The Hidden Risks Of Agentic AI (And How To Govern Them)

Forbes

06-08-2025

Rob Green is the chief digital officer of Insight Enterprises, a Fortune 500 Solutions Integrator.
As artificial intelligence (AI) and agentic capabilities rapidly expand to solve for practical value-added use cases and practical applications, organizations are grappling with the complexities of governance and security. As is so often the case with new technology waves, we see policies, procedures and tooling struggling to keep up with the pace of innovation.
As an early adopter, Insight has been a pioneer in addressing the challenges and opportunities posed by agentic AI. Our learnings have helped us update and adapt our governance approach, security procedures and teammate education and guidance.
Based on what we've learned, here are a few key considerations for keeping agentic AI safeguarded while still reaping the benefits.
Understanding Agentic AI Governance
To ensure governance, policies, processes and safeguards remain in lockstep with agentic developments, it's vital to conduct rigorous and frequent reviews with inputs from stakeholders across the organization. This includes legal, IT, sales, services, operations and any group that stands to benefit from agentic AI.
Agents have the potential to drive meaningful transformation and efficiencies, but it's vital they do so securely, ethically and responsibly. Ensuring that teams that are deploying agents are aware of proper use policies and guidelines is critical to mitigating risk. So is ensuring security teams have the tools to monitor agentic activity.
Policy Development And Legal Involvement
A cornerstone of effective governance lies in comprehensive policy development. Our own early adoption of AI technologies provided valuable lessons in drafting policies tailored to agentic systems. You can't put the burden of AI policy development just on the tech teams or those who will be using the AI models. The legal team needs to be involved from the outset to ensure compliance and mitigate liability risks.
These policies should address potential misuse, specify acceptable use cases and delineate accountability, especially given the varied regulatory landscapes across regions.
Challenges In Implementation
Developing governance models is only part of the equation; socializing these policies within an organization is equally crucial. If your organization doesn't see the guidelines as reasonable and easily adoptable, they're going to try and find ways around them.
When we first started working with more generative AI models, several business units rapidly adopted AI platforms and agents. This created challenges related to data security, permissions and our teammates' understanding of policy restrictions.
Governance models need to be flexible, allowing organizations to adapt to the rapid evolution of AI while securing buy-in from stakeholders. We review our teammate use policies regularly and have rewritten them entirely as new advances—like agentic AI—have emerged.
Security: A Shift-Left Approach
Security considerations must be integrated into AI projects from the outset—a practice known as the 'shift-left mentality.' Incorporating thorough quality assurance processes tailored to address AI-specific security vulnerabilities is essential.
Our own approach includes reviewing AI tools based on parameters like data usage, read/write access, security controls and the reputability of providers. Our chief information security officer and security team are constantly exploring new models and testing them out, running them locally to ensure safety and security for our organization.
In one case, one of my EU-based colleagues proposed a concierge AI tool that, upon further inspection, we had to deny use of due to the level of access to information it required. Although the use case was valid, this demonstrated the importance of vigilance in tool selection.
Client Engagement And Regional Nuances
Our interactions with clients reveal a growing interest in responsible AI practices. Questions often revolve around basic principles, but the complexity of AI requirements varies across regions. Executives must provide nuanced answers that address these regional differences while adhering to their governance frameworks.
Key Takeaways
To effectively manage agentic AI governance, I want to leave you with a few key points to consider:
• Collaborate with legal teams. Involve legal counsel early to ensure compliance and mitigate liabilities.
• Implement robust policies. Draft clear and adaptable policies for agentic AI use and misuse.
• Prioritize security. Adopt a shift-left approach to integrate security measures from project inception.
• Monitor continuously. Regularly evaluate AI models and platforms for emerging risks.
• Foster organizational buy-in. Socialize governance frameworks and educate employees on policy adherence.
• Engage clients thoughtfully. Address regional complexities with tailored, nuanced responses.
Agentic AI represents both a significant opportunity and a profound challenge for organizations. By adopting comprehensive governance frameworks, executives can navigate these complexities while safeguarding ethical practices and security. Proactive measures and a commitment to continuous evaluation pave the way for responsible AI adoption in a rapidly evolving landscape.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?