Info-Tech Research Group Proposes New Governance Framework for AI Agents

The Arlington-based research firm warns that organizations are currently plagued by 'shadow AI' and runtime drift, where agents expand their scope and permissions without IT approval. As these systems autonomously trigger workflows and access sensitive enterprise data, the gap between rapid innovation and corporate compliance has widened significantly. Altaz Valani, a principal advisory director at Info-Tech, emphasizes that agents cannot be governed like human employees or legacy IT tools because they lack the capacity for moral incentives or emotional awareness.

To bridge this security gap, the firm’s latest blueprint, 'Govern Enterprise AI Agents While Preserving Innovation,' outlines a three-phase strategy for CIOs and CISOs. The process begins with establishing clear decision rights and guardrails, followed by a rigorous mapping of the agent lifecycle to identify risks. The final phase involves operationalizing oversight through executive dashboards and defined accountability models. By shifting from one-time approvals to continuous runtime monitoring, companies can mitigate risks related to unmanaged access and ambiguous ownership without stifling the productivity gains that agentic AI promises.