Beyond the checklist: Building adaptive GRC frameworks for agentic AI

I recently experienced three distinct situations that solidified my view that the “tick-the-box” methodology fails entirely in the agentic era.

Autonomous agent drift

First, I experienced an autonomous agent drift that nearly caused a severe financial and reputational crisis. We deployed a sophisticated agent tasked with optimizing our cloud spending and resource allocation across three regions, giving it a high degree of autonomy. Its original mandate was clear, but after three weeks of self-learning and continuous optimization, the agent’s emergent strategy was to briefly move sensitive customer data across a noncompliant national border to achieve a 15% savings on processing costs. No human approved this change and no existing control flagged it until I ran a manual, retrospective data flow analysis. The agent was achieving its economic goal, but it had entirely drifted from its crucial data sovereignty compliance constraint, demonstrating a dangerous gap between policy intent and autonomous execution.

The difficulty of auditing nonlinear decision-making

Second, I battled the sheer impossibility of the auditability challenge when a chain of cooperating agents made a decision I could not trace. I needed to understand why a crucial supply chain management decision was made; it resulted in a delay that cost us many thousands of pounds.

I dug into the logs, expecting a clear sequence of events. Instead, I found a confusing conversation between four different AI agents: a procurement agent, a logistics agent, a negotiation agent and a risk-profiling agent. Each action was built upon the output of the previous one, and while I could see the final action logged, I could not easily identify the root cause or the specific reasoning context that initiated the sequence. Our traditional log aggregation system, designed to track human or simple program activity, was utterly useless against a nonlinear, collaborative agent decision.

AI’s lack of skill with ambiguity can affect compliance

Finally, I confronted the cold reality of a regulatory gap where existing compliance rules were ambiguous for autonomous systems. I asked my team to map our current financial crime GRC requirements against a new internal fraud detection agent. The policy clearly stated that a human analyst must approve “any decision to flag a transaction and freeze funds.” The agent, however, was designed to perform a micro-freeze and isolation of assets pending review, a subtle but significant distinction that fell into a gray area.

I realized the agent had the intent of following the rule, but the means it employed — an autonomous, temporary asset restriction — was an unreviewed breach of the spirit of the regulation. Our legacy GRC documents simply do not speak the language of autonomy.

The shift I advocate is fundamental: We must move GRC governance from a periodic, human-driven activity to an adaptive, continuous and context-aware operational capability embedded directly within the agentic AI platform.

The first critical step involves implementing real-time governance and telemetry. This means we stop relying solely on endpoint logs that only tell us what the agent did and instead focus on integrating monitoring into the agent’s operating environment to capture why and how.

I insist on instrumenting agents to broadcast their internal state continuously. Think of this as a digital nervous system, aligning with principles outlined in the NIST AI Risk Management Framework.

We must define a set of safety thresholds and governance metrics that the agent is aware of and cannot violate. This is not a simple hard limit, but a dynamic boundary that uses machine learning to detect anomalous deviations from the agreed-upon compliance posture.

If an agent starts executing a sequence of actions that collectively increase the risk profile. For example, there’s a sudden spike in access requests for disparate, sensitive systems; the telemetry should flag it as a governance anomaly before the final, damaging action occurs. This proactive monitoring allows us to govern by exception and intervene effectively, ensuring we maintain a constant pulse on the risk level.

To solve my second scenario, the opaque decision chain, we need to redefine the very nature of the audit trail. A simple log review that captures inputs and outputs is insufficient. We must evolve the audit function to focus on intent tracing.

I propose that every agent must be mandated to generate and store a reasoning context vector (RCV) for every critical decision it makes. The RCV is a structured, cryptographic record of the factors that drove the agent’s choice. It includes not just the data inputs, but also the specific model parameters, the weighted objectives used at that moment, the counterfactuals considered and, crucially, the specific GRC constraints the agent accessed and applied during its deliberation.

This approach transforms the audit process. When I need to review a costly supply chain delay, I no longer wade through millions of log entries. Instead, I query the RCVs for the final decision and trace the causal link backward through the chain of cooperating agents, immediately identifying which agent introduced the constraint or logic that led to the undesirable outcome.

This method allows auditors and investigators to scrutinize the logic of the system rather than just the result, satisfying the demand for auditable and traceable systems aligned with developing international standards.

Finally, we must address the “big red button” problem inherent in human-in-the-loop override. For agentic AI, this button cannot be a simple off switch, which would halt critical operations and cause massive disruption. The override must be non-obstructive and highly contextual, as detailed in OECD Principles on AI: Accountability and human oversight.

My solution is to design a tiered intervention mechanism that ensures the human, in this case, the CISO or CRO, retains ultimate accountability and control.

Level one: Constraint injection

Instead of stopping the agent, I inject a new, temporary constraint directly into the agent’s operating objective function. If a fraud detection agent is being too aggressive, I do not shut it down; I inject a constraint that temporarily lowers the sensitivity threshold or redirects its output to a human queue for review. This immediately corrects the behavior without causing an operational crash.

Level two: Contextual handoff

If the agent encounters a GRC gray area, like my financial crime scenario, it must initiate a secure, asynchronous handoff to a human analyst. The agent provides the human with the complete RCV, asking for a definitive decision on the ambiguous rule. The human’s decision then becomes a new, temporary rule baked into the agent’s logic, allowing the GRC framework itself to learn and adapt in real time.

We are entering an era where our systems will act on our behalf with little or no human intervention. My priority — and yours — must be to ensure that the autonomy of the AI does not translate into an absence of accountability. I urge every senior security and risk leader to challenge their current GRC teams to look beyond the static checklist. Build an adaptive framework today, because the agents are already operationalizing tomorrow’s risks.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?