Category definitionFor boards, CIOs and risk officers

What is agentic AI, governed for production?

Agentic AI plans multi-step actions and executes across systems with reduced human intervention per step. Every action carries an identity, a policy and an audit record, or it stays a demo, never production.

Book a 30‑min call See the full category definition
What it is
Autonomy scoped to task risk
The test
Identity, containment and audit, by architecture
Who carries the duty
The deployer, not the model vendor
On this page
  1. 1. The definition
  2. 2. Why now
  3. 3. The 3 properties
  4. 4. Where it sits
  5. 5. Direct answers
The definition

Autonomy is not the product. Governed autonomy is.

Governed autonomy is the rule under which an AI agent acts within permissions set by the risk of each step of a workflow, records every action and keeps a stop at hand, and moves from assistance to supervised execution, then to bounded autonomy, only when the record of its past actions supports the change. An agent acts without approval on low-risk, reversible steps and stops for human sign-off on actions with financial, legal or safety consequence. The threshold is fixed before deployment, not discovered after an incident.

  • Not an agent framework

    Frameworks orchestrate calls between tools and models. They do not carry accountability for the action taken. An orchestration library is a component, not an answer to who signs for the outcome.

  • Not an unregistered agent

    A copilot waits for a human at every step; an agent does not. The production question is no longer which of the two you have. It is whether the agent runs under its own identity, a declared tool scope and a stop path whose time to stop is measured, not promised.

  • Not an automation script

    Scripts execute a fixed path. Agents plan and adapt, so the audit trail has to capture a decision, not just an output. Logging the result is not enough once the path is not fixed.

Agentic AI is a workload. The governance, audit and runtime that make it defensible are the operating layer we already run. See the full category definition When to choose Hikari Blue, and when not to

Why now

Obligations attach to the action, not the model.

An agent that acts across systems with reduced human intervention crosses into Annex III high‑risk territory faster than the model that serves it. The deployer, not the model vendor, carries the compliance obligation. Read more on what AI governance requires in production.

  • Article 9 · Risk management

    Continuous risk management across the agent's lifecycle, not a one-time assessment before launch. Each new tool or permission an agent gains reopens the assessment.

  • Article 12 / 19 · Traceability

    Which agent acted, under whose authorisation, on which data. A model API does not log this for a multi-step task. The containment layer around the agent does.

  • Article 14 · Human oversight

    Oversight scoped by task risk, not blanket approval on every step. A named person can review, override or stop the agent before a consequential action ships.

One agent action, as the trail records it.

Run the example to follow an agent request through policy, human decision and record. Press KILLSWITCH by Hikari Blue to see the stop path instead: the agent is halted, the payment is not released, and the halt itself is recorded.

Execution traceOne governed decision through the 4 planes

Illustrative simulation. Example data, audit record format of Reference Architecture v1.0.

  1. RequestAgent requests: approve vendor payment above threshold
  2. PolicyPolicy P-04 v3 applied · human approval required above threshold
  3. DecisionA. Moreau, treasury operator, approved
  4. RecordRecord #4127 · hash linked to #4126 · exportable
Example, fictional data. A simulation, not the proof of a halt at a client.

Our newsroom tracks the enforcement timeline and the shift it forces. Govern the action, not the model The agent no one owns

The 3 properties

What qualifies a governed agent.

The same 3 properties that qualify our operating layer are the test we apply to every agent before it reaches production. Each one is architectural: it cannot be added later as a feature.

  • Identity by architecture

    Every agent carries a verifiable identity and least-privilege permissions, assigned before production, not discovered in an incident review. No agent acts under a shared credential.

  • Containment by architecture

    A kill switch at the infrastructure layer, without needing the agent's cooperation. Containment does not depend on the agent behaving.

  • Audit by architecture

    Every action written to an append-only record at the moment it happens. The evidence a regulator accepts, not documentation reconstructed after the fact once an incident forces the question.

The human, the agent and the Control plane between them.

