For Years, AI Has Been Making Recommendations. Today, It Is Beginning to Act
The emergence of agentic AI represents one of the most significant shifts in the evolution of artificial intelligence.
Traditional AI systems typically analyse, predict, classify or generate content. Humans remain responsible for deciding what to do with the output. Agentic AI changes that equation. These systems can increasingly reason, plan, make decisions, invoke tools, access data sources, interact with applications and execute multi-step tasks with limited human intervention.
This creates immense opportunities for productivity, efficiency and scale. It also introduces an entirely new governance challenge. The question is no longer simply what did the AI recommend? It is increasingly what did the AI do? And more importantly, can we explain, monitor and control its behaviour?
This is the fourth article in our series, following Data and Models: The Foundations of Safe AI.
The Shift from Intelligence to Autonomy
Most governance frameworks were developed for relatively predictable systems. Even machine learning governance practices evolved around models that performed specific, bounded tasks.
Agentic AI introduces something fundamentally different: autonomy. An AI agent can interpret objectives, create a plan, access multiple data sources, interact with external systems, make decisions and execute actions.
In essence, organisations are moving from governing systems that provide answers to governing systems that can independently pursue outcomes. This shift dramatically changes the risk profile.
Why Traditional Governance Is No Longer Enough
Traditional governance frameworks are often built around predefined rules, fixed workflows and predictable outcomes. Agentic systems are inherently more dynamic.
The challenge is not that they are malfunctioning. The challenge is that they may behave in ways that were never explicitly anticipated. For example, an AI agent tasked with improving customer service efficiency may:
- prioritise speed over quality
- access information it should not access
- generate unintended customer communications
- trigger actions that create downstream consequences
The agent may be operating exactly as designed while still producing undesirable outcomes. This is why governance must evolve from monitoring technical performance to understanding behavioural outcomes.
The Visibility Problem
One of the biggest risks associated with agentic AI is that organisations often have limited visibility into what autonomous systems are doing.
Many organisations can answer the usual questions: is the system running, is it available, is it performing? Far fewer can answer:
- Why did it make that decision?
- What information did it use?
- Which tools did it access?
- What actions did it take?
- Was the behaviour within defined tolerances?
- How is behaviour changing over time?
Without visibility, governance becomes reactive. Issues are discovered after they have already occurred. By then, trust may already have been damaged.
Observability: The Missing Layer of AI Governance
This is where observability becomes critical.
In traditional technology environments, observability helps organisations understand the health and performance of systems. In AI environments, observability must go much further. It provides continuous insight into decisions, actions, behaviour, context, outcomes and emerging risks.
Observability enables organisations to move beyond asking whether AI is functioning to understanding whether AI is operating within acceptable boundaries. Put simply: governance requires visibility, and visibility requires observability.
What AI Observability Should Monitor
As AI systems become more autonomous, organisations need the ability to monitor several dimensions simultaneously.
- Behavioural observability — understanding how AI systems are making decisions and executing tasks
- Operational observability — tracking system effectiveness and reliability
- Risk observability — identifying emerging governance and compliance concerns
- Human oversight observability — monitoring when and how human intervention occurs
The Importance of Guardrails
Observability alone is insufficient. Seeing undesirable behaviour is valuable, but only if organisations can respond effectively. Agentic AI therefore requires clearly defined guardrails. These may include approval thresholds, escalation mechanisms, access restrictions, action limits, segregation of duties and human review checkpoints.
The objective is not to eliminate autonomy. The objective is to ensure autonomy operates within clearly defined boundaries.
Just as organisations establish risk appetites for financial, operational and regulatory activities, they must define acceptable behavioural boundaries for autonomous AI systems.
The Executive Imperative
Boards and executives should begin asking new questions that were rarely relevant in previous generations of technology governance. For example:
- Which AI systems are operating autonomously?
- What actions are they permitted to perform?
- What controls exist around those actions?
- How are we monitoring behaviour?
- How quickly can we identify unintended outcomes?
- Who is accountable when an autonomous system exceeds its intended scope?
These are no longer technical questions. They are governance questions. And increasingly, they are boardroom questions.
Why Agentic AI Will Redefine Governance
Many organisations are currently focused on governing models. Over the next few years, the focus will increasingly shift toward governing behaviour. This is a significant evolution.
Success will not be determined solely by whether an AI model is accurate. Success will be determined by whether autonomous systems consistently operate within organisational, regulatory and ethical boundaries. That requires a new level of visibility, monitoring and control. It requires observability.
Closing Thought
The promise of agentic AI is extraordinary. Autonomous systems have the potential to transform productivity, accelerate innovation and redefine how organisations operate.
But autonomy without visibility creates risk. As AI moves from generating outputs to taking actions, observability becomes the cornerstone of effective governance.
The winners in the next wave of AI adoption will not simply be those that deploy autonomous systems the fastest. They will be those that can confidently answer a much more important question: what is our AI actually doing?
The next article in this series is Assurance and Accountability: Proving AI Behaves as Intended, where we examine how organisations move from visibility and monitoring to evidence, trust and regulatory-grade assurance.
About the authors
Albert VenterChief Executive Officer, NovoFinity
Albert Venter is a Data & AI Governance leader and Chief Executive Officer at NovoFinity, specialising in financial services and regulated industries. He helps organisations turn complex data, AI and regulatory challenges into practical, measurable business value. His expertise spans data and AI governance, strategy, BCBS239, automation, cloud transformation and process optimisation, with experience delivering major initiatives across Australia, Africa and Europe.