Inventory first
You cannot govern what you cannot see. Maintain a central agent registry.
Risk and control pairs
For every risk, name the control: human approval, permission restriction, audit log, knowledge governance.
Human accountability
Sensitive decisions remain human. The agent prepares; the human approves.
Reporting cadence
Boards see a quarterly agentic operations report: agents, workflows, value, incidents, risks.
