Agentic AI and the Oversight Lens

Each section moves in three tiers: a board line, a why it matters note, and a shaded detail block carrying the authority.

When AI acts, the program is the only live framework

This paper applies the Center's thesis to its hardest case: govern the system, not the technology. Agentic capability is exactly the technology that will not hold still, which is why oversight built around the technology fails and oversight built around the program endures.

This paper uses a deliberately operational definition of agentic AI and sources its claims about enterprise deployment to primary disclosures and named vendor documentation rather than press characterization.

What changes when AI acts

An agentic system, given an objective, takes sequences of actions with limited human review of the individual steps. Three things change when the institution's software stops recommending and starts doing: authority, attribution, and tempo.

Why it matters. Whether the underlying model is impressive is not the governance question. The governance question is what changes when the act occurs without a contemporaneous human decision, and each change maps to a program element that must be rebuilt for systems that act.

The program, stress-tested

The oversight program's elements are stable across technologies, and agentic AI is the strongest test of that claim. In each case the question survives and the answer changes.

2.1 Inventory: systems that multiply

Inventory at the level of durable governance objects: the agent's identity, its objective and scope of authority, the systems it can touch, the human accountable, and its kill conditions.

Why it matters. Agents are configured rather than installed, call tools and other models, and can initiate subordinate processes. An inventory that cannot answer what an agent could do at maximum permission has captured the software and missed the authority, which is what the board is accountable for. Agentic capability is also arriving primarily through vendors, so the Buyer-side inventory discipline applies with the dial turned up.

2.2 Accountability: a named human for every agent

Single-point accountability per agent: one named owner who holds the delegation instrument, sees the action logs, owns the limits, and carries the upward duty, whatever domains the agent crosses.

Why it matters. McDonald's put officers under personal oversight duties within their domains, and a single agentic workflow crosses several. Shared accountability for an agent is unaccountability with extra names. The delegation instrument is the accountability question's new artifact, and boards should expect to see it the way they expect a committee charter.

2.3 Escalation: triggers before deployment

Triggers must be defined at deployment: action thresholds, anomaly conditions, out-of-scope attempts, and the stop conditions under which the agent halts pending human review.

Why it matters. A trigger invented after the incident is evidence for the plaintiff, and with agents the incident will be in progress when discovered. Incident definitions need rewriting in the same pass, because the agent's characteristic failure is misdirected competence, performing correctly toward the wrong objective, which a taxonomy built for model error will classify as success.

2.4 The record: action logs as the evidentiary core

The agent's action log, what it did, under what authority, within what limits, with what monitoring and interventions, is simultaneously the operational telemetry, the examination artifact, and the litigation exhibit.

Why it matters. The Informed Decision Standard asks the institution to prove informed decisions were possible. For agents the proof has a new center of gravity. The oversight obligations are retention, integrity, ownership, and reviewability of the logs; the EU AI Act's deployer log-retention duties and the state documentation defenses point the same way. An institution whose agents act without durable logs has built the Boeing record in machine time.

The agent's action log is the new board minute. It is the record that proves, or disproves, that the institution governed what acted in its name.

The open lane, and who must fill it

The scoping decisions of 2026 leave exactly one framework governing what an institution must oversee when software acts on its behalf: the institution's own oversight program.

Why it matters. Banking institutions cannot answer the agent question by pointing to model risk compliance; the agencies declined to let them. The frontier statutes bind the Builders of the most capable models, not the deploying institution's delegation of authority. The technical safety literature addresses the how layer, indispensable and insufficient. What remains is the oversight layer, and that is the assignment, not a gap to lament.

The institutions that move fastest on agentic AI over the next two years will be the ones whose delegation instruments, escalation triggers, and log disciplines were decided in advance, because those are the institutions that can say yes to the next agent in days rather than quarters and defend the yes in any forum. The cyber-extension habit, stretching existing programs over agents, fails here for the same reason it fails for AI generally, and faster: the inherited program was built for systems that hold still and advise. Govern the system, not the technology, was written for exactly this moment.

The questions held; the program held

Agentic AI does not change the questions of oversight governance, and that stability is the most useful fact a board can hold as the technology accelerates.

What is governed: the inventory now includes authority, not just software. Who is accountable: a named human per agent, holding a written delegation. What escalates: triggers and stop conditions decided before deployment, on clocks the law already runs. What record exists: action logs kept with the discipline of board minutes, because that is what they now are. The institutions that answer those questions in advance will deploy agents faster than the institutions that do not, and will be the only ones able to prove, when the first agentic incident reaches a courtroom or an examiner, that an informed decision was possible. The program is the governance.