ISMS

Agent governance is maturing fast — budgets, allowlists, custodians, sign-off. The human directing those agents has none of it. Three gaps keep coming up: no guidance on how many pieces of AI-assisted work one person can hold, access decided in seconds mid-task with the approved scope six weeks behind them, and initiatives that no approval process ever declares finished. All three come back to one question — where the context between AI sessions actually lives — and per-project instruction files do not answer it.

Somebody on your team has started using AI agents, the governance question just landed in your lap, and the auditor will ask in nine months. The reflex is to hire an ‘AI governance consultancy.’ I want to argue the opposite: if you already run a serious ISO 27001 or 22301 programme, you hold the unfair advantage. Five lessons from running an on-prem agent lab, each mapped onto controls you already operate.