AI agent governance is the set of rules and controls that decide what an AI agent may read, what it may do on its own, what needs a person's approval, and what record it leaves. It includes accountability and controls for internal as well as external actions.
Why agents need their own governance
Wrong answers can cause harm when people rely on them. Agents can also send emails, update records or book meetings, creating internal or external effects before anyone reviews them.
Agents also run on schedules and on triggers, when nobody is watching, and they act on behalf of someone. Both facts change what governance has to cover: whose authority the agent is using, and what happens when nobody is there to stop it.
The controls that matter
Frameworks use different words for the same handful of controls. For agents they come down to six.
- Accountability: assign an owner and define the authority for each agent, whether delegated by a person or granted to a scoped service identity.
- Least privilege: restrict the agent's identity, tools and sources to what the task needs.
- Approval gates: require human review for consequential actions based on risk, including sensitive internal updates and external sends.
- A record: log consequential approvals and actions in a tamper-evident record for review.
- Revocation and expiry: access can be withdrawn, and access is checked again at the moment an action is sent, not only when the run began.
- Honest outcomes: an action that was held, failed or had an unclear result is recorded that way, not filed as done.
The risks agent governance addresses
- Data leakage: an agent with broad access surfaces a record to someone who should not see it, or includes it in something sent outside.
- Prompt injection: instructions hidden in an email, a web page or a document try to make the agent do something its owner never asked for.
- Over-permissioned connections: an overly broad connected account may grant an agent more access than it needs.
- Duplicate or runaway actions: a retried step sends the same message twice, or a schedule keeps acting after the reason for it ended.
- Silent failure: an action fails or is only partly applied and the work is reported as complete.
- Lost accountability: nobody can say afterwards who allowed an action, or on what information.
Human review and tamper-evident records help oversight but do not reliably prevent prompt injection or catch every harmful action. Layer least privilege, separation of untrusted content from instructions, tool restrictions, risk-based approval, monitoring and incident response. Test controls and review internal actions too.
Frameworks worth knowing
Several public frameworks cover AI governance, and each says something useful about agents. None of them needs to be adopted whole by a startup or growing company.
- The NIST AI Risk Management Framework: a voluntary framework organised around govern, map, measure and manage.
- ISO/IEC 42001: a certifiable management system standard for organisations that develop or use AI.
- The EU AI Act: European regulation that sets obligations by risk level, including transparency and human oversight for some uses.
- The OWASP Top 10 for large language model applications: a practical list of security risks, including prompt injection and excessive agency.
For a startup or growing company the practical version is shorter, and the guide to AI governance for startups and growing companies turns it into a one-page policy.
A starter policy for AI agents
These are starting points, not a complete security programme; tailor controls to the risks and test them.
- Owner: one named person is accountable for the company's AI agents.
- Access: use least privilege for delegated users or scoped service identities, and restrict tools and data to the task.
- Approval: require review for consequential external and internal actions according to risk.
- Record: log consequential approvals and actions in a tamper-evident record and review it regularly.
- Review: each agent's access and schedule is reviewed each quarter, and unused agents are switched off.
About Hoppflow
Where Hoppflow fits
Hoppflow provides the following scoped controls alongside a company's own policies and security measures. Its agents and automations work from the same governed company brain as the people who use it.
- Delegated boundaries: an agent's draft to a customer, supplier or connected tool is held for a person's approval, and Hoppflow checks access again before a supported external action is sent.
- Permissioned retrieval: roles define who can see, run and approve supported parts of a workspace, and supported company-brain retrieval paths apply each person's access rules.
- Traceability: approvals and external agent actions are kept in a tamper-evident authorization record.
- Honest outcomes: Hoppflow records a held, failed, or unclear external effect as such instead of filing the work as done.
- Revocation: disconnecting a supported integration revokes Hoppflow's ongoing access to that account.
Routine work runs through Automations. The full set of controls is on Security and trust, and access is through the waitlist. Hoppflow does not claim certification against any framework named in this guide.
Questions people ask
What is AI agent governance?
AI agent governance is the set of rules and controls that decide what an AI agent may read, what it may do on its own, what needs a person's approval and what record it leaves. It assigns accountability and controls for both internal and external effects.
How do you govern AI agents?
Assign an owner, restrict the delegated user or service identity to the task, apply risk-based approval to internal and external actions, log and monitor outcomes, and regularly review access. Layer controls and test their limits.
What is human in the loop for AI agents?
Human in the loop means a person reviews and approves an agent's action before it takes effect. Review is useful for consequential actions, whether an external message or a sensitive internal change. It is not foolproof.
What are the biggest risks of AI agents?
Data leakage through broad access, prompt injection from untrusted content, over-permissioned tool connections, duplicate or runaway actions, failures reported as success, and actions nobody can later account for. Approval and records support oversight but cannot reliably prevent or catch all of these risks. Combine least privilege, isolation of untrusted content, tool restrictions, monitoring and response, and test the controls.