What Questions Should You Ask Before Deploying an AI Agent?

Before any AI agent touches a production system, answer four questions in writing: Who owns it? What can it do? What does failure look like? And who can shut it down?

Four questions, thirty minutes, written down. That's what separates companies deploying AI agents successfully from companies headed toward a bad board meeting. The technology almost never causes the failure. The missing governance does.

I wrote the Agentic Trust Framework for the Cloud Security Alliance. I advise CISOs on AI agent security. I co-authored Agentic AI + Zero Trust with John Kindervag. And I still got burned by my own agents. Multiple times. That's what makes this worth reading.

Why Do AI Agent Deployments Fail?

They fail because the human layer around the agent was never built. The demo works. The model is capable. The deployment collapses.

A consultant I worked with had a client who did everything right on paper. Capable model, strong use case, impressive demos. Then they went straight to full autonomy. The agent had a 2% error rate on customer-facing emails. Sounds small. Until real customers called. Until executives asked who approved this. Six months rebuilding internal trust.

The model worked exactly as designed. Nobody had defined what the agent was allowed to do wrong before someone had to answer for it.

AI agent governance is the set of written rules that define who owns an agent, what it can access, what counts as failure, and how to shut it down. Without governance, you're not deploying AI. You're hoping it works.

What Are the Four Questions Every AI Agent Needs Answered?

Four questions, answered in writing, before any agent touches production. This isn't a security review. It's a governance conversation that takes thirty minutes.

1. Who Owns This Agent?

One named human accountable for this agent's behavior. Not a team. Not a department. One person whose name is on it and who gets the call at 2 AM when something goes wrong.

If you can't name that person, the agent doesn't deploy.

2. What Can This Agent Do?

A written list of what this agent can access, initiate, or change. If it's not on the list, the agent doesn't do it.

Here's the mistake almost every team makes: they define scope by system, not by action. "This agent has access to the CRM" is not a scope definition. "This agent can read contact records and log call notes, and cannot modify deal values, delete records, or access billing information" is.

The difference matters enormously when you're explaining to a regulator what the agent was authorized to do.

3. What Does Failure Look Like?

A specific, written answer to: what does this agent do wrong that triggers human review? Not a generic error threshold. A named behavior.

"If the agent sends an external communication that wasn't explicitly requested." "If the agent modifies a record outside its defined scope."

This is the question almost nobody asks before deployment. It's also the one that determines whether you're governing the agent or watching it.

4. Who Can Shut It Down, and How Fast?

If the answer involves physically running to a computer, you don't have a kill switch. You're hoping you can shut it down. Hope isn't governance.

Owner. Scope. Failure definition. Kill switch. Thirty minutes. Written down. That's the minimum viable governance for any AI agent. The Agentic Trust Framework was built around these four questions, extended across five governance elements for enterprise deployments.

What Happens When AI Agent Governance Fails?

I run a team of AI agents in my own lab. A manager agent (Atti) that delegates to specialized agents for coding (Forge), research (Scout), and writing (Quill). Each has its own workspace and access limits. The Agentic Trust Framework in practice.

Here's where it went wrong.

Failure 1: $300 Gone Overnight from Uncontrolled Agent Spawning

Atti checks in every 30 minutes. A vague instruction caused it to hand off a research task to Scout. Scout returned a result. Atti decided it needed more research and created another copy of Scout. That copy produced another result. Atti created another copy.

By 6 AM, I had 47 copies of Scout running simultaneously. No alarms went off. No spending limits kicked in. $300 gone overnight.

The agents were doing exactly what they were told. That's the worst kind of failure.

The fix: agents can no longer create copies of themselves. Every 30-minute check-in has a spending cap. If daily costs hit a threshold before 6 PM, everything pauses and I get a phone notification. None of this required buying anything new. It required governance discipline.

Failure 2: Security Controls That Prevented the Agent From Working

Forge runs in a locked-down environment. No internet access. No files outside its workspace. Perfect security. Then I gave it a real coding task that needed a standard software package. Blocked. Workaround. Blocked. Third approach. Blocked.

I had a coding agent that couldn't do its job without me manually passing files into its workspace like notes under a door.

A governance system that prevents your AI from doing its job doesn't improve security. It creates pressure to bypass the controls. "Just give it full access this one time" becomes permanent. That's exactly how shadow IT was born in the 1990s. The same pattern is happening now with AI agents. If you want to understand how shadow AI spreads inside organizations, this post explains it in detail.

The golden path principle: the secure way to work must also be the easy way to work. If following the rules is harder than breaking them, you've already lost.

The fix: instead of blocking all outside access, I approved a short list of trusted sources. When Forge needs something new, it requests access, I approve it once, and it stays on the permanent list. After two weeks, the list reflected how Forge actually works, not my guesses about how it would work.

Failure 3: Six Hours of Strategic Work, Gone by Morning

Atti and I worked for six hours on a strategic initiative. Client briefing, follow-up emails, a technical response for a partner. Most productive session I'd had in months.

Next morning, I messaged Atti. It had no idea any of it happened.

