Govern the action, not only the model
Agent governance must cover what an agent can access, which actions it may take, the evidence it must produce and the person accountable for approval.
Scope and permissions
Role-based access, bounded tools, data controls and task-specific authority.
Approval gates
Human review for material architecture, business and production decisions.
Evaluation
Quality, completeness, relevance and outcome checks before work advances.
Traceability
Reviewable inputs, outputs, decisions, approvals and validation evidence.
A practical control pattern
Start with low-risk, reversible workflows. Define success and escalation criteria. Capture evidence by default. Expand autonomy only when observed performance and operational controls justify it.