Perspective
From automation to agency: what actually changes
Traditional automation follows a script. It is fast and predictable, but it breaks when inputs vary or a decision needs judgment. AI agents work from a goal instead of a script: they interpret context, choose the next step and use tools to complete it.
That does not make rules-based automation obsolete. The most effective solutions combine both:
- Deterministic steps for calculations, postings and anything with a single correct answer.
- Agent steps for reading unstructured content, handling exceptions and deciding between options.
- Human steps for approvals, sensitive decisions and accountability.
A good test for an agent use case: the work crosses several systems, the inputs vary, and today a skilled person spends most of the time gathering information rather than deciding.
Guide
Governing AI agents in regulated organizations
When software can act on its own, governance has to cover actions as well as answers. We recommend a control framework built on five questions for every agent:
- Identity: under which identity does the agent act, and with which permissions?
- Autonomy: which actions may it take alone, and which require approval?
- Data: which data may it read, where is it processed, and how is personal data protected under PDPL?
- Evidence: is every prompt, tool call and decision logged for audit?
- Quality: how is accuracy measured before release and monitored in production?
Aligning these controls with existing frameworks, such as NCA Essential Cybersecurity Controls, ISO 27001 and ISO/IEC 42001, keeps AI inside the governance model your organization already runs.
Playbook
Your first 90 days with agentic AI
Many organizations run AI pilots that never reach production. A focused first 90 days avoids that:
- Days 1–20: select three use cases with clear owners, measurable baselines and accessible data.
- Days 20–60: build one proof of value on real data, with security and integration designed in from the start.
- Days 60–90: measure results, decide on scale-up, and set up the shared platform and governance the next use cases will reuse.
The goal is not one impressive demo. It is a repeatable way to deliver agentic solutions safely.
