AI Governance Institute
← News
Research2026-09-09

Weaver and Assury Map Four Agentic AI Governance Gaps Compliance Programs Are Missing

What happened

Weaver and Assury published How Agentic AI Is Changing AI Governance Requirements, a practitioner-oriented framework identifying control gaps that emerge when AI systems move from discrete, single-query interactions to extended, multi-step agentic sessions. The paper argues that conventional governance frameworks, designed around individual model outputs, cannot account for risks that accumulate across an agent session, where a sequence of individually permissible actions can combine into an outcome no single approval gate would have sanctioned. The authors identify four specific gaps: organizations are not tracking how authorization context shifts as an agent acquires information mid-session; autonomy levels are changing dynamically without triggering re-authorization or human review; and audit evidence is being captured after actions execute rather than before, eliminating the possibility of a meaningful pre-action approval record. The framework draws direct lines to enterprise control categories including least-privilege enforcement, human approval gates, logging architecture, and third-party assurance, and situates the analysis against a backdrop of agent governance becoming binding across multiple regulatory domains.

Why it matters

  • ·Cumulative session risk is not addressed by most existing AI governance frameworks, meaning approval gates and audit trails calibrated to single-query outputs will not catch harm that emerges from a sequence of individually sanctioned agent steps, creating a direct compliance exposure as agentic deployments scale.
  • ·Dynamic autonomy expansion during a session, where an agent effectively elevates its own permissions as it gathers context, mirrors the OAuth scope drift and credential escalation patterns documented in recent agentic attack research, and may constitute a control failure under frameworks requiring least-privilege enforcement and documented authorization changes.
  • ·The absence of pre-action audit evidence fundamentally undermines the auditability requirements that regulators and frameworks such as the NIST Artificial Intelligence Risk Management Framework Playbook expect, shifting forensic burden onto organizations that assumed vendor-side logging would be sufficient.

Governance controls affected

AGT-005Human Approval Gate for Irreversible Agent ActionsAGT-006Agent Action Audit TrailAGT-015Agent OAuth Scope Drift DetectionAGT-017Agentic Autonomy Expansion CriteriaALC-002High-Risk AI Audit Trail

What to do now

  • ☐Audit existing agent approval workflows to determine whether they evaluate cumulative session risk or only individual action requests, and document the gap for remediation planning.
  • ☐Map all deployed agentic systems to identify where autonomy levels can change mid-session without triggering a re-authorization event or human review, and implement controls to flag such changes.
  • ☐Review your audit logging architecture to confirm that pre-action records are captured for consequential agent decisions, not only post-execution logs, and update log retention policies accordingly.
  • ☐Assess whether least-privilege controls applied at agent session initiation remain enforced throughout the session as the agent acquires additional context or data access.
  • ☐Incorporate the four gap categories identified by Weaver and Assury into your next agentic AI governance maturity review and update your risk register to reflect any unaddressed exposures.

What to watch next

Regulatory guidance on agentic AI is converging on precisely the control categories this framework identifies. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services and emerging domestic frameworks are likely to set binding expectations around pre-action authorization and audit evidence within the next 12 months, meaning organizations that treat these as aspirational today face a compliance gap tomorrow. Teams should also monitor whether NIST's ongoing work on agentic standards, noted as incomplete in NIST's Agent Standards Gap Leaves Enterprises Without Enforceable Agentic AI Controls, produces enforceable language on session-level risk tracking and dynamic autonomy controls before year-end.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-09

Jamf: AI Agent Governance Must Extend to Credentials, Identities, and Network Paths

Jamf published a practitioner guide arguing that enterprise AI agent governance cannot stop at model approval and must extend to the authorization controls, credential management, network paths, and logging infrastructure surrounding deployed agents. The guide identifies deterministic authorization, human approval gates for high-impact actions, and least-privilege access as foundational controls for agentic workflows. It is directed at enterprise security and compliance teams deploying agents inside organizational perimeters.

Enforcement2026-09-04

SSH MCP Command Classification Flaw Breaks Human Approval Gate Assumptions

A critical advisory has identified a flaw in an SSH MCP server implementation where a command could be classified as safe while the remote shell executed a different, more privileged command. The vulnerability breaks read-only workflow assumptions that enterprise approval gates depend on. Compliance teams are advised to treat command classification, server provenance, and approval workflows as controls requiring independent validation.

Corporate Policy2026-08-27

Meta's Agent Deployment Drove a 40% Incident Spike Before Plans Were Scrapped

Internal disclosures from Meta's canceled Project OT reveal that AI agents deployed to replace workers made large-scale, disruptive autonomous actions that contributed to a 40% rise in major technical and security incidents and up to a 70% increase in employee time spent resolving them. The program had targeted headcount reductions of up to 60% in some teams before being scrapped after an initial layoff wave. The case provides the most detailed quantified account of enterprise agentic AI failure yet reported by a named organization.