The enterprise AI governance discipline has, to date, focused primarily on the risks of individual inference requests: a model receives a prompt, produces a completion, and a human or downstream system acts on the result. The governance controls for this model, including access policy, audit logging, cost attribution, and failure handling, are the subject of the companion paper EACP-2026-001 [9]. This paper addresses a structurally different problem.

Agentic AI systems, architectures grounded in the ReAct paradigm of Yao et al. [1] and extended by tool-using model architectures including those described by Schick et al. [2], execute tasks by selecting actions from a set of available tools and invoking them in sequence. Unlike a single inference call, an agent session may span dozens of tool invocations, produce irreversible real-world side effects at each step, and complete without any human reviewing the intermediate decisions. The agent's reasoning traces, which contain the decision logic that produced each action, are generated and discarded within the session unless explicitly logged.

OWASP's Top 10 for LLM Applications identifies Excessive Agency (LLM08) as a primary risk class for deployed LLM systems, characterizing it as the condition where an LLM-based system has been granted more capabilities, permissions, or autonomy than required to accomplish its task [4]. Excessive agency is not a model property; it is a governance property. It emerges from the absence of bounded delegation policies and action classification controls, not from model behavior. The EAGF addresses it structurally.

IBM's Cost of a Data Breach Report 2024 records a $4.88 million mean breach cost and a $1.88 million differential between organizations with and without AI and automation in security operations [7]. This differential reflects the observability and response speed advantages that a mature governance layer enables. For agentic systems, where a single compromised or misdirected agent session can execute dozens of consequential actions before detection, the governance differential is substantially wider.

This paper makes four primary contributions:

• The Enterprise AI Agent Governance Framework (EAGF) is introduced as a named, bounded architectural concept positioned between the application layer that spawns agents and the tool execution layer where agent actions take real-world effect.
• The Action Blast Radius is formally defined as the maximum irreversible consequence set reachable from a single agent invocation, providing a bounded governance parameter enabling least-privilege agent design and organizational risk assessment.
• The Agent Delegation Boundary is introduced as a named three-dimensional control structure (principal, capability, context) extending the AI Access Policy Matrix [9] to the multi-action agent case. A complete Delegation Boundary specification is a necessary prerequisite for least-privilege agent governance not achievable through single-request policy models alone.
• The Reversibility Budget is defined as a session-level governance metric providing a continuous, automatable measure of accumulated irreversibility within an agent session. A minimum reversibility budget policy enables automated human escalation without requiring per-action review, resolving the latency-governance tension in operational agent deployments.

Yao et al. introduced the ReAct paradigm as an architecture for language model agents that interleave reasoning traces with action execution [1]. In the ReAct pattern, the model generates a reasoning step ("Thought"), selects an action ("Act"), observes the result ("Observe"), and iterates until the task is complete. Each action step can invoke a real-world tool. Schick et al. demonstrated that language models can learn to invoke APIs and external tools through in-context examples, extending the single-completion model to one in which the model operates as an autonomous orchestrator of external capabilities [2].

The ReAct and tool-use architectures create a governance gap with four characteristics not present in single-inference deployments. First, actions are irreversible: the agent can send an email, modify a file, or write a database record before any governance control is applied after the fact. Second, action sequences compound: a single misdirected agent session can chain many irreversible actions in rapid sequence before any human observes the outcome. Third, intent is opaque without logging: the reasoning trace that motivated each action is discarded unless explicitly captured, making post-hoc incident investigation impossible. Fourth, the attack surface extends: prompt injection techniques can redirect an agent's action sequence by modifying tool outputs, a vector not present in single-request architectures.

The EAGF is architecturally analogous to the Enterprise AI Control Plane described in EACP-2026-001 [9], which drew its structural precedent from software-defined networking and cloud infrastructure control planes. Where the EACP interposes between the application layer and the model layer to govern individual inference requests, the EAGF interposes between the application layer that spawns agents and the tool execution layer where agents take real-world actions. The EACP governs what models receive; the EAGF governs what agents do. Both are necessary; neither is sufficient alone.

