Ninety-five percent of the data leaders in a Dataiku and Harris Poll survey said they could not fully trace an AI decision from input data through model output if a regulator asked.
That figure is uncomfortable when a model is producing recommendations for a person to review. It becomes something else entirely when the same model is given the authority to act without that review.
What actually changes when a model becomes an agent?
The human review step disappears, and with it the informal control that has been quietly absorbing data quality problems for years.
When a model recommends, a person decides, and that person applies context the model does not have. They notice the customer name looks wrong. They know that supplier was consolidated last quarter. They catch the duplicate before it becomes a duplicate purchase order.
When an agent acts, the data decides. There is no second reader, and every weakness in the foundation propagates directly into the world at machine speed.
Why is unresolved data the specific risk?
Because an agent has no way to know that five records describe one company.
Give an agent a task spanning the CRM, the ERP vendor master, and a procurement platform, and it will do what it was asked, competently, against three entities where one exists. The output is fluent, internally consistent, and wrong in a way that is difficult to spot afterwards precisely because nothing in it looks like an error.
An agent acting on unresolved, unscored data produces confident recommendations with unknown foundations. That is a fair description of most agent pilots, and it is why so many of them are never granted authority over anything consequential.
What does an agent need underneath it?
Four things, and none of them is a property of the agent.
Entities resolved once
So a task spanning four systems operates on one customer rather than four. Resolution has to be established beneath the agent and shared, rather than reconstructed by each agent for each task.
Confidence at the attribute
So the agent knows what it is standing on, value by value. This is the property that lets authority be scoped honestly: an agent can be permitted to act on well-corroborated attributes and required to escalate on thin ones, which is a far more useful boundary than permitting it to act on a whole domain or none of it.
Governance enforced per value
So access control is a property of the data rather than of the application the agent happens to be calling through. An agent operating under the same policy as the people is only possible when the policy attaches to the attribute.
A record of what it did
The recommendation, the evidence with its confidence, the expected outcome, the owner, and the horizon, captured at the moment of action rather than reconstructed for a review afterwards.
How do you extend an agent’s authority responsibly?
By treating it as an evidential question rather than a political one.
Start narrow, on a decision class where the window is short and the inputs are few, and record what the agent recommended alongside what happened. After a quarter, the conversation about widening its remit is grounded in a hit rate rather than in whoever is most confident in the meeting.
That approach also produces the artifact a regulator or an internal auditor will eventually ask for. Not a policy stating that agents are governed, but a log showing which values a given action rested on, how well supported each was on the day, and what the outcome turned out to be.
Does this slow the agent program down?
It front-loads the work, which is a different thing.
The alternative is not a faster program. It is a program that reaches a pilot quickly and then stalls indefinitely at the production decision, because nobody will sign off on giving authority to a system whose inputs cannot be defended. The Harris Poll study of 900 CEOs found 62% are under board pressure to show AI results faster than their teams can deliver, and the stall point is consistently the same: the demonstration ran on curated inputs and production has none.
Establishing resolution and scoring once, beneath every agent rather than inside each one, is what converts that stall into a sequence of small authority extensions each backed by evidence.
What agents are actually good for once the foundation holds
Work that is defensible because the record supports it, rather than work that is impressive because the output reads well.
An agent reconciling every purchase order against receipt and every receipt against invoice continuously, so a discrepancy is settled while it is still cheap to settle. An agent monitoring supplier financial health across a resolved supply base and flagging distress while there is time to qualify an alternative. An agent watching for compliance gaps that open between submissions rather than surfacing them when somebody comes looking.
None of those require a frontier model. All of them require a foundation that can say what each value is worth.
What sits underneath the agents
The PolyPhaze white paper Enabling Trusted Outcomes covers the governance surface, model placement, and how an agent workforce is served from the same foundation as people, applications, and partners. Download the full AI agent governance ebook for everything behind this.
Frequently asked questions
What is AI agent governance?
AI agent governance is the set of controls determining what an autonomous agent may act on, enforced at the data layer rather than the application layer. It covers which entities the agent operates against, which attribute confidence levels permit action without escalation, and what record each action leaves.
Why is an agent riskier than a recommendation engine?
Because a recommendation passes through a person who applies context the model lacks and catches obvious errors. An agent acting autonomously removes that step, so weaknesses in the underlying data propagate into the world without a second reader.
How do you decide what an agent is allowed to do?
Scope authority to attribute confidence rather than to whole domains. An agent can be permitted to act where values are well corroborated and required to escalate where they are thin, then have its remit widened based on a recorded hit rate rather than on assertion.