The arrival of agentic AI is one of the most significant legal and compliance developments in recent memory.

AI adoption in the enterprise context recently meant building predictive models, deploying chatbots, and running recommendation engines. Those systems were, in legal terms, relatively tractable. They produced outputs that humans then acted upon. Accountability was a conceptually clear: a human made the decision, informed by an AI tool. What is now emerging is categorically different. AI agents can plan, reason, take actions, use tools, modify systems, communicate with external parties, and spin up other agents — all without a human touching the keyboard. It is not clear the legal and compliance architecture is ready for this one.

Two authoritative resources published in late 2025 and early 2026 help chart what may be the path forward. The first is Singapore’s Infocomm Media Development Authority (IMDA) draft Model AI Governance Framework for Agentic AI (Version 1.0, published January 22, 2026), a structured framework targeted at organizations looking to develop or deploy agentic AI responsibly. The second is a white paper from the World Economic Forum (WEF), published in November 2025 in collaboration with Capgemini, titled AI Agents in Action: Foundations for Evaluation and Governance. Together, these documents represent the current state of international organizational efforts to address how organizations should govern this new class of technology. This post draws on both resources to offer legal practitioners and business leaders a grounded, practical understanding of what agentic AI is, what risks it presents, who bears accountability when things go wrong, and what a sound AI governance program should include in their view.

What Is Agentic AI?

The term “agentic AI” is used widely but defined inconsistently. For legal and compliance purposes, a working definition is essential.

The IMDA framework describes agentic AI systems as systems “that can plan across multiple steps to achieve specified objectives, using AI agents.” While there is no settled global consensus on the precise definition of an AI agent, certain features appear consistently across the literature: agents possess some degree of independent planning capability, they take action-sequences rather than producing single outputs, and they interact with other systems or agents to complete tasks on behalf of humans. The WEF paper adds important technical texture, describing how modern AI agents are built on a layered architecture comprising application, orchestration, and reasoning layers — each playing a distinct role in how the agent receives instructions, coordinates tasks, and makes decisions.

At the core of most enterprise-facing AI agents today is a large language model (LLM) or multimodal model that functions as the agent’s “brain.” But what separates an agent from a conventional LLM-based application is the presence of additional components that enable autonomous, multi-step action. The IMDA framework identifies six core components: (1) the underlying model itself; (2) instructions that define the agent’s role, capabilities, and behavioral constraints; (3) memory, both short- and long-term, that allows the agent to retain and retrieve information across interactions; (4) planning and reasoning capabilities that allow the agent to break down complex goals into sequences of steps; (5) tools, which are integrations that allow the agent to interact with external systems — writing to databases, executing code, sending communications, or processing payments; and (6) protocols, such as the Model Context Protocol (MCP) developed by Anthropic, which provide standardized ways for agents to communicate with tools and with each other.

This architecture has significant legal implications. An agent’s “action space” — the range of actions it is permitted to take — is determined principally by the tools it can access. An agent with access to a sandboxed code execution environment presents a materially different risk profile than one with write access to a customer database, authority to send external emails, or the ability to execute financial transactions. Similarly, an agent’s “autonomy” — the degree to which it can self-direct toward a goal without human intervention — ranges across a wide spectrum. The IMDA framework identifies four levels of human involvement: agent proposes and human operates; agent and human collaborate with human approval at significant steps; agent operates with human approval only at critical junctures; and agent operates with humans merely observing after the fact. Where on this spectrum a given deployment sits is one of the most important determinations an organization can make, and it drives essentially every other governance decision that follows.

The further complexity introduced by multi-agent systems deserves particular attention. In an agentic deployment, it is increasingly common for multiple agents to work together — in sequential workflows where one agent’s output becomes the next agent’s input, in supervisor-and-subagent configurations, or in parallel “swarm” arrangements. Each of these patterns multiplies the number of decision points, data access events, and potential failure modes, while simultaneously diffusing accountability across a chain of automated actors. As the WEF paper observes, building agents requires “not just engineering but also orchestration and coordination between models, tools, data sources and humans.”

