Governed automation by workload
Agent governance is not one control set applied everywhere. It is derived from the irreversible actions a specific workload contains. These pages set out what each agent may do, how it fails, and the controls that hold.
Get an Agent Trust Gap BriefGovernance follows the action, not the model
The useful question is never "how capable is this agent". It is "what can this agent cause to happen that cannot be undone". Every control below derives from that list, and workloads differ mainly in which irreversible actions they contain.
| Workload | What the agent does | Dominant failure mode |
|---|---|---|
| Healthcare | Scheduling, eligibility, prior auth, patient messaging | Scope drift into clinical advice; PHI over-access |
| Revenue | Outbound sending, CRM writes, pipeline updates | Domain reputation damage; silent CRM corruption |
| Procurement | Tender monitoring, drafting, pricing, submission | Fabricated figures; missed deadlines; unattributable bids |
The four questions that size the controls
- What are the irreversible actions? Sends, payments, dispatches, submissions, writes others depend on. Most teams have never written this list down, and everything else follows from it.
- What is the blast radius of the worst case? One wrong message, or ten thousand. One record, or the dataset finance reports from.
- Who is accountable when it goes wrong? If the answer is "the model", there is no control. Accountability has to resolve to a person before deployment, not during an incident.
- What would you need to produce afterwards? Design the receipt for the hardest question you might be asked, then build controls that generate it as a by-product.
Common questions
What determines how much governance an agent needs?
The reversibility and blast radius of its actions, not its model or its autonomy level. An agent that only reads needs very little. An agent that can send, pay, dispatch or submit needs approval gates, caps and receipts.
Do all agents need human approval?
No. Requiring approval everywhere destroys the value of automation and trains people to approve reflexively. Approval belongs specifically on irreversible actions.
What is the single most useful control?
Idempotency on every effect. It is unglamorous and it prevents the most common real-world incident: retries producing duplicate sends, duplicate charges and duplicate dispatches.
How do you know a boundary is actually enforced?
Count the refusals. A boundary that has never blocked anything is either untested or not enforced. Refusal receipts turn a claim into evidence.
Where should an organisation start?
Write down the irreversible actions. Most teams have never enumerated them, and that list determines every control that follows.