AI Agent Governance: Five Pillars You Build, Not Write

What agent governance is actually governing

Jane, a support engineer, types one sentence into a support copilot: prepare a refund summary for ticket #4521. The copilot hands it to a planner agent, which calls a research agent (Zendesk ticket, linked Jira bug) and a billing agent (Stripe payment record). One human request, six machine-to-machine calls, most made by software that decided on its own to call more software.

That chain — user → application → agent → sub-agent → MCP tool — is the agentic call path, and it is what agent governance has to control. Every enterprise access model rests on three assumptions: a user sits at the front of the request, the thing making the call is that user, and the scope is what the user consented to. By the third hop all three are false, so three questions stop having answers:

• Who is this call for? The user authenticated three hops ago. Is their identity still on the request, or did a service account replace it?
• Who is making it? A bearer token proves possession of a credential, not which of your two hundred agents holds it.
• What may it do? A token minted for the first callee is over-privileged for every callee after it.

Answering all three at every hop, with evidence, is what agentic AI governance means — five systems, not a paragraph on responsible use.

The agent is a third kind of principal

Most teams reach for one of two shortcuts: let the agent forward the user’s token, or give it a shared service account. Both are wrong, because an agent is neither.

Giving each agent its own verifiable identity is the decision everything else hangs off. It buys attribution, because the receiver can tell which agent called; per-agent policy, because Jane’s copilot reading Jira and her engineering agent writing to it are different principals even though both act for Jane; and no anonymous agents, because a tool reachable only by a registered identity makes registration the enforcement point.

The urgency is unglamorous: machine identities already outnumber human users in most enterprises by more than 40 to 1, and agents multiply faster than service accounts ever did — anyone with a framework and an API key can make one.

The five pillars

Complete governance is five capabilities in a loop. The first two run before an agent makes a single call, the middle two on every call, the last continuously — feeding back into the second.

Five-pillar governance pipeline: discover and register before any call, authenticate and authorize on every call, audit continuously, with a feedback arrow back to registration

‍