The Risks of Agentic AI

Agentic AI does not introduce wholly new categories of risk — it amplifies familiar risks and creates new pathways through which they manifest.

The foundational risks are inherited from the underlying LLM technology: hallucination (the generation of confident but incorrect information or decisions), bias (the systematic favoring of certain outcomes based on patterns in training data), data leakage, and adversarial prompt injection (the manipulation of model behavior through malicious inputs). But the IMDA framework makes a critical point that organizations often miss: while the risks themselves may be familiar, they “manifest differently through the different components” of an agentic system. A hallucination in a chatbot produces a wrong answer that a human can disregard. A hallucination in an agentic planning module can produce a wrong sequence of actions — tool calls that execute incorrectly, database writes that corrupt records, or downstream agent instructions that propagate errors through an entire multi-step workflow.

The IMDA framework identifies five categories of harmful outcomes that can result when agents malfunction or are compromised. Erroneous actions are incorrect actions taken by an agent — a medical scheduling agent that books appointments on wrong dates, or a coding agent that produces code with exploitable security vulnerabilities. Unauthorized actions are actions taken outside the agent’s permitted scope — acting without the human approval its operating procedures require, or accessing systems it was not sanctioned to touch. Biased or unfair actions reflect the discriminatory potential of agents operating in high-stakes domains, including procurement, hiring, and grant disbursement, where systematically skewed decisions can create legal liability under discrimination law. Data breaches can result from agents being exploited by attackers to exfiltrate sensitive information, or from an agent’s failure to recognize that certain data is confidential. And disruption to connected systems can occur when a compromised or malfunctioning agent overwhelms external systems with requests, deletes critical data, or propagates failures across interconnected platforms.

The WEF paper introduces an additional dimension of risk specific to multi-agent environments that practitioners are only beginning to grapple with. These include orchestration drift, where agents plugged into workflows without shared context produce brittle or unpredictable results; semantic misalignment, where two agents interpret the same instruction differently and generate conflicting or duplicated actions; security and trust gaps, where the absence of shared trust frameworks between agents creates vulnerabilities that malicious actors can exploit; and cascading failures, where errors in one tightly linked agent propagate across a network of dependent agents. Perhaps most sobering is the observation that agentic systems introduce a new class of failure modes linked to “potentially misaligned interactions in multi-agent systems” — failures that are not attributable to any single component but emerge from the complex dynamics of the system as a whole.

From a legal perspective, this last category is particularly significant. Traditional product liability, negligence, and contractual indemnification frameworks assume that harms have traceable causes attributable to identifiable actors. In multi-agent systems operating at machine speed across organizational boundaries, that traceability is not guaranteed, and in some failure scenarios it may be structurally impossible to achieve without purpose-built logging and governance infrastructure.

Who Is Responsible When an Agent Causes Harm?

The question of accountability for agentic AI is not merely philosophical — it will be litigated, and soon. Existing legal frameworks are already being stretched to address the novel dynamics of autonomous systems. It is therefore critical that businesses think carefully about how responsibility is allocated across the agentic AI value chain before deployment.

Both the IMDA framework and the WEF paper draw the same fundamental conclusion: the autonomy of AI agents does not reduce human accountability. Organizations that deploy agents and the humans who oversee them remain accountable for the agents’ behaviors and actions. But the practical challenge is that agentic AI involves multiple actors — model developers who build the underlying LLMs; agentic AI system providers who build the platforms and tools on which agents run; tooling providers who supply external integrations; deploying organizations who configure and launch agents within their own products and processes; and end users who interact with or are affected by those agents. Accountability is diffused across all of these parties, and the lines of responsibility are not always clear.

