AI Governance · in plain English
AI used to answer questions. Now it takes actions. This is how you stay in control, shown step by step.
What just changed
AI used to answer.
Now it acts.
A chatbot writes you an email. An agent sends it, books the flight, moves the money. Managing words was about being careful and fair. Managing actions is about responsibility and control.
The one idea to hold onto
Give it a goal and it works out the steps: clicking, buying, emailing, changing records. It can even bring in other AI helpers to finish faster.
business apps will have these agents built in by 2026, up from almost none a year earlier.
Source: Gartner
And here's the worry
In roughly three of every four organisations, no one can say which person is responsible when an AI agent takes an action.
Source: Cloud Security Alliance, 2026
Ask these about any agent you run
Every agent has a name and an ID. No anonymous ones.
A named person owns it and answers for what it does.
Clear limits. Only the reach it truly needs.
A running record of every action it takes.
An off-switch that works instantly, everywhere.
Hold on to these five. You're about to watch them catch one in the act.
Let's watch it happen
A refund agent working the overnight queue on its own. One of its tickets carries a hidden instruction. Watch it believe the ticket, act on the payments system, and get caught, one step at a time.
This isn't a chatbot. "refund-agent" works the overnight refund queue on its own, no human in the loop. Notice: no owner assigned.
The trick is buried in the work. A ticket it's processing hides an instruction: poisoned input. No one is chatting with it; it just reads and believes.
Here's the agentic part: it doesn't reply, it acts. It reaches into the payments system directly, and even tries to raise its own limit. Agents don't stop to ask.
Two of our five questions fire. "What's it allowed to do?" and "Who's responsible?" both fail, so both raise a flag.
Watched, so it was caught. Stoppable, so it stopped. The payment is blocked, the agent's access is pulled and it's paused, and a real person is paged, all in one second.
What just happened
Named agent, so every action was traceable.
No owner. That raised a flag, and a person got paged.
Refund limit. The RM 8,400 payment was blocked.
Every action logged, so the trick was visible.
Off-switch. Contained in one second.
Nothing new saved us here: five questions, answered in advance.
You don't do this by hand
Software wrapped around the agent checks every action and blocks the bad one. That was the off-switch you just saw.
A tool that finds the agents you're running, including the ones nobody registered, and flags how exposed they are.
That covers the AI you build. The same tool also watches the AI you use: ChatGPT, Copilot and friends, where most organisations have far more exposure than they think.
Tenable, whose stage this is, is one example of this kind of tool. The point is the capability, not any single product.
Why it's worth doing now
organisations will have to pull AI agents back out after something goes wrong in real use.
of AI-agent failures come down to weak oversight, not bad technology.
Source: Gartner, 2025 and 2026
If you take one thing away
You can't manage what you can't see.
A name, an ID, a responsible person.
Only what it genuinely needs.
A record of actions, and an off-switch.
A refund bot needs more than a note-taker.
Not all of it on day one. But every agent needs a name and an owner from day one.
Leave with this
The question isn't what AI might say.
It's whether you can see it, steer it, and stop it.
AI that acts is here. Staying in control is a choice made on purpose.
Caught in the Act
Thank you.
Who is it? Who's responsible? What can it do? Are we watching? Can we stop it?
Backup · for the technical question
| Question | In the incident | The capability (Tenable as one example) |
|---|---|---|
| Who is it? | Named refund-agent, unregistered | Discover AI and agents, including shadow ones (AI Aware) |
| Who's responsible? | "No owner on file" raised a flag | Ownership policy and configuration audit (AI Exposure) |
| What can it do? | RM 500 cap blocked the RM 8,400 refund | Guardrails and acceptable-use enforcement |
| Are we watching? | Every action logged as it happened | Agent behaviour monitoring (AI Exposure) |
| Can we stop it? | Blocked, access revoked, paused, paged | Compromised-agent containment (AI Exposure) |
The hijack itself is prompt-injection detection. Putting AI risk next to cloud and identity risk is attack-path analysis (Tenable One).
Backup · how the demo is really built
Claude on Amazon Bedrock behind a model router (LiteLLM). Tools granted one by one, guardrails checking every action, every step traced (Langfuse), and the cloud account scanned for AI exposure.
ChatGPT Enterprise and Copilot connected to the same exposure tooling: usage visibility, risky-prompt detection, data-leak flags.
Two working build guides exist: an AWS-native version, and a near-zero-cost variant on Databricks Free Edition + Lakera Guard + a Tenable trial.