Agentic AI Governance Gaps Hiding in Your Organisation

Eighty percent of organisations have already encountered risky behaviour from their AI agents. Here are the five governance gaps that made it possible — and how to close them before they become compliance failures.

Section 1 — The Hidden Risk

The Hidden Risk

Let's start with three statistics that should concern every risk professional in Australia and New Zealand:

“50% of AI use across ANZ organisations is unapproved or ungoverned. Half of all AI activity in your organisation may be happening outside your governance framework.”

—  ANZ Market Data 2026

·       59% of employees source their own agentic AI tools when approved options are unavailable or too restrictive. They're not waiting for IT to catch up.

·       80% of organisations have already encountered risky behaviour from AI agents — according to McKinsey's 2026 AI Trust Maturity Survey.

These aren't future risks. They're current operational realities. And they exist because most governance frameworks were designed for software that supported decisions. Now AI participates in making them.

After assessing organisations across New Zealand and Australia, I consistently find the same five governance gaps. They're present in almost every organisation I work with — regardless of size or industry.

Gap 1 of 5 — No AI Agent Inventory

Gap 1: No AI Agent Inventory

The problem: You cannot govern what you cannot see.

Most organisations have no complete register of which AI agents are deployed, what they're connected to, or what actions they're authorised to take. Agents proliferate across departments — marketing uses one for content, sales uses another for lead scoring, customer service deploys chatbots, finance automates reconciliation — and no single person has visibility across all of them.

Add shadow agents — the tools employees adopt without IT approval — and you have an estate of autonomous systems operating without oversight.

The Fix

Build and maintain a living “permissions inventory.” This is a document recording:

·       Which AI agents are approved for use

·       Which systems each agent can connect to

·       What actions each agent is authorised to take

·       Which team or individual owns each integration

If your organisation uses an AI governance platform, much of this can be tracked centrally. If not, even a well-maintained spreadsheet is better than invisibility.

“Governance must define scope, inventory, and ownership in auditable form. Without an inventory, the other two are impossible.”

—  McKinsey Trust Framework, 2026

Gap 2 of 5 — No Scope of Authority Defined

Gap 2: No Scope of Authority Defined

The problem: Without defined boundaries, agents operate in grey zones — taking actions that may be technically possible but weren't intentionally authorised.

The Thoughtworks Scope of Authority Framework, published in June 2026, borrows from corporate agency law to distinguish between:

·       Actual authority — what the agent is explicitly permitted to do (documented and technically enforced).

·       Apparent authority — what third parties reasonably believe the agent can do (based on how it presents itself).

Both must be governed. An agent that appears to customers as a full company representative creates apparent authority — even if it was never formally authorised to make commitments on your behalf.

The Fix

Every deployed agent needs three things:

1.       A designated principal — a specific, named human executive who is legally and operationally accountable for the agent's outcomes.

2.       Documented scope boundaries — what it can access, what actions it can take, and what it explicitly cannot do.

3.       Technical enforcement — platform-level guardrails that prevent the agent from exceeding its scope, not just policies that tell it not to.

Gap 3 of 5 — No Human Override Mechanism

Gap 3: No Human Override Mechanism

The problem: Agents take actions at machine speed across connected systems. When something goes wrong — an incorrect refund, an inappropriate communication, a data access violation — can you stop it before it cascades?

Most organisations deploy agents with the ability to act but without the infrastructure to intervene. If credentials are scattered across sessions and configurations, revoking access means tracking down every connection point. By then, the damage may be done.

The Fix

Consolidate agent credentials under a centralised authentication system. Each agent should operate under a defined identity with explicit, scoped permissions. Removing access should be a single action with a clear audit trail.

The Model Context Protocol (MCP) standard — now maintained by the Linux Foundation — provides structured, auditable channels for agent access through OAuth rather than embedded credentials. This means revoking an agent's access to a specific system is a single, instant operation.

“If an agent exceeds its defined thresholds — say, attempting a transaction above its authorised limit — the action is automatically paused and routed to a human supervisor before proceeding.”

—  Thoughtworks Scope of Authority Framework, 2026

Gap 4 of 5 — No Audit Trail for Decision Chains

Gap 4: No Audit Trail for Decision Chains

The problem: When your CMO asks “why did the agent send that email to 50,000 customers?” — can you trace the full decision chain?

In multi-agent systems, this becomes exponentially complex. A procurement agent might invoke a contract-review agent, which triggers a compliance-check agent, which escalates to a negotiation agent. Each handoff introduces potential for scope drift, conflicting objectives, or cascading errors.

Without structured audit trails, you cannot explain agent behaviour — to regulators, to the board, or to affected customers.

The Fix

Implement structured logging for every agent action:

·       Who — which agent (by identity).

·       What — the action taken and data accessed.

·       When — timestamp with millisecond precision.

·       Why — the triggering condition or instruction.

·       Result — the outcome of the action.

AWS CloudTrail, for example, logs every API call including the agent identity, the action taken, the time, and the source. Pipe these logs to a SIEM for real-time alerting on anomalous behaviour.

Gap 5 of 5 — No Incident Response Plan for Agent Failures

Gap 5: No Incident Response Plan for Agent Failures

The problem: Gartner predicts 40% of enterprises will demote or decommission AI agents by 2027. The root causes? Not technical capability — but “escalating costs, unclear business value, and inadequate risk controls.”

“40% of enterprises will demote or decommission AI agents by 2027 — not for technical failures, but for governance failures.”

—  Gartner 2026

When your AI agent makes a consequential error — sending incorrect information to a regulator, making an unauthorised financial commitment, or exposing customer data — what happens next? Most organisations have incident response plans for cyber attacks and data breaches. Almost none have equivalent plans for AI agent failures.

The Fix

Develop an AI-specific incident response playbook that includes:

·       Detection — how will you know an agent has malfunctioned? Automated alerts, anomaly detection, user reports.

·       Containment — immediate revocation of the agent's access and actions.

·       Assessment — trace the decision chain to understand what happened and what's affected.

·       Remediation — correct any downstream impacts (communications, transactions, data changes).

·       Communication — templates for internal reporting, customer notification, and regulatory disclosure.

·       Review — post-incident analysis and governance framework update.

Closing — Connecting the Gaps

Closing the Gaps

These five gaps are interconnected. Without an inventory (Gap 1), you can't define scope (Gap 2). Without defined scope, you can't build meaningful override mechanisms (Gap 3). Without override mechanisms and audit trails (Gaps 3–4), your incident response plan (Gap 5) has nothing to work with.

The good news: addressing these gaps doesn't require a 12-month programme. A structured assessment can identify your specific exposure in a single day, and a governance framework addressing all five can be operational within 8–12 weeks.

The organisations that close these gaps now — while governance remains voluntary in New Zealand and before mandatory standards arrive in Australia — will be positioned to lead rather than scramble when regulation hits.