The IMDA framework distinguishes between responsibilities within the organization and responsibilities with external parties. Within an organization, the framework identifies at least four distinct classes of actors who bear governance responsibilities: key decision makers (board members, executives, department leaders) who set strategic policies and high-level goals for agent use; product teams who translate business requirements into technical implementations and manage the agent lifecycle from development through post-deployment monitoring; cybersecurity teams responsible for defining security guardrails, conducting threat modeling, and overseeing incident response; and end users who bear responsibility for appropriate use and timely reporting of issues. Critically, the framework recommends that all teams involved in the agentic AI lifecycle develop internal capabilities to understand agentic AI itself, recognizing that adaptive governance is impossible without substantive literacy about what is being governed.

With respect to external parties — model developers, platform providers, MCP server operators — the IMDA framework advises organizations to clarify the distribution of obligations in contractual terms and conditions, with specific attention to security arrangements, performance guarantees, and data protection commitments. Organizations should assess whether external products provide sufficient security features, including scoped API keys, per-agent identity tokens, and robust observability mechanisms such as logging of tool calls and access history. Where such features are absent, organizations must either pursue alternative or in-house solutions or narrow the scope of their agentic deployment to reduce exposure.

The WEF paper draws a useful distinction between “providers” — organizations that supply AI systems, platforms, or tools — and “adopters” — organizations within which AI systems are deployed. The provider is responsible for ensuring that products are developed and maintained in accordance with responsible and ethical guidelines, with appropriate documentation and support. The adopter is responsible for procurement due diligence and for deployment in accordance with documented requirements and risk assessments. This provider-adopter framework closely mirrors emerging regulatory patterns globally, where liability tends to flow in proportion to who had the most knowledge, most control, and most capacity to prevent harm.

A specific area of concern is what the IMDA framework calls agent identity management. As agents become more autonomous, they must be treated as accountable actors within an organization’s identity and access control infrastructure. Each agent should have a unique identity that allows it to be tracked and held accountable. Its permissions should not exceed those of the human user on whose behalf it acts. Delegations of authority should be recorded. Current authentication systems are not well-suited to this challenge — they are built for individual humans with static roles, not for dynamic agents that may act in multiple capacities, spin up sub-agents, or operate across recursive delegation chains. Until robust industry standards emerge, organizations should implement interim best practices including formal agent identification protocols and carefully scoped, dynamic authorization frameworks.

Guardrails and Governance Safeguards: Building a Responsible Agentic AI Program

With the foundational concepts established, we turn to the practical question that is at the heart of any compliance program: what must an organization actually do to govern agentic AI responsibly? Drawing on the IMDA framework’s four-pillar structure and the WEF paper’s progressive governance model, the following represents a comprehensive overview of the safeguards and processes a sound AI governance program should include.

Pillar One: Assess and Bound Risks Before Deployment

The first and arguably most important governance discipline is prospective risk assessment — conducted before an agent is built or deployed, not after. The IMDA framework is emphatic that organizations should “limit the scope of impact of their agents by designing appropriate boundaries at the planning stage.” This means treating every proposed agentic use case as a risk exercise from the outset.

Risk assessment for agentic AI is a function of both likelihood and impact. On the impact side, key factors include the domain in which the agent operates (with low tolerance for error in healthcare, financial services, and legal contexts), the sensitivity of the data the agent can access, whether the agent can reach external systems and third-party APIs, the scope of the agent’s actions (read-only vs. write access), and whether the agent’s actions are easily reversible. On the likelihood side, key factors include the agent’s level of autonomy and the degree to which it is constrained by structured procedures, the complexity of the tasks it is asked to perform, and the nature of its exposure to external or untrusted data sources (which creates vulnerability to adversarial prompt injection and other cyberattacks).

The WEF paper introduces a structured five-step risk assessment life cycle for AI agents: define context (establish scope, boundaries, stakeholders, and risk criteria); identify risks (brainstorm and catalogue potential technical, organizational, and ecosystem failure modes); analyze risks (assess probability and impact, drawing on classification data and evaluation evidence); evaluate risks (compare against risk criteria and tolerability thresholds); and manage risks (implement preventive, detective, and responsive controls, and integrate feedback loops for continuous monitoring). This life cycle should be treated as iterative and ongoing, not a one-time pre-deployment exercise.

