Most AI governance frameworks were designed around a model that made sense for predictive systems: assess before deployment, document the assessment, approve or refuse, monitor for drift. The decisive moment is the approval, and the artefacts are documents.
Agentic systems relocate the risk. An agent's behaviour is a sequence of tool invocations chosen at runtime in response to inputs that did not exist at approval time. The number of distinct sequences a non-trivial agent can execute is not enumerable in advance, which means no pre-deployment assessment, however thorough, can describe what the system will actually do.
What a runtime control actually is
The distinction that matters is between observation and enforcement. A dashboard showing what agents are doing is monitoring. A component sitting in the execution path that can refuse an action is a control. Organisations frequently believe they have the second and have built the first.
A functioning runtime layer typically provides four things: an enforcement point that every tool invocation passes through; a policy expressed in terms of the delegation rather than only the identity; a halt capability that can stop a specific agent, or all agents, without taking down the surrounding application; and a log that records the decision and its basis rather than only the outcome.
Human oversight and the rubber-stamp failure
Requiring human approval for consequential agent actions is a reasonable control that degrades predictably. If an approver receives a high volume of requests, each carrying little information beyond "the agent would like to do this", approval becomes reflexive within days. The control remains in place on the org chart and has stopped functioning.
The approval requests that work are the ones that carry what the approver needs to make an actual judgement: what the agent is trying to accomplish, why it selected this action, what it will do with the result, and what happens if the answer is no. That is more engineering work than adding a confirmation dialog, and it is the difference between a control and a formality.
Start with the inventory
None of this is implementable without knowing which agents exist, what each can reach, and who owns it. Most organisations that have deployed agents cannot produce that list, because agents arrive through many routes — a platform feature enabled by default, a team's internal tool, a vendor capability switched on during an upgrade — and few of those routes pass through a register.
The inventory is unglamorous and it is the prerequisite. A runtime control layer that governs the agents you know about, while the ones you do not know about run unconstrained, is a control layer in name.