Audit logs are a post-mortem. Runtime governance is a pre-flight check.

AI agents operate at machine speed. Governance cannot remain a human-speed process.

For years, organisations have treated auditability as evidence of control. An application performs an action. The system records it. A dashboard displays it. If something goes wrong, security, risk and compliance teams reconstruct the event, identify the failure and recommend a remediation.

That model made sense when software followed predictable workflows and consequential decisions still passed through people. It is dangerously incomplete when autonomous AI agents can query databases, call external services, initiate transactions and coordinate with other agents in seconds.

A record of an unauthorised action may help explain an incident. It does not prevent one.

That is the difference between forensic accountability and operational governance.

AI has outrun the review cycle

In IBM’s 2026 Tech Leader Study, 77% of surveyed organisations said AI adoption was already outpacing their governance capabilities. 70% said teams were deploying AI faster than IT could track, while only 11% felt prepared for the scale of AI agent deployment expected over the next year. IBM also found that organisations embedding control directly into their AI systems saw 25% fewer security incidents than those relying on manual governance.

For CISOs, this creates a structural accountability problem.

Security leaders remain responsible for data exposure, access violations, third-party risk and regulatory compliance. But the systems producing those risks are becoming faster, more autonomous and more distributed.

An AI agent does not wait for the next architecture review. It does not pause while a governance committee interprets a policy. It may complete hundreds of actions before a monitoring alert is investigated.

If governance exists only as documents, review boards and retrospective logs, the organisation may be able to show that it had a process. It cannot show that the process controlled the action.

That is governance theatre, not governance.

The old model detects failure after execution

The traditional pattern looks like this:

Agent acts → log entry created → anomaly detected → investigation begins → remediation follows

Every component may work exactly as designed and the organisation can still lose. The payment has already been initiated. The sensitive record has already been retrieved. The customer communication has already been sent. The external tool has already received the data.

At that point, the audit log becomes a post-mortem.

Logs remain essential. They support investigations, compliance reporting and accountability. But they answer retrospective questions: what happened, which system made the request, when it occurred and what the outcome was.

Runtime governance must answer a more important question first: should this action be allowed to happen at all?

The new model governs before the action

A runtime governance model inserts a control point between an agent’s intent and its execution:

Agent proposes action → gateway verifies identity and context → policy evaluates authority and risk → action is allowed or refused → an attributable, versioned decision record is retained

This is the AI equivalent of a pre-flight check.

Before an aircraft takes off, the industry does not rely on the flight recorder alone. The black box is invaluable after an incident, but it is not the primary safety mechanism. Aviation uses checklists, permissions, system checks and operating thresholds before take-off.

Enterprise agents need the same separation between evidence and control.

The decision happens before the action, not after it. The record is evidence of control, not a substitute for it.

An agent gateway provides a consistent enforcement point between agents and the systems they access. Instead of embedding different governance logic into every agent, application and integration, organisations can route interactions through a shared layer that verifies identity, evaluates policy and records the resulting decision. Affinidi Agent Gateway, for example, is designed to sit between applications, agents and backend services, applying controls across protocols such as MCP and A2A without requiring governance logic to be rebuilt for every integration.

The result is a different security posture. The organisation no longer asks only, “Can we prove which agent did this?” It can ask:

• Which agent is requesting the action?
• On whose behalf is it acting?
• What credentials, claims or delegated authority does it hold?
• Which tool, service or dataset is it trying to access?
• Is the requested action permitted in this context?
• Does the action require human approval?
• Can we produce verifiable evidence of the decision?

Governance becomes part of execution, not paperwork surrounding it. (We made the case for why agent identity is the missing piece of that picture earlier this year.)

Policy-as-code turns intent into enforcement

Most organisations already have AI policies. They define acceptable use, restricted data, approval requirements, spending limits and escalation procedures. The problem is not always the absence of policy. It is the distance between written policy and production behaviour.

A document stating that an agent must not transfer customer data to an unapproved service does not technically stop the transfer.

Policy-as-code closes that gap. Rules can be expressed declaratively, versioned, reviewed and evaluated automatically at the gateway. Policies can consider the identity of the caller, the agent’s role, the requested resource, the declared purpose, the sensitivity of the data and the current runtime context.

