending an email.

None of this requires a large programme. It requires deciding the rules once, clearly, and making the easy path for makers the governed path.

What it buys you

Approvals become routine. Incidents become smaller, because the reach of each agent is known in advance. And leadership can answer the question it will be asked sooner or later, by a board, a regulator or a customer: what is your AI doing, and who is accountable for it?

That answer is worth having before the twentieth agent, not after.