By Prasad Varahabhatla | Fullcast Advisor, Senior Director of Enterprise AI Programs and Governance, Cisco
"All it takes is one event."
One rogue agent, one unlogged decision, one quiet data exposure. That is the scenario shaping how enterprise AI leaders now think about risk.
Most enterprises have an AI policy. Usually it lives as a document. What's often missing is the connective tissue that turns that document into day-to-day protection. Leading enterprise AI governance at Cisco has given me a close view of what real governance demands, and how much ground most organizations still need to cover.
The space between AI adoption and AI accountability is where risk quietly accumulates and closing that gap is the work at hand.
We Are at the Cusp of a Generational Technology
This moment goes well beyond the internet revolution, beyond the iPhone era, beyond cloud computing, beyond anything most of us have lived through before. The disruption is already underway, and the upside is real.
Every few weeks, a new large language model arrives claiming to outperform everything before it. The early distinctions, one model better at X, another at Y, are narrowing quickly. Alongside that, the shift from generative AI to agentic AI is opening up an entirely new set of capabilities, and an entirely new set of considerations. Generative AI responds. Agentic AI acts, combining probabilistic reasoning with deterministic execution to carry out complex, multi step tasks with increasing autonomy.
The opportunity is significant, and competent users of AI are measurably more productive today than an year ago. The distance between exceptional developers and average ones has also narrowed. Not because exceptional work has gotten easier, but because the floor has risen. Developers who once lacked the tools to move fast now have them. Teams are generating ideas, iterating, and removing low value tasks at a pace the industry hasn't seen before.
And that is exactly where the challenge begins.
What Real Governance Looks Like: Five Active Dimensions
The instinct in most enterprises is to reach for a policy document. That instinct is right, but incomplete. Governance is not a set of rules written on paper, published, and handed out for people to follow. Without an connected and orchestrated execution layer, a governance document means very little. Real governance has five active dimensions:
Identity and Access Management: Agents, like employees, should operate within a defined scope of access. Think of a building where a badge gets you through the front door, but certain floors require an escort. The bounds need to be clear: what the agent can access, what it cannot, and when it is pushing against those limits.
Discoverability: At any given moment, an enterprise should be able to identify every agent running inside it. Not in theory, in fact, and in real time. What isn't known cannot be managed.
Observability: Learning that an agent went rogue two weeks ago is a post mortem, not governance. Real observability means continuous, real time visibility into what every agent is doing, with systems in place to flag anomalies and act on them quickly. The logs will be there. The question is whether the infrastructure can turn them into a timely signal.
Configurability: Every agent has a behavioral baseline: how long it typically takes to complete a task, which tools it accesses, which decisions fall within its scope. Governance means recognizing when an agent deviates from that baseline, and having the ability to intervene before the deviation becomes a problem.
Explainability and Traceability: When an agent makes a decision, it should be able to show its work. Every autonomous agent should be able to lay out its reasoning in clear detail: this was the input, these were the rules applied, this was the outcome reached, and this was the next step taken. Agents that cannot explain themselves create accountability gaps enterprises cannot afford.
The Threat That Hasn't Made It Onto Most Risk Registers Yet: Agent Sprawl
Ask most executives about AI risk and the conversation gravitates to data privacy, hallucinations, or regulatory compliance. There is another category worth raising, one that hasn't yet shown up on most risk registers: agent sprawl.
Almost anyone in a modern enterprise can create an agent. One of the larger challenges ahead is simple in shape and complex in consequence: organizations will end up with a lot of agents, and very little clarity on what to do with all of them.
Mastering RevOps From Data Integrity to Personal Growth
Agents get created for a task, then quietly abandoned. Duplicate agents get built independently by teams who don't know the others exist. An orphan agent, still technically active, still connected to enterprise systems, sits in the background with no clear owner and no one watching.
If thirty people are doing the same job, they need one shared agent, not thirty individual ones. The redundancy is wasteful, but the larger issue is governance exposure. Every additional agent is another surface area to monitor, secure, and eventually decommission.
Prompt Injection and the New Attack Surface
Governed innovation calls for internal discipline, and it also calls for defending against a threat landscape that is evolving as quickly as the technology itself.
One of the more subtle and consequential attack vectors in agentic AI is prompt injection. When an agent browses the web to answer a question, it reads whatever is on those pages, including any instructions a malicious actor may have embedded there. Those instructions, invisible to the human eye and written specifically for LLMs, can redirect an agent to take actions it was never intended to take.
There are security softwares available that can check and restrict prompt injection. We must also clear eyed about the limits of any single security layer. Imagine a prompt crafted in a way a person might not anticipate, but an agent will read and act on. Most of the time these get caught. It only has to slip through once.
The practical implication for any enterprise building agentic systems: a governance framework needs to define not just what agents can do, but where they can go, which sources they can trust, and how they handle instructions that appear mid-task from external sources.
Human Oversight Is Not Optional
AI autonomy has limits, which means human oversight belongs in the architecture of responsible deployment from day one, not as an afterthought, and not as something to optimize away.
Take a financial close process. That is not work to hand to an autonomous agent to certify at the end of a quarter. A corporate controller does that. No questions asked. The agent can do the work. The human still owns the decision.
The same logic applies to approval workflows. When an agent surfaces a recommendation and routes it to a human for sign off, that approval step has to mean something. Human oversight cannot become a rubber stamp. The approval screen should show every agentic step that led up to it, so the person clicking approve understands exactly what they are signing off on.
The design principle is simple: build AI systems that make human judgment more informed, not less relevant.
Governed Innovation Is Not a Paradox
The phrase governed innovation can sound like a contradiction, with rules and creativity seemingly pulling in opposite directions. That framing does not hold up.
The technology is consequential, and creativity & innovation need to keep flowing. Governance is not designed to slow AI adoption. It creates the conditions under which AI can be adopted at scale, sustainably, without the kind of catastrophic failure that forces an enterprise to pull back entirely. Another way to think about it: roads do not slow cars down. They make it possible to drive faster, farther, and with far less risk of ending up in a ditch.
That is the work ahead: An enterprise AI governance framework that brings together policy, observability platforms, security tooling, incident response protocols, and the human oversight structures that make the whole system trustworthy. The pieces already exist in parts of the organization. The work now is stringing them together into something coherent.
Prasad Varahabhatla is Senior Director of Enterprise AI Programs and Governance at Cisco and an advisor to Fullcast. His work focuses on building the execution layer for responsible AI adoption at enterprise scale.
KEY TAKEAWAYS
1. What does effective enterprise AI governance require?
Effective enterprise AI governance requires more than a written policy. Organizations need an execution layer that connects policy with identity and access controls, real-time monitoring, security tools, incident response, traceability, and human oversight.
2. Why is real-time visibility important for AI governance?
Organizations cannot govern AI agents they cannot see. Real-time discoverability and observability help enterprises identify active agents, monitor their behavior, detect unusual activity, establish ownership, and retire duplicate or abandoned agents.
3. How should enterprises govern autonomous AI agents?
Enterprises should establish clear access boundaries and maintain a traceable record of agent activity. Organizations should be able to determine what information an agent accessed, which rules governed its actions, what decision it reached, and what action it took next.
4. Why is human oversight still necessary in enterprise AI?
Human oversight remains essential for consequential business decisions. AI agents can perform complex tasks and make recommendations, but people should retain responsibility for high-stakes approvals. Reviewers also need enough context to understand the agent's actions before approving its recommendation.