Critically, once the risk assessment is complete, organizations should make explicit design choices to bound identified risks. The IMDA framework identifies three principal levers: agent limits (restricting the tools and data an agent can access to the minimum necessary for its function; constraining autonomy by requiring the agent to follow defined standard operating procedures; and designing mechanisms to take the agent offline or limit its footprint when it malfunctions); agent identity (ensuring each agent has a distinct identity with clearly documented scope and permissions, and that delegations of authority do not exceed what the authorizing human user is themselves authorized to do); and residual risk evaluation (acknowledging that even after mitigation, residual risk remains, and making an explicit organizational determination about whether that residual risk is tolerable).

Pillar Two: Make Humans Meaningfully Accountable

A recurring theme across both documents is the danger of nominal human oversight — systems in which humans are technically “in the loop” but in practice lack the information, the training, or the cognitive bandwidth to actually catch agent errors before they cause harm. Automation bias, the well-documented tendency of humans to over-trust automated systems that have historically performed reliably, makes this worse. As agents become more capable and reliable in routine situations, the human tendency to disengage from oversight increases — precisely when that oversight remains essential for detecting rare but high-consequence failures.

Designing for meaningful human oversight requires organizational specificity about which agent actions require human approval, what form that approval should take, and how the system will be audited for effectiveness. The IMDA framework identifies four categories of agent actions that should trigger mandatory human approval: high-stakes decisions in sensitive domains such as healthcare or legal proceedings; irreversible actions such as permanently deleting data, sending external communications, or making financial payments; outlier or atypical behavior such as accessing systems outside the agent’s normal operational scope; and user-defined thresholds that reflect individual risk tolerance beyond organizational minimums.

How approval requests are presented matters as much as whether they are required. The IMDA framework makes a nuanced point that is easy to overlook: approval prompts should be “contextual and digestible,” presenting the agent’s proposed action in plain terms rather than dumping raw logs that a human reviewer cannot meaningfully assess in real time. For routine decisions, a simple approve/reject interface may suffice. For complex decisions involving the review of a multi-step plan, it may be more productive to allow the human to edit the plan before giving the agent authorization to proceed.

Beyond individual approval points, the WEF paper emphasizes that human oversight must be designed as a system, not a moment. This means training personnel to identify common agent failure modes (inconsistent reasoning, policy non-compliance, anomalous tool calls), regularly auditing whether human approval mechanisms remain effective, and complementing human oversight with automated real-time monitoring that can escalate unexpected or anomalous behavior before it causes harm. Accountability structures should be documented, assigned, and regularly reviewed — not left as implicit assumptions about who is responsible for watching the machine.

Pillar Three: Implement Technical Controls Across the Agent Lifecycle

Technical governance is not a substitute for organizational governance, but it is an essential complement. Both frameworks recommend a lifecycle approach: controls during design and development, testing before deployment, and continuous monitoring after deployment.

During design and development, organizations should implement technical controls specifically tailored to the new components that differentiate agents from conventional software. For the planning and reasoning component, this includes prompting the agent to reflect on whether its proposed plan adheres to user instructions before executing, prompting it to summarize its understanding and request clarification at ambiguous junctures, and logging the agent’s plans and reasoning so that human reviewers can verify them. For tool integrations, it means configuring tools to require strict input formats, applying the principle of least privilege (giving each agent access only to the tools and data strictly necessary for its function), and refusing write access to sensitive databases unless absolutely required. For communication protocols — including MCP servers — organizations should whitelist trusted servers and sandbox code execution environments.

