The PDF nobody enforces

Think of an AI agent that runs accounts payable for a distributor, and does it well, until a supplier changes the bank account on an invoice. The agent updates the record, queues the payment and a person approves it. Every rule in the policy was followed. The control that would have stopped it was never in the process.

According to a 2025 survey by Pacific AI and Gradient Flow, three out of four organizations have an AI policy, fewer than half monitor their systems in production and only one in six has a way to report an incident.

It makes no difference whether it is a bank with an entire risk department or a mid-sized company where risk is handled by the person who does purchasing. Everyone has the document. Few can answer what the AI did yesterday, how it decided and who authorized it.

An agent executes the process you give it, faithfully and fast. If a control is missing, it does not notice the hole: it repeats it at full speed. The only governance that counts is the control inside the workflow, at the moment the agent acts.

A policy speaks to people

A policy says what your people can and cannot do with AI tools. People write it and review it, and it is enforced when someone notices.

Governance works another way. It is the check that fires at the moment of the action, the record that shows the action happened as it should, and the ability to prove it later to someone with no reason to believe you: the finance manager, an auditor, a regulator.

While AI only suggested, the person reading the draft was the control. With agents that person left the chain: the agent reads, applies the rule, posts the entry and updates the record. If you moved the work into software and did not move the control, you are left with activity you find out about later.

Go back to the distributor. The assignment was to read the invoice, match it to the purchase order and, within tolerance, leave it for payment. When the invoice with different bank details arrives, the agent sees a field it was taught to extract and updates the record, because nobody scoped its credentials. The person approves the payment because the policy requires approval above a certain amount, and checks what was asked: amount and purchase order.

Nobody approved the account change. It was not a payment, so it never went through approval. The log says "payment approved". It does not say "supplier record modified, source: page 2 of a PDF, authorized by: nobody". Only someone who sits down to read line by line what the agent did will catch it.

A person doing it by hand would probably have let it through too: comparing the bank details with the record was in nobody's process. The policy was followed in full. The control that mattered did not exist.

A quarterly committee against something that acts all day

Traditional governance assumes a risk that stays still and can be sampled. An agent is probabilistic, changes when the data changes and acts thousands of times before the next review. A single odd input triggers an action no sample would have seen.

Reviewing an agent once a quarter tells you what you wanted to happen. It does not tell you what happened.

What governance looks like inside the operation

The controls live where the agent works, and they follow the same decisions made for any person who joins:

• What it can touch. Credentials scoped to what its role requires, nothing more.

• What it is forbidden to do. The same agent never initiates and approves the same transaction. It is the segregation of duties you would demand of any person.

• Who reviews. High-risk writes go through approval before they become final. When it is not sure, the case goes to a person instead of a guess.

• What gets recorded. Every action goes into the record.

• Who watches it. Someone measures whether its behavior is drifting.

None of that fits in a policy. It is built into how the agent runs.

The automatic control beats the human one it replaced

The fix for the distributor is a rule in the workflow: the agent can read the bank details on an invoice, but it cannot write them to the supplier record. Ever. If they do not match what is on file, the invoice stops and a person reviews the change.

Or a second digital collaborator that only watches: it cannot post anything, and every time a bank detail moves it reports what changed, where it came from and who touched it.

The resulting control is far stronger than the human one. With three hundred invoices a week and the field on page two, nobody was comparing each account with the record. The human control existed on paper and in practice was a spot check. The software checks all three hundred and records it.

Agents are the risk only if they are installed with the controls kept in a document.

Nobody asks for the controls they need

In discovery nobody would have mentioned the bank account field. It had never failed, and people describe the process they run, not the one that could fail. They tell you the happy path accurately, but not the fifteen places where the process depends on someone noticing something.

If you build exactly what the client specifies, you automate the holes along with the work. The list of what goes wrong does not come in a requirements document: it comes from having done this enough times to fear the right things.

With a caveat that applies to us too: a control the client did not ask for still belongs to the client. Every rule is shown, explained, and the client accepts or rejects it. Applying our own judgment silently inside someone else's systems would be the same failure, with the vendor's name on it.

The record is designed on day one

When a regulator asks what happened in March, the record of every action either exists or does not, and no quarterly review rebuilds it. That is why governance cannot come after the pilot: adding controls to an architecture that is already set costs several times more. We would rather have that conversation in the first week, even if we get called overcautious.

A board-level matter

In Chile, Law 21.719 on personal data protection takes effect on December 1, 2026. It creates an agency that can open investigations on its own and fine up to 20,000 UTM for the most serious violations, three times that for repeat offenders. If your AI touches customer or employee data, "we have a policy" will not be a defense.

The commercial cost arrives before the regulatory one. Gartner projects that more than 40% of agentic AI projects will be cancelled before the end of 2027, with weak risk controls among the main causes. They are cancelled because the organization could not govern what it had already set in motion.

The question

For any AI system acting in your company today: can you say what it did, why, and who or what authorized it. For every action, not a sample.

If the answer is no, you have ungoverned software making decisions in your company's name, and that does not wait for next quarter. The next step is not another policy. It is to look honestly at whether anything is really holding it.

Sources

• Pacific AI and Gradient Flow, 2025 AI Governance Survey.

• Law 21.719 on personal data protection, Chile: published December 13, 2024, in force from December 1, 2026.

• Gartner, forecast on agentic AI projects (2025).