Your AI governance program did its job. The model was risk-rated, tested for bias, and documented. Then a business unit deployed an agent that issues payouts and updates customer records, and a board member asks a simple question: how many agents are running right now, and who approved what they just did? The answer lives in a log that someone with database access could have edited, and the agent your team didn’t know about isn’t in it at all.
Model governance was built for systems that answer. Agents act, and that leaves a gap most programs haven’t closed: most organizations can see that an agent did something, and very few can stop it. This guide shows how to close that gap with a practical framework your CAIO, CISO, and risk teams can adopt. You’ll get a policy template you can adapt per agent, a way to match human oversight to the risk of each action, a map from EU AI Act, GDPR, NIST AI RMF, and ISO/IEC 42001 duties to agent controls, an audit evidence checklist, and a 90-day plan to get your first agent governed in production. Download it to see the full framework.