Pre-deployment testing for agentic systems is more demanding than testing for conventional software, and organizations need to adapt their approaches accordingly. The IMDA framework highlights several dimensions of agentic testing that go beyond standard software quality assurance: overall task execution accuracy, policy compliance (whether the agent follows defined procedures and escalation routes), tool call accuracy (whether the agent calls the right tools with the right inputs in the right order), and robustness testing against real-world errors and edge cases. Testing should evaluate not just individual agents but entire agent workflows — including the agent’s reasoning and tool-calling behavior across multiple steps — and it should extend to multi-agent scenarios to capture emergent behaviors that arise when agents interact. Because agent behavior is inherently stochastic and context-dependent, tests should be run repeatedly and across varied datasets to detect low-probability but high-impact failure patterns.

After deployment, the recommendation from both frameworks is a graduated rollout accompanied by continuous monitoring. The autonomy of agents and the dynamism of the environments in which they operate mean that many risks cannot be fully anticipated before deployment. Beginning with trusted, experienced users; limiting initial tool and protocol access to the most secure, well-understood integrations; and confining early deployment to lower-risk internal systems allows organizations to observe agent behavior in production before expanding the agent’s reach. Post-deployment monitoring should be configured to detect anomalous behavior in real time — with alerts triggered by threshold breaches (such as repeated failed tool calls or attempted access to unauthorized systems), anomaly detection techniques that identify unusual agent trajectories, and in some cases agent-based monitoring where dedicated supervisory agents flag inconsistencies in peer agent behavior. The IMDA framework recommends that monitoring severity responses be proportionate to risk: lower-priority alerts flagged for review at scheduled intervals, higher-priority alerts triggering immediate intervention, and catastrophic failures triggering agent termination with fallback to human-managed processes.

Pillar Four: Enable and Educate End Users

The final pillar of a sound agentic AI governance program addresses end users — the employees, customers, and other stakeholders who interact with or are affected by AI agents. Both frameworks emphasize that trustworthy agentic deployment cannot rest on technical controls and organizational structures alone; it requires that the humans who use and rely on agents do so with adequate knowledge of what those agents can and cannot do.

The IMDA framework distinguishes between two primary archetypes of end users. External-facing users — such as customers interacting with a customer service or sales agent — need transparency above all: clear disclosure that they are interacting with an agent, accurate information about the agent’s authorized scope of action, clarity about how their data is collected and used, and explicit escalation pathways to human accountable parties when the agent malfunctions or its decisions are disputed. These transparency obligations are not merely best practices; in many jurisdictions they intersect with existing consumer protection requirements, privacy law disclosure obligations, and emerging AI-specific transparency mandates.

Internal users — employees who integrate agents into their workflows, such as coding assistants, HR automation tools, or enterprise productivity agents — need not just transparency but substantive education and training. They must understand relevant use cases and the scenarios in which agent use should be restricted (for example, not using an agent to handle confidential client data if the system does not provide adequate protection). They need training in how to instruct agents effectively, including awareness of how phrasing affects agent behavior. They require education about common failure modes — hallucinations, reasoning loops, policy non-compliance — so that they can recognize and report problems. And perhaps most importantly, organizations need to address the longer-term workforce development concern that both frameworks raise: as agents take over entry-level and repetitive tasks that have historically served as the training ground for junior employees, organizations risk eroding the foundational skills and domain knowledge that make human oversight meaningful. Governance programs should identify core competencies that must be preserved and actively maintained through targeted training and structured professional development.

Looking Ahead: The Multi-Agent Horizon

Both the IMDA framework and the WEF paper are clear-eyed about the fact that we are at an early and rapidly evolving stage of agentic AI adoption. The single-agent use cases that represent today’s most common enterprise deployments are already giving way to multi-agent ecosystems in which networks of agents interact, negotiate, delegate, and transact across organizational and technical boundaries.

The WEF paper identifies several emerging patterns in this space: agent-to-agent commerce, in which agents autonomously initiate transactions and exchange data with other agents; internet-of-agents architectures in which large-scale networks of agents create new questions of interoperability, governance, and societal impact; and trust frameworks for inter-agent collaboration, in which credentialing systems and behavioral standards are needed to verify agent identity, capabilities, and reliability across organizational boundaries. New protocols — including Google’s Agent-to-Agent Protocol (A2A) released in April 2025 and the Agent Payments Protocol (AP2) released in September 2025 — reflect the speed at which the underlying technical infrastructure for these ecosystems is developing.

