Top 5 governance considerations for Agentic AI

AI Governance & Assurance
Risks & Liability

Agentic AI has captivated enterprises and computer science communities as the next frontier in artificial intelligence. The concept of AI Agents is not new, and has been used within academia and in targeted places in industry for decades[1]. However, what's truly new isn't the concept of agents performing tasks (like RPA), multi-step AI programs (such as DeepMind and AlphaGo), or route-based optimization tools (like Google Maps). The new idea in Agentic AI is the integration of an LLM as the central reasoning component.

LangChain defines Agentic AI as “a system that uses an LLM to decide the control flow of an application”[2].

Instead of performing strictly aggregate, predictive modeling or generating probabilistically based text or images based on a prompt (generative AI), Agentic AI is designed to act in the steps of[2]:

  1. Perceive: Gather data from multiple inputs
  2. Reason: Use an LLM as the reasoning engine. However, as Dr. Wolfram describes in his excellent article ‘What Is ChatGPT Doing … and Why Does It Work?’[6], LLMs are not reasoning, but predicting the next word that seems most probable.
  3. Act: Using API calls, execute on tasks
  4. Learn: If a feedback loop is present, ‘learn’, specifically over multi-step tasks.

IBM went as far as to say: “For organizations struggling to see the benefits of gen AI, agents might be the key to finding tangible business value. Monolithic LLMs are impressive but they have limited use cases in the realm of enterprise AI. It remains to be seen whether the vast sums of money currently being poured into a handful of huge LLMs will be recouped in real-world use cases, but Agentic AI represents a promising framework that brings LLMs into the real world, pointing the way to a more AI-powered future.”[3]

Anyone with experience in “traditional” agent-based modeling and dynamic programming of multi-step optimization functions might be skeptical of this assertion[3]. Let’s examine why in the context of governance implications below.

Agentic AI governance considerations

In LangChain’s State of AI Agents Report, the number one issue cited with the use of agents was that of performance quality[1]. Outside of performance considerations, which only increase in complexity with each additional step to solve, Agentic AI creates heightened concerns about the system behaving outside of its intended purposes. The key deployment considerations are enumerated below:

1. Increased difficulty responsibly building and validating

Traditional model development is focused on creating an abstraction of reality to describe or predict one narrow task. LLMs are focused on generating text based on a prompt to sound human. In both cases, the development process is more linear and straightforward than Agentic AI. Agentic AI at its core is a multi-step sequence of events (as in the not-so-distant work of IBM’s Deep Blue and Deep Mind’s AlphaGo). To properly construct (and subsequently validate and stress test an agentic AI system), defining the different states of the system and decision points, with possible outcomes, is essential for medium- and high-risk systems. Iterating through and validating the different stages to ensure the modeling system’s intended use is accomplished.

2. Increased complexity of monitoring

As described in #1, the multi-step nature of agentic AI causes an exponentially increasing surface area and acceptable bounds that need to be monitored. Monitoring is more in-depth than distributional analysis, and understanding the context is critical, ex. a ticket price distribution is shifted further than normal, however, this is due to a last-minute booking.

3. Increase developer and validator skill set requirements

To properly build and validate Agentic AI, the pre-request skill sets of those working on Agentic systems are more interdisciplinary and specialized than “traditional modeling”, even LLMs. Understanding the context for the goals of the system, the multi-step process, testing the model[s] at each step, as well as ensuring holistic performance is critical.

4. Embedded controls to gate decision-making

This is difficult when using an LLM as the ‘reasoning’ component, but is more tractable when using optimization. Building logic to ensure that an agentic AI system does not purchase a ticket for the incorrect dates, destination, exceed defined budget, etc.

5. Tailored agent-specific access

The premise behind agentic AI is that agents can act automatically and perform useful functions. As such, this implies that agents have access to not only read information from multiple sources but also to write. This raises access control considerations that are new to many AI-based systems. With algorithms making decisions autonomously, which we have previously identified will not be always 100% correct,  the burden on specific targeted access, as well as corresponding segregation of duties, logging, and review procedures increases.

Example: An Agentic AI Travel Agent - To LLM or not

In this example, let's consider a travel agent built as an AI agent. The guiding business need is that an agentic travel agent doesn’t get tired and can be infinitely auto-scaled horizontally to meet increasing customer demand.