Identity is a row in the agent register. Containment is the stop path. Oversight is a named person at an approval gate. All three sit on the Control plane, not inside the agent.

A named approver, the Control plane with agent register and kill switch, and the agent below.A named person approves each consequential action before it runs.The same person can stop the agent from the control plane.
  1. Ungoverned zoneA pilot or tool running with no owner, no record and no stop.
  2. Agent register and permission matrixEvery agent has its own identity and only the access its task requires.
  3. Named human approverA named person whose decision is part of the record.
  4. Human oversightThe person can approve the system’s actions and stop it.
  5. Approval gateThe operation waits for a named person’s decision before it proceeds.
  6. AgentThe software agent acts within its declared scope; the stop reaches it directly.
  7. Stop pathHeld by the control plane: halt, throttle or roll back the agent.
Text version
  1. A named human approver sits on the left of the figure; a human oversight link runs from this person down to a bar, and an approval gate sits on it: the operation waits for a named human decision.
  2. On the Control plane, the agent register lists every agent under its own identity and the permission matrix declares what each one may touch.
  3. The agent runs on the plane below, within its declared scope. The stop path leaves the Control plane and ends at the agent: halt, throttle, roll back.
  4. A dashed frame marks a named zone with no governance around it, such as a pilot.
The control plane stands between the person and the agent. Source: Reference Architecture v1.0, example data.

The reference architecture behind identity, containment and audit is published. See the Engineering page See the operating layer these properties come from

Where it sits

The workload, and the layer that makes it defensible.

Agentic AI is the workload: autonomous action across systems. The AI operating layer is what makes that workload defensible, policy per task, audit trail per action, kill switch as architecture. One runs on top of the other, never instead of it.

  • The workload

    An agent that plans, calls tools and acts across systems. It is judged on what it does, not on how well it demos.

  • The layer underneath

    The software and operating discipline between the model and the workflow. It decides which agent may act, and records that it did.

To put agents to work across your business, with the result measured on your operations: Enterprise AI Agents

See how the practices behind this work engage. How we operate What is an AI operating layer

To run agentic AI in production: AI‑Enabled Operations, delivered by an on-site AI pod. For private equity funds: the Portfolio AI Program.

Direct answers

The questions senior buyers actually ask.

What is agentic AI, in practice?

Software that plans multi-step tasks, calls tools and acts across systems with reduced human intervention per step, not a chatbot answering one question. Every action needs an identity, a policy and an audit record, or it is a demo, not a production agent.

How is agentic AI different from an AI operating layer?

Agentic AI is a class of workload: autonomous action across systems. The AI operating layer is the governance, audit and runtime that makes that workload defensible: policy per task, audit trail per action, kill switch as architecture. Agentic AI runs on the layer, not instead of it. What is an AI operating layer

Does agentic AI trigger the EU AI Act?

Often, yes. Agents taking consequential actions, credit, hiring, clinical, critical infrastructure, meet the Article 6 high‑risk conditions under Annex III, applicable from December 2, 2027 after the Digital Omnibus deferral. Article 50 transparency duties apply since August 2, 2026; general-purpose model obligations since August 2, 2025, under Commission enforcement since August 2, 2026. In our reading, the deployer carries the operational compliance obligation, not the model provider. We map your agents to risk tier before anything reaches production. See what AI governance requires

What happens when an agent fails or acts wrong?

It stops. Containment operates at the infrastructure layer, without needing the agent's cooperation. Every action up to that point sits in the append-only audit trail, so the incident review starts from evidence, not reconstruction.

For boards, CIOs and risk officers

See agentic AI against your own workflows.

30 minutes with a named partner. We map one agentic workflow you already run to the audit trail a regulator would ask for. You leave with the diagram, whether or not we ever work together.

  • One agentic workflow you already run
  • The audit trail a regulator would ask for
  • A diagram you keep, whether or not we work together
Book a 30‑min call Or see Hikari Blue Ops, the product side of the layer