The Enterprise AI Agent Governance Framework is defined as the architectural layer positioned between the agent orchestration layer (which spawns and directs agent sessions) and the tool execution layer (where agent actions produce real-world effects). The EAGF evaluates each proposed agent action against organizational policy before execution, logs every reasoning step and action outcome to an immutable audit record, tracks session-level governance state, and escalates to human review when policy thresholds are reached.

The EAGF comprises five components. Fig. 1 presents the reference architecture. Table I presents the failure mode analysis for each component.

The Action Classification Engine evaluates each agent-proposed action before execution, assigning it a reversibility classification and a blast radius category. The reversibility classification determines whether the action can be undone: a database read is reversible; a sent email is irreversible; a file modification may be reversible (if version-controlled) or irreversible (if not). The blast radius category determines the scope of potential consequence: an internal API call has a bounded organizational blast radius; an external API call may have an unbounded one.

Fig. 2 presents a directional illustration of relative reversibility and blast radius by action category. The Action Classification Engine operationalizes this taxonomy as a pre-execution classification policy, enabling downstream components to apply risk-proportionate governance without requiring human review of every action.

The Delegation Boundary Enforcer validates each proposed action against the organization's Agent Delegation Boundary before permitting execution. The Delegation Boundary extends the AI Access Policy Matrix defined in EACP-2026-001 [9] to the multi-action agent case. Where the AI Access Policy Matrix governs a single (principal, capability, data classification) triple mapping to a permitted model provider, the Agent Delegation Boundary governs a (principal, capability, context) triple mapping to a permitted action set within an agent session.

The Delegation Boundary Enforcer also provides structural defense against prompt injection: if injected instructions direct the agent to take an action outside B(p, c, x), the action is blocked regardless of the agent's reasoning. The agent's reasoning may be compromised; the boundary policy is enforced externally and cannot be overridden by the agent.

The Reversibility Budget Monitor tracks the session-level ratio of reversible to irreversible actions in real time. This metric, the Reversibility Budget, provides a continuous governance parameter enabling automated escalation decisions without requiring per-action human review.

The Agent Audit Logger creates an immutable record of every reasoning step, proposed action, Delegation Boundary check outcome, action execution result, and escalation event within an agent session. This component is the mechanism by which the EAGF enables post-hoc forensic investigation, regulatory compliance demonstration, and systematic quality management for agent behavior.

The NIST AI RMF Manage function requires organizations to respond to AI risks in deployment [5]. For agentic systems, responding to AI risks requires knowing what decisions the agent made and why. Without the Agent Audit Logger, the agent's reasoning traces are lost at session completion. The Agent Reasoning Trace Irreversibility Property (Observation 1) applies: no subsequent investment can reconstruct the reasoning that led to a given irreversible action.

The Human Escalation Orchestrator manages the workflow by which agent sessions are paused and human judgment is inserted at governance-defined checkpoints. Escalation triggers include: the Reversibility Budget Monitor reaching ρ_min; the Delegation Boundary Enforcer detecting a proposed out-of-boundary action; the Action Classification Engine scoring a proposed action above a configured blast radius threshold; and the Agent Audit Logger detecting a reasoning pattern associated with prompt injection or goal drift.

The Human Escalation Orchestrator resolves the central tension in operational agent deployment: agents are valuable because they reduce human review burden, but governance requires human judgment at high-consequence decision points. The Reversibility Budget and Delegation Boundary provide the policy precision required to minimize escalations to those genuinely requiring human judgment, rather than escalating every action or escalating nothing.

A four-tier maturity model is defined for EAGF assessment, using the same tier nomenclature as the EACP companion paper [9]: Ad Hoc, Defined, Managed, and Optimizing, adapted from the CMMI framework's five-level progression. In practitioner observation, most enterprise agent deployments in 2026 operate without formal EAGF infrastructure; Fig. 2 illustrates directional relative risk by action category and Fig. 3 presents the maturity concentration heatmap across the five EAGF components.

Three reference architectures are defined for organizations at different maturity levels. As with the EACP companion reference architectures [9], these are reference configurations illustrating minimum viable EAGF for each tier, not prescriptive implementations.