Scenario

Customer X wants to book a trip to Barcelona Spain on the new Novel Inc Virtual Agent travel website. Customer X prefers to fly United Airlines and is a Hilton rewards member. They are sensitive to cost and travel dates of March 1st through March 10th of 2025. Given an LLM based 4 step process outlined above, let's review the possible states of the system:

  1. Ingest customer preferences, their credit card and personal information, access United Airlines flight schedule, and Hilton’s hotel network.
  2. Based on customer preferences, feed into an LLM to determine the optimal travel schedule.
  3. Based on the information determined in step 2, execute POST API calls to United Airlines and Hilton to purchase flights and hotels for the duration of the trip.
  4. Determine if the customer is satisfied with the bookings. If not, iterate through until the customer is.

The key issue we note, which could be alternatively solved with linear programming optimization techniques that are built for the optimization of constraints, is ensuring the accuracy of the city, times, budgetary constraints, and booking preferences. These components can be mathematically modeled and controlled with a ‘traditional’ programming user interface without requiring the high computational overhead of an LLM. When you introduce an LLM into the mix, the following ‘states’ need to be accurate, validated, and controlled to ensure the optimal customer experience:

  • Translation of the following data from the prompt:
    • Date Range
    • Airline preference
    • Hotel preference
    • Max budget
    • Reward codes
    • Etc
  • API search calls are properly executed with the above prompt information
  • ‘Reasoning’ to determine the optimal route given preferences and constraints
  • POST API call execution of reasoned optimal route

If translation and state recognition are off in any section, there are cascading error consequences of the action.

We share this example to help you understand the difference in the two paths for getting to the same result. Evaluate use cases carefully to ensure that using AI agents with LLMs embedded is worth the overhead of achieving a particular result [7].

Want to hear more examples and discussion about Agentic AI? Tune in to our repisode of The AI Fundamentalists, Agentic AI: Here we go again.

Solution considerations for AI agent governance

If you're planning to implement AI agents with LLM components, you need a strategic AI governance plan with specific capabilities and expertise. Here’s what to look for in a comprehensive solution to get you there:

  • Deep technical experience in complex systems
    • Look for solutions that work with both traditional multi-state systems and modern LLMs. This combined expertise is crucial for identifying potential risks and implementing appropriate controls in AI agent architectures.
  • Comprehensive controls framework
    • Your solution should be built from a proven governance framework that addresses the full AI lifecycle. The framework should incorporate best practices from data science, software engineering, and risk management.
    • Ensure that the solution has controls that are mapped to key standards such as NIST AI RMF, not to mention industry, regional, and state AI regulations that are critical to your business. Also make sure the controls have been validated by regulatory experts. This helps future-proof your AI agent deployment against evolving compliance requirements.
  • Purpose-built software solutions
    • Consider AI governance solutions with workflow management tools that can handle the complexity of AI agent development and deployment.
  • Automated validation capabilities
    • With AI agents performing multiple steps and making autonomous decisions, continuous validation is critical. Your partner should provide automated tools to monitor system behavior and verify performance against intended use cases.

Monitaur supports the insurance industry with these capabilities and expertise. We’re happy to assess your strategy and risks with governance and you pursue AI agents in your strategy.

Conclusion

In summary, it is our opinion that the current generation of Agentic AI is not ready for enterprise use, outside of very limited use cases, and poses a heavier load than other AI systems, including LLMs as well as ‘traditional’ agent-based and multi-step modeling paradigms. This is due to the unpredictability of the reasoned outcomes, and the number of potential states to control for.

However, we heartily support the concept of agentic AI and think that the re-emerging of mathematical optimization and ‘traditional’ modeling techniques, powered by modern computing power, could power the concept of multi-step AI systems to the next level of productivity and usefulness.

No matter where you stand on the legitimacy of the current generation of Agentic AI systems, Monitaur can assist in responsible governance to drive compliance with key standards and regulations.

References

  1. LangChain State of AI Agents Report.” Accessed January 12, 2025.
  2. LangChain Blog. “What Is an AI Agent?,” June 29, 2024.
  3. Agentic AI: 4 Reasons Why It’s the Next Big Thing in AI Research,” October 11, 2024.
  4. Pounds, Erik. “What Is Agentic AI?” NVIDIA Blog (blog), October 22, 2024.
  5. What Is ChatGPT Doing … and Why Does It Work?,” February 14, 2023.
  6. Holland, John H., and John H. Miller. “Artificial Adaptive Agents in Economic Theory.The American Economic Review81, no. 2 (1991): 365–70.
  7. "A clamor for generative AI (Even if something else works better)" Wall Street Journal, February 2025