Agentic governance without slowing the program down

Loose: every team launches its own agent, no one knows which data they touch, and the first audit creates a six-month freeze. Heavy: a 40-page framework, a fortnightly review board, and a delivery team that quietly stops asking for approval.

Both end in the same place — a stalled program and a board asking what happened to the AI strategy.

Accountable executive — the line leader whose P&L the agent moves. Owns the decision to ship.

Data steward — owns the data scope the agent touches and confirms it's allowed for that purpose.

Risk reviewer — single named person from legal/risk who signs the risk register entry. Not a committee.

Scope gate (week one): use case, data scope, success metric, risk class — one page, approved by the three roles. No engineering until this is signed.

Pre-launch gate (before production): test results against the success metric, controls in place, kill-switch defined. Same three roles sign.

30-day review: did the metric move, did any control fire, expand or descope. Same three roles.

A single agent register lists every agent in production, owner, data scope, last review date, and risk class. If you can't render it in one screen, the program has scaled past your governance.