Governance and Accountability

If you punch someone in the face, you cannot tell the police "That was not me, it was my hand." An agent is the organisation's hand. When it makes a decision or takes an action, the organisation made that decision and took that action, and someone in it is accountable for the outcome. Governance is the set of decisions that make this workable: who may deploy an agent, what it may access, what it may do without asking, what it must log, how its behaviour is reviewed, and what happens when it goes wrong. These are policy questions with technical enforcement.

Good governance is specific. "Agents must be safe" governs nothing. "This agent may read tickets, may draft replies, may not send them without approval, and every run is retained for ninety days" governs a great deal. Write the specific version, then build the system so that the policy is enforced rather than hoped for.