A policy might specify that:

• A customer-service agent can read an order status but cannot change payment details.
• A procurement agent can create a purchase request below a defined value but must escalate larger commitments.
• An agent can access personal data only when acting for an authenticated user with an appropriate purpose.
• Calls to an unapproved model, tool or MCP server must be blocked.
• A high-risk action requires stronger credentials or human authorisation.

Agent Gateway uses Open Policy Agent (OPA) policies for declarative access control and can apply controls to inbound and outbound agent traffic. Its architecture also preserves caller context, supports delegated credentials and produces tamper-evident records of governance decisions.

This makes policy testable. Security teams can review proposed rule changes. Engineers can validate them before deployment. Auditors can trace which version applied to a specific decision. When risk tolerances change, the organisation can update one enforcement layer instead of modifying every agent independently.

That is what scalable governance looks like.

Regulators and standards bodies are moving toward runtime trust

The direction of travel is becoming clear.

In July 2026, the Monetary Authority of Singapore published the Safeguards for Agentic Finance at Runtime (SAFR) framework through its BuildFin.ai initiative. SAFR proposes a governance checkpoint between an agent’s proposed action and its execution, supported by agent identity, a controls repository, a disposition engine and an audit log. The action can then be approved, rejected, escalated for human review or observed, according to institutional policy.

SAFR is an industry reference framework, not regulatory guidance or a statement of supervisory expectations. That distinction matters. But its architecture sends an equally important signal: post-execution audit alone is not considered a sufficient design pattern for autonomous financial agents. Governance needs to operate at the point of action.

Europe is approaching the trust problem from another direction. The European Digital Identity framework, commonly associated with eIDAS 2.0, establishes an interoperable foundation for digital identity, electronic attestations and trust services across the EU. It is not an AI-agent runtime governance framework. However, its emphasis on verifiable identity, attributes, signatures, seals and cross-border trust reflects the same broader requirement: digital interactions need reliable proof of identity, authority, origin and integrity.

Together, these developments point toward an operating environment in which identity, authority, policy and evidence must travel with digital actions. For AI agents, those controls cannot be bolted on after deployment.

Govern at the boundary

The shipping container transformed global trade not because it was technologically complex, but because it standardised the handoff between ports, ships, cranes and transport networks.

Agentic AI faces a similar infrastructure problem. Enterprises do not need a different trust mechanism for every model, agent, protocol and partner. They need a standard control boundary where identity can be verified, authority evaluated, policy enforced and evidence produced consistently.

That boundary is the gateway.

Agent Gateway provides a unified control layer for agent interactions, allowing organisations to govern agent traffic across systems and organisational boundaries while maintaining attribution and tamper-evident records. Paired with Agent Stream, which governs what happens inside the execution flow, the aim is to make trust part of the infrastructure rather than custom code rebuilt inside every integration.

For CISOs, the question is no longer whether AI agents will create more logs. It is whether those agents can be stopped, constrained or escalated before a prohibited action becomes an incident.

---

If your governance can only explain what happened after the fact, it is not controlling the system. It is documenting the loss.

Move from post-mortem evidence to pre-flight control. Explore Agent Gateway.

Sources

• IBM Institute for Business Value, “New IBM study finds CIOs and CTOs face growing AI control gap as enterprise deployment scales”, IBM Newsroom, 8 June 2026. https://newsroom.ibm.com/2026-06-08-new-ibm-study-finds-cios-and-ctos-face-growing-ai-control-gap-as-enterprise-deployment-scales
• Paige Gross, “AI deployment plans are catching leaders underprepared”, CIO Dive, 8 June 2026. https://www.ciodive.com/news/tech-leaders-ai-deployment-underprepared/822295/
• Monetary Authority of Singapore and BuildFin.ai, “Safeguards for Agentic Finance at Runtime (SAFR)”, v1.1, 2026. https://www.mas.gov.sg/-/media/mas-media-library/development/fintech/ai-safr/safr-v1-1.pdf
• Regulation (EU) 2024/1183 establishing the European Digital Identity Framework, EUR-Lex, 2024. https://eur-lex.europa.eu/eli/reg/2024/1183/oj
• Affinidi, “Agent Gateway: Control layer for agentic AI”. https://www.affinidi.com/agent-gateway