Agentic AI systems, architectures in which large language models execute multi-step tasks by selecting and invoking real-world tools across extended sessions, introduce a class of enterprise governance risk that single-request LLM deployments do not. A model API call produces a completion that a human reviews before acting on. An agent produces file deletions, sent emails, database writes, and external API calls that take effect before any human is aware. The governance infrastructure required for this class of system is absent from most enterprise AI deployments in 2026. This paper introduces the Enterprise AI Agent Governance Framework (EAGF), a five-component architectural layer governing the lifecycle of agent sessions. Four findings are central to this paper:
Abstract.Agentic AI systems, architectures in which large language models execute sequences of tool invocations across extended sessions without per-action human review, introduce enterprise governance requirements not addressed by existing LLM governance frameworks. The irreversible real-world consequences of agent actions, including file modifications, external communications, and database writes, create a governance risk class qualitatively distinct from the inference-level risks addressed by the Enterprise AI Control Plane (Jaggi and Rao, EACP-2026-001). This paper introduces the Enterprise AI Agent Governance Framework (EAGF), a five-component architectural layer governing agent session lifecycle, action authorization, audit logging, and human escalation. Three original contributions are presented. The Action Blast Radius is formally defined as the maximum irreversible consequence set reachable from a single agent invocation given its tool set and permission scope, providing a bounded, auditable governance parameter. The Agent Delegation Boundary is introduced as a three-dimensional control structure (principal, capability, context) extending the AI Access Policy Matrix to the multi-action agent case, not addressed by existing RBAC standards or the single-request policy model. The Reversibility Budget is defined as a session-level governance metric enabling automated policy enforcement across multi-action agent sessions without per-action human review. A four-tier maturity model for organizational self-assessment is presented alongside three reference deployment architectures, Contained, Extended, and Autonomous. The framework is evaluated against enterprise AI governance frameworks and applicable AI governance standards. An indicative 90-day implementation roadmap for the Contained architecture is provided.
Index Terms.enterprise AI governance, agentic AI, LLM agents, action blast radius, agent delegation boundary, reversibility budget, AI agent risk management, excessive agency, enterprise AI governance frameworks
The enterprise AI governance discipline has, to date, focused primarily on the risks of individual inference requests. A model receives a prompt, produces a completion, and a human or downstream system acts on the result. The governance controls for this model, including access policy, audit logging, cost attribution, and failure handling, are the subject of the companion paper EACP-2026-001 [9]. This paper addresses a structurally different problem.
Agentic AI systems, architectures grounded in the ReAct paradigm of Yao et al. [1] and extended by tool-using model architectures including those described by Schick et al. [2], execute tasks by selecting actions from a set of available tools and invoking them in sequence. Unlike a single inference call, an agent session may span dozens of tool invocations, produce irreversible real-world side effects at each step, and complete without any human reviewing the intermediate decisions. The agent's reasoning traces, which contain the decision logic that produced each action, are generated and discarded within the session unless explicitly logged.
LLM security guidanceidentifies Excessive Agency (LLM08) as a primary risk class for deployed LLM systems, characterizing it as the condition where an LLM-based system has been granted more capabilities, permissions, or autonomy than required to accomplish its task [4]. Excessive agency is not a model property; it is a governance property. It emerges from the absence of bounded delegation policies and action classification controls, not from model behavior. The EAGF addresses it structurally.
IBM's Cost of a Data Breach Report 2024 records a $4.88 million mean breach cost and a $1.88 million differential between organizations with and without AI and automation in security operations [7]. This differential reflects the observability and response speed advantages that a mature governance layer enables. For agentic systems, where a single compromised or misdirected agent session can execute dozens of consequential actions before detection, the governance differential is substantially wider.
This paper makes four primary contributions:
Yao et al. introduced the ReAct paradigm as an architecture for language model agents that interleave reasoning traces with action execution [1]. In the ReAct pattern, the model generates a reasoning step ("Thought"), selects an action ("Act"), observes the result ("Observe"), and iterates until the task is complete. Each action step can invoke a real-world tool. Schick et al. demonstrated that language models can learn to invoke APIs and external tools through in-context examples, extending the single-completion model to one in which the model operates as an autonomous orchestrator of external capabilities [2].
The ReAct and tool-use architectures create a governance gap with four characteristics not present in single-inference deployments. First, actions are irreversible. The agent can send an email, modify a file, or write a database record before any governance control is applied after the fact. Second, action sequences compound. A single misdirected agent session can chain many irreversible actions in rapid sequence before any human observes the outcome. Third, intent is opaque without logging. The reasoning trace that motivated each action is discarded unless explicitly captured, making post-hoc incident investigation impossible. Fourth, the attack surface extends. Prompt injection techniques can redirect an agent's action sequence by modifying tool outputs, a vector not present in single-request architectures.
The EAGF is architecturally analogous to the Enterprise AI Control Plane described in EACP-2026-001 [9], which drew its structural precedent from software-defined networking and cloud infrastructure control planes. Where the EACP interposes between the application layer and the model layer to govern individual inference requests, the EAGF interposes between the application layer that spawns agents and the tool execution layer where agents take real-world actions. The EACP governs what models receive; the EAGF governs what agents do. Both are necessary; neither is sufficient alone.
The Enterprise AI Agent Governance Framework is defined as the architectural layer positioned between the agent orchestration layer (which spawns and directs agent sessions) and the tool execution layer (where agent actions produce real-world effects). The EAGF evaluates each proposed agent action against organizational policy before execution, logs every reasoning step and action outcome to an immutable audit record, tracks session-level governance state, and escalates to human review when policy thresholds are reached.
The EAGF comprises five components. Fig. 1 presents the reference architecture. Table I presents the failure mode analysis for each component.
| Component | Primary Failure Mode (Absent) | Organizational Consequence |
|---|---|---|
| Action Classification Engine | All agent actions treated as equivalent regardless of reversibility or blast radius category | No automated differentiation between low-risk reversible actions and high-risk irreversible ones; governance decisions cannot be calibrated by action consequence; policy enforcement is binary (all or nothing) rather than risk-proportionate |
| Delegation Boundary Enforcer | Agents operate with implicit maximum permissions; no policy check at action invocation time | Excessive agency (published LLM security guidanceLLM08) [4] is structurally enabled; prompt injection attacks can direct agents to take actions outside the intended task scope; no audit trail of boundary violations; highest regulatory exposure of any EAGF component |
| Reversibility Budget Monitor | No session-level view of accumulated irreversibility; governance decisions are made action-by-action without session context | An agent session can accumulate many irreversible actions before any governance threshold is triggered; no automated escalation mechanism; human reviewers must monitor agent sessions manually to detect accumulating risk |
| Agent Audit Logger | Reasoning traces and action outcomes are not persisted; session state is lost at completion | Forensic investigation of agent behavior after an incident is impossible; regulatory compliance demonstration (applicable AI regulations |
| Human Escalation Orchestrator | No automated trigger for human review; agents complete sessions of arbitrary length and irreversibility autonomously | No structured mechanism to insert human judgment at policy-defined checkpoints; agents operating near or beyond their blast radius boundary continue without oversight; incident response depends on human observers noticing anomalous behavior rather than systematic detection |
© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. All rights reserved. Academic citation permitted with attribution; commercial use and derivative frameworks require written permission.