The Contained architecture establishes the minimum viable EAGF for organizations beginning agent governance implementation. Priority sequence: Action Classification Engine first (to bound blast radius before any session executes), followed by Delegation Boundary Enforcer (to enforce least-privilege access by agent class), followed by Agent Audit Logger (to create the session record required for compliance attestation). Reversibility Budget Monitor and Human Escalation Orchestrator are deferred to the Extended architecture.

In the Contained architecture, high-risk actions (above a configured blast radius threshold) require human approval before execution. This makes all agent actions with irreversible external consequence human-gated, at the cost of reduced agent autonomy. The Contained architecture is appropriate for initial pilot deployments and for agent classes operating on high-risk data. Table II presents the indicative 90-day implementation roadmap for the Contained architecture.

The Extended architecture adds the Reversibility Budget Monitor and Human Escalation Orchestrator. At this tier, agents execute reversible actions autonomously; the Reversibility Budget Monitor tracks accumulated irreversibility across the session; and escalation is triggered when ρ(S) approaches ρ_min rather than at each individual irreversible action. This substantially reduces human review burden while maintaining governance over session-level risk accumulation.

The Extended architecture integrates with existing enterprise infrastructure: the Agent Audit Logger feeds the organization's SIEM; the Delegation Boundary Enforcer integrates with the enterprise identity provider; and the Human Escalation Orchestrator integrates with existing ticketing and notification workflows.

The Autonomous architecture adds continuous evaluation pipelines and policy-as-code for delegation boundaries and blast radius thresholds. At this tier, agents execute all actions within their defined Delegation Boundary autonomously; the Reversibility Budget Monitor adjusts ρ_min dynamically based on session context and historical behavior; and the Human Escalation Orchestrator is reserved for boundary violations and anomalous reasoning patterns rather than routine budget exhaustion.

The Autonomous architecture aligns with the NIST AI RMF Govern function, requiring organizations to establish policies that are enforced programmatically rather than through manual review [5]. ISO/IEC 42001:2023 management system requirements are satisfiable through the documented policy artifacts and audit evidence produced by this architecture [8].

The NIST AI RMF 1.0 organizes AI risk management around four functions: Govern, Map, Measure, and Manage [5]. The EAGF provides direct operational support for each function in the agent context. The Govern function is operationalized by the Delegation Boundary Enforcer, which enforces policy at the action level. The Map function is supported by the Action Classification Engine's blast radius assessment, which identifies agent risks in context before deployment. The Measure function is supported by the Reversibility Budget Monitor's continuous session-level risk metric. The Manage function is supported by the Human Escalation Orchestrator's checkpoint and response workflow.

The EU AI Act applies particularly stringent requirements to AI systems that exercise autonomy in high-risk domains listed in Annex III [6]. Agentic AI systems deployed in high-risk domains, including employment, education, law enforcement, and critical infrastructure, are subject to Article 9 quality management requirements, Article 12 automatic logging requirements, and Article 13 transparency requirements. The EAGF's Agent Audit Logger directly addresses Article 12; the Delegation Boundary Enforcer and its policy documentation support Article 9.

Penalties under the EU AI Act reach 7% of global annual turnover for prohibited practice violations (Article 85(3)) and 3% for provider and deployer obligation violations including logging and transparency requirements (Article 85(2)) [6]. Agentic systems taking autonomous action in high-risk domains face the full penalty exposure of the high-risk system provisions; the EAGF's Contained architecture represents the minimum governance posture for defensible compliance.

ISO/IEC 42001:2023 requires organizations to establish documented controls for AI risk management and maintain evidence of management system effectiveness [8]. The EAGF's Delegation Boundary policy documentation maps directly to ISO 42001's controls for AI system access and data governance. The Agent Audit Logger provides the measurement and monitoring evidence required by the standard's performance evaluation clause. Organizations pursuing ISO 42001 certification will find that Extended-tier EAGF maturity provides substantial control evidence for agent governance specifically, a gap area in many current ISO 42001 implementations that were designed before widespread enterprise agent deployment.

