In my last post I argued that agentic AI is following the same Build, Scale, Govern arc that cloud and microservices followed, just compressed. I ended it with a guess: that the governance layer for agents, the service mesh moment, would arrive faster than most roadmaps assume.
So this post is the follow-through. What actually makes governing autonomous agents different, what the most regulated industries are doing about it, what the platforms have started to solve, and what is still nobody’s solved problem.
— -
Why the old playbook doesn’t stretch
We already know how to govern software. I spent years of my career doing it: API gateways, IAM policies, distributed tracing, cost allocation tags. So the tempting assumption is that agents are just another workload that plugs into the same machinery.
They are not, and the reason is simple. Everything in that machinery assumes request-response systems with deterministic behavior. You send a request, the service runs fixed logic, you get a response. With an agent, you hand over a goal and the system works out the steps itself at runtime. That one difference breaks the playbook in four places.
Observability: Tracing an HTTP call tells you what happened. With an agent, you also need to know why. Why did it pick tool A over tool B? What context did it have? What did it ignore? Traditional APM (application performance monitoring — the tooling we use to watch services in production) has no concept of reasoning. A trace of an agent’s execution is not an explanation of its decision.
Cost: A buggy microservice retries and fails. A buggy agent loops, spawns sub-agents, and burns tokens with no natural ceiling. In my last post I told the story of the finance review nobody could answer: why did this month’s bill jump forty percent. With agents, that question can arrive after a single bad afternoon. Cost used to be an infrastructure line item. Now it is a runtime behavior that needs runtime controls.
Identity and access: An agent acts on behalf of a user but runs with its own identity. Classic IAM was never built to express “this agent may call this tool, with these parameters, only while acting for this user.” Agents also bring an attack surface services never had: prompt injection, where malicious content in the agent’s inputs becomes an instruction. Your agent’s context window is now part of your security perimeter.
Audit: When a deterministic system makes a decision, you point at the code. When an agent makes a decision, the honest answer involves a probability distribution. There is no shared definition yet of what an audit trail means for a system whose behavior is not fixed between reviews.
— -
What the regulators just told us
If anyone should have answers, it is the industries that have governed models for decades. What they are telling us right now is revealing, and a little uncomfortable.
Banking has had formal model risk management since 2011, when US regulators issued SR 11–7. An entire discipline grew around it: model inventories, independent validation teams, model risk committees. In April 2026, the Federal Reserve, OCC, and FDIC replaced it with SR 26–2 , the first major revision in about fifteen years. The revision explicitly scopes out generative and agentic AI, calling these technologies novel and rapidly evolving.
Read that carefully. The most mature model governance regime in the world just told banks that the systems they are actively deploying sit outside the framework. According to NVIDIA’s 2026 State of AI in Financial Services report, based on a survey of more than 800 industry professionals, 42% of financial firms are already using or assessing agentic AI, and 21% have already deployed agents. Agent-specific guidance is signaled but not yet issued. Until it arrives, the deployment curve is ahead of the governance curve.
The reason for the exclusion matters, because it confirms the argument above. Traditional validation assumes a model’s structure and behavior stay stable between review cycles. You validate it once, monitor it, document it. An agent that adapts its own steps at runtime breaks the assumption underneath all three pillars. The principles are still sound. The methods behind them no longer fit.
Pharma tells a similar story from a different angle. There is no single AI rulebook in life sciences. Validation teams piece together governance from a patchwork of frameworks: FDA’s Computer Software Assurance guidance, a 2025 draft guidance on AI credibility, ICH quality risk management, GAMP AI guidance, and voluntary standards like ISO 42001. The FDA and EMA jointly issued ten good AI practice principles in early 2026, and EU AI Act high-risk obligations are phasing in this year.
The FDA’s underlying position is the one worth holding onto: AI may inform the work, but it does not own the accountability. A human must remain responsible for the decision and be able to explain why it was appropriate. No dashboard satisfies that requirement on its own.
Two heavily regulated industries, one conclusion. Existing frameworks assume systems whose behavior can be pinned down at validation time. Agents cannot be pinned down that way. The frameworks are being rewritten in real time, and enterprises deploying agents today are writing their own interim rules. Having watched enterprises do exactly that during early cloud adoption, I can tell you how it tends to go: unevenly.
— -
Where the platforms are converging
While regulation catches up, the platform layer is moving. A common architectural pattern is emerging across vendors, one I think will outlast any single product: enforce governance outside the agent, at a boundary the agent cannot reason around.
AWS’s Amazon Bedrock AgentCore is the most complete concrete example of the pattern today (AgentCore from here on). Its policy capability, generally available since March 2026, sits at a gateway between the agent and its tools. Every tool call crosses that boundary and gets checked against rules written in Cedar, a purpose-built policy language. The rules define which tools an agent may call, what parameters it may pass, and under what conditions.
The design choice that matters most: the checks run at the gateway layer, outside the agent’s code. The agent never sees the policy, so it cannot work around it. AWS describes this in its own documentation as probabilistic detection with deterministic enforcement — the model’s judgment can be uncertain, but the final allow-or-deny decision is not. Whatever you think of the product, that separation is the clearest governance principle for agents I have come across.
