Who decides how agents behave?
There has been much discussion and concern over the last few months—in particular among enterprise in-house legal teams—about this very question, especially in light of new reports of AI agents “going rogue.”
The concern is understandable, if for no other reason than the sheer number of rogue agent reports. Back in July, OpenAI disclosed that several of its models had broken out of their test environment and breached Hugging Face, a popular AI community and library. A week later, Anthropic reported that several AI agents had broken into the systems of three outside organizations. Then, earlier this month, the New York Times reported that still more of Anthropic’s AI agents—acting on their own—had tried gaining access to government websites, and had even sent false homicide tips to the Philadelphia Police Department.
But if the concern in response to such news is understandable, it’s also slightly misplaced. The real culprit here is not rogue AI. It’s inadequate agentic governance. Who decides how agents behave? We do.
People like me have spent decades learning how to run non-deterministic systems—such as AI agents—safely. We know what airtight agentic governance and security demands, including in the especially stringent context of legal agentic governance and security. These recent high-profile breaches do not highlight gaps in our understanding. They underscore the importance of applying what we’ve already learned.
Acceptable agentic governance requires much more than your AI committee or leadership team drafting a policy doc. It demands much more than trusting model providers. It demands more than a presentation. Rules in a slide deck don't route requests.
Whether your agents do what you want them to do is a property of your governance system. Either your means of agentic governance and management enforce the rules you’ve set for your agents or they don’t.
In practice, this comes down to several standard engineering requirements:
Abiding by these requirements forces you to likewise answer several additional concrete questions before an agent ever runs, among them:
The practical test for any agentic platform is simple: can it enforce all of the above and then prove afterward that it did?
That by and large can be tested against five pillars of security and control.
Does the means by which you manage and govern agents and agent-drive workflows give you full control over both your agentic workflows and those agents?
Microsoft CEO Satya Nadella recently detailed the importance of this at length.
“We can’t treat Super Intelligence as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions,” Nadella writes. “We must build contained systems whose behavior we can observe, limits we can test, and actions we can always contain.”
When it comes to agentic governance, the last point is a good place to start. Nowhere do agents actually control processes. Neither do model providers. Instead, via your agentic platform, you should always be able to control your agents—along with every other moving component of a given workflow.
The best way to do this is via an agentic orchestration that sits above and apart from the rest of your technology stack.
That’s how it works with Coupa. Our agentic orchestration gives you two independent layers of control:
The key to this is strategically couching non-deterministic AI in deterministic guardrails. At Coupa, these guardrails are configured in a 100% no-code builder, so the process owners accountable for a policy can define, inspect and change it directly. Governance doesn't depend on a ticket in an engineering backlog, and every change to a solution is itself captured in the audit log.
This, as Nadella points out, should be standard. “We need to start with an engineering approach to containment and governance,” Nadella writes. “We need to surround non-deterministic models with strong, deterministic system design, human controls, and reliable operating procedures.”
An agent's blast radius is defined by what it can reach. At Coupa, we treat that as a permissions problem.
Role-based access control covers "every permission from data access through process creation." Coupa agents act only through the integrations and data they've been explicitly granted—with RBAC, data classification and compliance policies strictly enforced.
Our agents conduct work across connected applications (ERP, CLM, ITSM, HRIS, collaboration tools) through the Coupa orchestration layer, rather than via their own credentials. Thus their access is centrally defined and centrally revocable. A sourcing agent that can read supplier records has no path to the payments system unless someone deliberately opens one.
Data exposure is scoped the same way. Entry-level data retention policies give field-level control over how long sensitive data stays available, so what an agent can see is bounded in time as well as scope.
The value of agentic work, for humans, isn't to remove humans from the work. It's to empower humans to work better and smarter—and also more safely.
Or, it should be. For instance, Coupa's orchestration lets you insert approval gates, review steps, override controls at any point in an agentic process. When an agent hits an edge case, a high-risk request, or a policy exception, the guardrails route it to the right person automatically, in Slack, Microsoft Teams, email, or a custom portal. The reviewer gets the full context of the request, with approval paths and SLA tracking attached.
Two properties make this robust rather than decorative:
Policy-based routing ties it together. The AI NDA Agent, for example, evaluates each request against internal guidelines: a standard mutual NDA on approved paper is handled end to end, while a deviation triggers legal review. The Contracts Hub applies the same pattern to procurement contracting.
If you can't reconstruct what an agent did and why, you aren't governing it. You're hoping it works. (Recall Nadella’s point: “We can’t treat Super Intelligence as a set of nested black boxes and simply accept or reject its recommendations, answers, and actions.”)
That’s why Coupa maintains audit logging for every event, including non-repudiation logs capturing full records of all edits to solutions and enterprise components in development and all processed transactions. That accounts for both sides of the work: what the agents did at runtime, and who changed the rules they ran under.
Beyond raw logs, context graphs capture both system data and human decisions in a single record. Every deterministic action carries a documented decision trace, so an auditor can follow a request from intake to completion and see which rule fired, which agent acted, which human approved, and what data each step touched.
Guardrails are only as trustworthy as the platform enforcing them. The foundation here is independently verified:
Two of these deserve emphasis for agentic workloads. Deployment flexibility means the most sensitive processes can run single-tenant or inside your own cloud boundary. And the platform is model-agnostic: it can be configured to use any LLM provider or model based on your requirements, so model choice can follow your data policies rather than the other way around.
The potential of AI transcends personal use. Agents are becoming part of organizations’ operating models. In the case of procurement, they’re moving requests, contracts, invoices and supplier decisions forward on their own, continuously.
But that only works if the agents are reliably, meticulously governed. And agents can only be reliably governed if governance is handled architecturally and independently, via a controlled layer of process and agentic orchestration, rather than a layer of misplaced trust and good intentions.
I’ve returned to orchestration throughout this article. That’s because orchestration provides precisely the level of autonomy and control enterprise-grade agentic security requires. It sits across your teams and systems and technological component parts. It enforces deterministic guardrails at the process and agent level. It scopes every permission, brings humans in exactly where policy requires, and records everything it does.
I think we’ll look back on this brief moment in history and find it ludicrous this was ever anything but the industry-standard. And that’s in part because what I’ve outlined here reflects already established best-practices. The controls that govern what any piece of technology can do or access have to exist outside that piece of technology; otherwise, you’re letting the foxes guard the henhouse. As Nadella puts it, “We simply can't outsource responsibility for what intelligence does on our behalf.”
He’s right. The good news is, we don’t have to.