The business case for EAGF investment rests on four value driver categories: breach and incident cost reduction, regulatory penalty avoidance, engineering overhead reduction, and agent trust acceleration. Table III presents the value driver framework with mechanism, evidence basis, and measurement approach for each category.

The following decision framework maps organizational state to recommended EAGF architecture and primary implementation justification.

Fig. 4 illustrates the divergence between a governed and an ungoverned agent session in terms of reversibility budget. In the ungoverned case, the agent accumulates irreversible actions without any session-level tracking, eventually reaching a state of complete irreversibility while the session continues. In the governed case, the Reversibility Budget Monitor tracks ρ(S) continuously and triggers human escalation at the policy-defined threshold, preventing continued irreversible action accumulation beyond the organization's risk tolerance.

The EAGF framework as defined in this paper is a conceptual architecture, not an implementation specification. The action reversibility classification taxonomy requires organization-specific calibration; no universal taxonomy is possible because reversibility depends on the organization's infrastructure, version control practices, and recovery capabilities. The Reversibility Budget metric assumes that actions can be reliably classified as reversible or irreversible at pre-execution time; in practice, some actions have conditional reversibility that depends on downstream system state.

The maturity assessment model is based on practitioner assessment rather than systematic survey data and should be treated as a reference framework. The indicative 90-day implementation roadmap in Table II depends on organizational complexity, existing infrastructure, and team capacity; actual timelines will vary.

The EAGF and EACP are complementary, not alternative, frameworks. The EACP governs individual inference requests: what models receive, at what cost, with what audit record, and under what access policy. The EAGF governs what agents do with the models' outputs: what actions they may take, in what sequence, with what blast radius, subject to what delegation constraints. An organization can have a mature EACP and simultaneously have no agent governance infrastructure; the EACP does not constrain what an application does with a model's completion. Both layers are required for a complete enterprise AI governance posture. The recommended implementation sequence is EACP first (governing the inference layer) followed by EAGF (governing the action layer), though organizations deploying agents before establishing an EACP should implement both concurrently.

Constitutional AI, introduced by Bai et al., addresses the alignment of model behavior with specified principles at training and inference time [3]. Constitutional AI and related alignment techniques address the question of what models are disposed to do. The EAGF addresses the complementary question of what agents are permitted to do, governed externally regardless of model disposition. A constitutionally aligned model that is granted unrestricted tool access with no delegation boundary still presents an unlimited blast radius; a model with no alignment training that operates within a bounded delegation boundary and with a monitored reversibility budget presents a bounded organizational risk. The two approaches address different risk surfaces and are not alternatives.

Enterprise AI agent deployments in 2026 are in an analogous governance state to enterprise AI inference deployments in 2024: the capability has arrived and is being deployed widely before the governance infrastructure required to operate it responsibly at scale exists. The Enterprise AI Control Plane addresses the inference governance gap; the EAGF addresses the action governance gap. The two gaps require two different frameworks because they involve different risks at different layers of the stack.

This paper has introduced three original contributions not present in existing AI agent governance literature: the Action Blast Radius as a bounded, auditable governance parameter enabling least-privilege agent design; the Agent Delegation Boundary as a named three-dimensional control structure extending the single-request policy model to the multi-action agent case; and the Reversibility Budget as a continuous, automatable session-level governance metric enabling human escalation to be triggered at policy-defined thresholds rather than at every action or never.

The governance decision for enterprise AI leaders deploying agents is not whether to bound the blast radius, but how large an unbounded radius they are willing to accept while they build the infrastructure to bound it. Every agent session that executes without a delegation boundary is a session that could, by design, do anything the tool set permits. Every agent session that executes without audit logging is a session whose forensic record is permanently destroyed. The EAGF provides the vocabulary, the architectural specification, and the indicative implementation roadmap. The window for deploying governed agents is open now.

© 2026 Arjun Jaggi and Aditya Karnam Gururaj Rao. Open reference model, free to use with attribution. arjunjaggi.com/papers/enterprise-ai-agent-governance.html