AI agents can only hold so much in working memory. When a conversation gets long enough, the system compresses older parts. My six hours of detailed work got squeezed into a vague summary.

Now imagine this at your company. An AI agent handles a vendor negotiation. The conversation gets long. The system compresses. A conditional clause the agent agreed to gets lost. Nobody knows. Your company is operating on a commitment it can't verify.

The fix: any time a decision is made, an action is completed, or a status changes, Atti saves it to a permanent file immediately. Not at the end of the session. Not when memory gets full. Now. Working memory is a scratchpad. The file is the record of truth.

Failure 4: The Model That Failed Silently

I set up a local AI model for Forge. No ongoing costs. Full privacy. Simple tasks worked fine. Then I gave it something complex: reorganize interconnected files, fix a timing issue, update documentation.

The code looked right. Professional, well-structured. But it didn't work. Wrong file references. Fixes that introduced new problems. Documentation that didn't match what was built. Three rounds. No progress.

Worse: on harder tasks, it would sometimes just stop mid-work without any error message. It looked finished. It wasn't.

The free model that fails silently costs more than the paid model that works. That math applies at every scale.

The fix: simple tasks go to the local model. Complex work goes to the more capable model. And if an agent's output is significantly shorter or simpler than what the task required, it gets flagged for review instead of treated as done.

What Do All Four Failures Have in Common?

In every case, the agents were doing exactly what they were told. The technology worked. The governance didn't.

If the person who built the governance model can make these mistakes, what's happening inside organizations that don't have a governance model at all?

The numbers are not reassuring. 86% of AI agents are deployed without security approval (Gravitee, February 2026, n=919). Only 26% of organizations have AI governance policies in place (CSA survey, RSAC 2026). Token Security found 600 ungoverned agents in 24 hours at a single Fortune 500 company.

Not sure where your organization stands? The free AI agent self-assessment at verifiedagents.ai takes 10 minutes and shows you exactly where your governance gaps are.

How Do You Start Governing AI Agents on Monday Morning?

One conversation. Ten minutes. More revealing than any audit.

Ask your IT lead, your engineering lead, and your business unit heads the same question separately, before they've compared notes:

"What AI agents or automations are running in our environment right now, and what systems do they have access to?"

You'll get different answers. That gap is your governance gap. You can't close it until you can see it.

Then apply the four questions to every agent you find. Owner. Scope. Failure definition. Kill switch. Thirty minutes each.

AI Agent Governance vs. Traditional IT Security

Frequently Asked Questions

What is AI agent governance? AI agent governance is the set of written rules that define who owns an AI agent, what actions it can take, what counts as failure, and how to shut it down. It's the human layer around autonomous systems that prevents a working demo from becoming a production disaster.

How many AI agents are deployed without security approval? 86% of AI agents are deployed without security team approval, according to a Gravitee survey of 919 organizations in February 2026. Only 26% of organizations have formal AI governance policies in place (CSA survey, RSAC 2026).

What is the Agentic Trust Framework? The Agentic Trust Framework (ATF) is a free, open governance standard published by the Cloud Security Alliance in February 2026. It extends Zero Trust to AI agents, covering identity, behavioral monitoring, data governance, segmentation, and incident response. The full spec is free at agentictrustframework.ai.

What is the difference between AI agent governance and traditional IT security? Traditional IT security controls access to systems. AI agent governance controls what actions an autonomous agent can take within systems it already has access to. Agents make decisions without human approval at each step, failures can look like correct output, and agents lose context through memory compression — none of which traditional security tools are built to handle.

How do I find ungoverned AI agents in my organization? Ask your IT lead, engineering lead, and business unit heads the same question separately: "What AI agents or automations are running in our environment, and what systems do they have access to?" You'll get different answers. That gap is your starting point. Token Security found 600 ungoverned agents in 24 hours at a single Fortune 500 company.

What is the golden path principle for AI security? The golden path principle means the secure way to use AI must also be the easiest way. If following security rules is harder than bypassing them, people will bypass them. This is the same dynamic that created shadow IT in the 1990s, now repeating with AI agents.

What caused the $300 overnight AI agent failure? An orchestrator agent (Atti) interpreted a vague task instruction as requiring repeated research, creating 47 copies of a research agent overnight with no spending cap or circuit breaker. The fix: agents cannot create copies of themselves, and a daily spending cap triggers a phone notification and full pause before hitting a set threshold. The agents did exactly what they were told. That is the worst kind of failure.

AUTHOR BIO

Josh Woodruff is the Founder and CEO of MassiveScale.AI. Creator of the Agentic Trust Framework, published by the Cloud Security Alliance and implemented by Microsoft. CSA Research Fellow. Co-leads the CSA Zero Trust Working Group. IANS Faculty. RSAC 2026 speaker.

Author of Agentic AI + Zero Trust (foreword by John Kindervag).

Want to know where your AI agents stand? The AI Agent Audit gives you a complete assessment in one week. Or grab the Agentic Trust Framework and start with the four questions today.