The same boundary now also hosts guardrails. As of mid-2026, AgentCore can evaluate tool call inputs and agent outputs in real time for prompt injection, sensitive data, and harmful content, and block them before they reach downstream systems. Telemetry comes out in OpenTelemetry-compatible format, with per-agent logs that keep traces, prompts, and policy decisions together — what an auditor would actually ask for. Policies can also run in log-only mode before moving to active enforcement. Anyone who has rolled out service mesh policies will recognise the pattern: dry run first, enforce second.
AWS is not alone in this. The big clouds are converging on the same boundary. Azure API Management now acts as an AI gateway that exposes APIs as MCP servers (MCP — the Model Context Protocol — is an open standard for connecting agents to tools), governs agent-to-agent traffic, and applies content safety checks at the gateway. Google’s Apigee has added MCP support and a central catalog for governed tools. Open-source and AI-native gateways like LiteLLM and Portkey put token budgets, guardrails, and MCP-level controls at a proxy in front of the model. Different products, same architectural bet. AgentCore is the worked example in this post because it currently expresses the pattern most fully, not because the pattern is AWS’s alone.
— -
What nobody has solved
The platform primitives are arriving. The governance program is not. Five gaps, in the order I would worry about them.
The boundary only governs what crosses it. Gateway-based policy applies to tool calls routed through the gateway. If an agent calls an SDK directly from its own code, that call never touches the policy layer. Skip the gateway and you skip the governance, silently. Keeping every tool call on the governed path is an engineering discipline problem, not a product feature. Service mesh taught this lesson the hard way: coverage gaps are where incidents happen.
Execution audit is not reasoning audit. You can now trace every step an agent took. Explaining to a regulator why it took those steps is a different problem, and nobody has solved it. Telemetry is evidence, not an explanation. The FDA’s accountability standard — a human who can explain why the decision was appropriate — is still met by humans, not by dashboards.
Cost governance is mostly reporting, not enforcement. Dashboards show token spend per agent. Hard budget ceilings, per-agent spend limits, automatic circuit breakers on runaway loops: teams are still building these themselves, the same way we all built cloud cost controls by hand after the first unexpected bill.
Cross-platform governance does not exist. AgentCore governs AgentCore. Azure governs Azure. Real enterprises run agents across clouds, internal frameworks, and vendor products, and there is no single governed layer across all of them. If the framework fragmentation in the Build phase was frustrating, the governance fragmentation in the Govern phase will be worse, because the stakes are higher.
The platform gives primitives, not a program. Policy engines and audit logs are necessary. They are not sufficient. You still need your own identity model, tool schemas, audit retention, incident response plan, and a named human who is accountable when an agent does something no policy anticipated.
— -
Where this leaves us
In the cloud era, real governance tooling arrived roughly a decade after adoption started. In the microservices era, closer to five years. With agents, serious governance primitives are shipping within two to three years of the technology going mainstream. The compression I wrote about last time is real.
But notice what compressed and what did not. The tooling compressed. The hard problems did not. Explainability, cross-platform control, cost enforcement, and regulatory clarity are all still open — and open at the exact moment banks and pharma companies are deploying agents into frameworks that just admitted they do not fully cover them.
If you are running agents in production, or planning to, I am curious which of these gaps bites your team first. My bet is on the gateway bypass problem, because it is the one that looks solved right up until the day it is not.
— -
References
1. Federal Reserve, OCC, FDIC. Revised interagency guidance on model risk management (SR 26–2 / OCC Bulletin 2026–13), April 17, 2026. Analysis: Databricks, Model risk management in 2026: A banker’s guide to the revised interagency guidance
2. Kapron, Z. The Governance Gap That Could Break Financial Markets. _Forbes, April 22, 2026.
- Sharma, K._ SR 11–7 in the Age of Agentic AI: Where the Framework Holds and Where It Strains. GARP Risk Intelligence, February 27, 2026.
4. Governing Generative AI Across Financial Institutions: An SR 26–2-Compatible Framework_. arXiv preprint. - AWS._ Amazon Bedrock AgentCore FAQs. 6. AWS. Amazon Bedrock AgentCore now supports Bedrock Guardrails in policy_. AWS What’s New, June 17, 2026.
- AWS._ Observe your agent applications on Amazon Bedrock AgentCore Observability. _AWS Documentation.
- IntuitionLabs._ Best Agentic AI Platform for Pharma GxP Validation (2026)_.
- IntuitionLabs._ Pharma AI Validation Packages for FDA and EMA Compliance_.
- Xevalics._ FDA’s Position on AI in Pharmaceutical Quality Systems (2026)_.
- Microsoft._ AI gateway capabilities in Azure API Management. _Microsoft Learn.
- NVIDIA._ State of AI in Financial Services: 2026 Trends. Survey of 800+ industry professionals, published January 22, 2026.
Top comments (0)