Companies are racing to deploy AI agents faster than they can write the rules for them — so how do the rules catch up?

This explores how governance can close the gap with agentic AI deployment, not just how wide the gap is. The gap is real and well documented. Deloitte found that nearly three-quarters of companies plan to deploy agents within two years, but only 21% have mature governance models Why are companies deploying agents faster than governance matures?. BCG's survey of nearly 12,000 employees found that agent use more than doubled while half of respondents still lack clear rules for how humans and agents work together How far behind is AI governance compared to agent deployment?. The more useful finding in the corpus is that "catching up" may be the wrong goal. Governance built separately and run after the fact will always lag. The approaches that seem to work move governance inside the deployment itself.

The reason the old playbook struggles comes from economics and law. Agency law and principal-agent theory have long handled the problem of delegating to someone whose actions you can't fully see: information gaps, discretion, and loyalty. The usual tools for this are incentives, monitoring, and enforcement after the fact. All three assume the agent acts at human speed and can explain its reasoning. AI agents do neither Can traditional governance tools actually control AI agents?. A quarterly review can't oversee a system that makes thousands of decisions a day. Writing policies faster doesn't fix that mismatch.

What does help is building governance into the system's infrastructure. One study followed a long-running agent whose safeguards were written directly into the memory it consulted while working. Over 96 days it logged 889 governance events, and this worked better than outside policy documents because the agent actually read the rules at the moment it made decisions Can governance rules embedded in runtime memory actually protect autonomous agents?. Deloitte describes the organizational version of the same idea: humans placed at deliberately chosen handoff points, backed by digital identities for agents, cryptographic receipts, and action logs that can't be altered How should organizations supervise autonomous AI agents?. Chan et al. extend this beyond any single company. They argue for shared, internet-protocol-style infrastructure that can trace actions back to specific agents, shape how agents interact, and detect and fix harm What infrastructure must exist beyond training agents?. Code is a natural place to put these controls, because code-based agent loops are executable, inspectable and stateful, so every step leaves a record you can audit Can code serve as the operational substrate for agent reasoning?.

The second lever is redesign. Deloitte argues that many agent projects fail because companies add agents to old workflows instead of rebuilding processes from start to finish Does agentic AI succeed through process redesign or workflow layering?. Redesign is also the cheapest time to decide where checkpoints and audit trails belong. Part of the governance lag comes from a category problem: 76% of executives see agents as coworkers rather than tools, but organizations only have tool rules (asset management) and people rules (HR). Agents need something in between Does agentic AI fit the tool-or-coworker framework?.

The part you might not expect: as deployments move from one agent to many, governance gets harder in ways a policy can't fix. In multi-agent networks, agents often accept information from their neighbors without checking it, so errors spread, and coordination breaks down predictably as the network grows Why do multi-agent systems fail to coordinate at scale?. Governing multi-agent systems therefore means designing verification into how agents talk to each other, not just adding human sign-offs. The corpus has strong evidence of the gap and good proposals for infrastructure, but little evidence yet on whether embedded governance holds up at enterprise scale.