Agentic AI: governance, security and guardrails
Putting AI agents into production in IT without losing control of what they do.
Why in 2026AI agents are leaving the pilot stage: they read data, call tools and act. The question is no longer "does it work?" but "who controls it, who is accountable, and how do we prove it".
Objectives
- Tell assistants, copilots and autonomous agents apart, and choose the right level of autonomy per use case.
- Map the risks specific to agents: prompt injection, data leakage, unintended actions, costs.
- Design guardrails: scope of action, identities and permissions, human sign-off, logging.
- Measure the value and reliability of an agent in production.
Programme
Day 1 · Understand and frame
- Use cases in IT: monitoring, incidents, compliance, reporting, documentation, code
- Anatomy of an agent: model, tools, memory, orchestration
- Risks and threats: prompt injection, exfiltration, model supply chain
- Agent charter: what they may do alone, what requires a human
Day 2 · Go to production
- Identities, secrets and least privilege for agents
- Calculations in code, decisions with people: where determinism belongs
- Agent observability: traces, costs, error rates, drift
- Demonstration: the service level chain automated end to end
Hands-on work
- Mapping your team's automatable tasks and the target level of autonomy
- Writing the charter of an agent for one of your processes
- Risk analysis of an existing or planned agent
What you take away
- AI agent usage charter
- Risk analysis grid
- Automation roadmap