For legal practitioners and compliance professionals, the governance implication is straightforward even if the implementation is complex: governance frameworks must be built to scale. The WEF paper’s “progressive governance” model is instructive here. Rather than prescribing a single set of controls for all agents, it recommends calibrating oversight to an agent’s classification profile — its function, autonomy, authority, predictability, and operational environment. As agents move from narrow, low-risk applications to complex, high-impact environments, governance must evolve in proportion. Access controls must tighten; monitoring must deepen; accountability structures must formalize; and human oversight mechanisms must become more sophisticated. The goal is not to freeze governance at the level appropriate for today’s most conservative deployment, but to build organizational and technical infrastructure capable of evolving as the technology itself evolves.

Practical Guidance: Starting Points for Compliance Teams

For organizations that have yet to build out a formal agentic AI governance program, the breadth of the foregoing may feel overwhelming. A few practical starting points:

Begin with an inventory. Before you can govern agentic AI, you need to know where it exists or is planned within your organization. Conduct a systematic review of current and proposed AI deployments to identify which, if any, meet the threshold of agentic capability — that is, which involve multi-step autonomous action rather than single-output generation. This inventory should capture each agent’s tool access, data access, level of autonomy, and deployment context.

Map your accountability structure. Use the frameworks described above to assign clear governance responsibility across your internal stakeholders — who sets policy, who builds, who secures, who monitors, and who trains end users. Memorialize these assignments in your AI governance policy documentation, and ensure they are reflected in relevant internal contracts, job descriptions, and performance expectations.

Review your vendor contracts. If you are deploying third-party agentic AI systems, your existing vendor contracts were almost certainly not drafted with the specific risks of agentic deployment in mind. Review them for provisions addressing security obligations, data handling, audit rights, incident notification, and liability allocation. Update or supplement them as necessary.

Establish pre-deployment review processes. No agentic AI deployment should go live without a documented risk assessment that addresses at minimum: the agent’s action space, its level of autonomy, the sensitivity of the data it can access, its exposure to external systems, its reversibility characteristics, and the human oversight mechanisms that will be in place. This review should be conducted by a cross-functional team including legal, compliance, cybersecurity, and business leadership.

Build for audit. Log everything the agent does, and ensure those logs are in a format that can support both real-time monitoring and after-the-fact forensic review. The IMDA framework’s emphasis on traceability is not a technical nicety — it is the foundation of any defensible accountability structure in the event of litigation or regulatory inquiry.

Conclusion

Agentic AI represents a genuine inflection point in the relationship between technology and accountability. For the first time, organizations are deploying systems that not only advise human decision-makers but actively make decisions, take actions, and modify the world on their behalf — often at machine speed and scale. The legal and governance frameworks that served us well in the era of assistive AI are not adequate for the era of agentic AI. Building the structures to govern this new technology responsibly is not optional, and it is not primarily a technical problem. It is a legal, organizational, and human challenge that demands the full attention of counsel, compliance officers, and business leaders alike.

The IMDA’s Model AI Governance Framework for Agentic AI and the World Economic Forum’s AI Agents in Action white paper offer the most comprehensive and actionable guidance currently available for organizations undertaking this challenge. They share a consistent and important message: agentic AI can be deployed safely and beneficially, but only by organizations that approach it with deliberate governance from the outset — assessing and bounding risks before deployment, maintaining meaningful human accountability throughout, implementing technical controls across the full agent lifecycle, and equipping end users with the knowledge they need to exercise effective oversight. Organizations that take these steps will be positioned not only to manage the risks of agentic AI but to capture its genuinely transformative potential. Those that do not are building liability without safeguards in one of the most dynamic and consequential technology environments in a generation.