AI Governance Capability
AI Agent Governance
AI agents introduce a different risk profile from static models. They invoke tools, access APIs, read and write data, and take actions across connected systems, often without a human in the approval loop.
That combination creates three governance gaps that model governance programs alone cannot close:
- Undeclared agents operating outside formal intake processes
- Unchecked runtime behavior that diverges from approved scope without triggering alerts
- Audit evidence scattered across disconnected platform logs rather than tied to a governance record
OneTrust AI Agent Governance gives security and governance teams clear control over what each agent is permitted to do, continuous oversight of what it is actually doing, and audit-ready evidence of how it was governed at every stage.
Govern AI Agents From Registration Through Runtime
OneTrust brings together agent registration and scope definition, permission enforcement, continuous runtime monitoring with Guardian Agents, inline data protection, multi-agent handoff governance, and automated revalidation so organizations can expand agentic AI without losing control of what agents do in production.
Discover and Register AI Agents
Most organizations cannot answer a basic question about their agentic AI: what agents are running, who owns them, and what they approved to do.
Formal intake catches the agents built through official processes. It misses the agents developed by product teams, the autonomous copilots enabled in third-party SaaS, and the agents that were approved for one use case and quietly expanded into another.
OneTrust brings agent discovery into the same inventory used to govern models, datasets, and AI use cases. Each agent is registered as a structured record that captures its intended purpose, the tools and APIs it is permitted to invoke, the data sources it can access, its deployment environment, and the owner accountable for its behavior. That record is the governance anchor the agent carries throughout its lifecycle.
Discovery does not rely on self-reporting alone. OneTrust AI Discovery and Registry surfaces undeclared agents through integrations with cloud environments and supported AI platforms, so the registry reflects what is actually deployed, not only what teams formally submitted. Newly discovered agents that lack a registration record route directly into a governance workflow for assessment and approval before they are permitted to continue operating.
Because every registered agent carries a defined scope, governance teams have a baseline to measure production behavior against. If an agent acts outside its registered purpose, that deviation surfaces as a policy violation, not a surprise found during an audit.
Enforce Agent Permissions and Allowed Actions
Defining what an agent is permitted to do is not the same as enforcing it. An agent registered to summarize internal documents may, without enforcement, access customer data, invoke payment APIs, or write to systems it was never approved to touch. Those gaps between documented intent and runtime behavior are where agentic AI risk originates.
OneTrust connects agent registration records to permission enforcement so that the scope defined at intake becomes a technical boundary the agent cannot silently cross. The enforcement model works like this:
- Policy objects capture permitted tools, approved data sources, and allowed action types as structured records attached to the agent's registration.
- Runtime enforcement applies those policy objects at the point of action. When an agent attempts something outside its boundaries, OneTrust blocks, escalates, or routes the request based on the applicable policy, before the action completes.
- Policy updates propagate automatically. When the policy record changes, the enforcement boundary changes with it. There is no manual step to synchronize documentation with controls.
- Policy exceptions are tracked. Any deviation from standard scope requires an accountable owner, an expiration date, and a documented rationale, so exceptions are visible to the governance team rather than implicit in the platform configuration.
The result is an audit trail that shows not just that a boundary existed, but that it was actively enforced, what actions were permitted and blocked, and how the policy applied to each agent across its production history. That evidence is what separates a governed agent from one that was only reviewed at intake.
Monitor Agent Behavior With Guardian Agents
Approved scope tells you what an agent was supposed to do. Guardian Agents show you what each agent is actually doing.
Guardian Agents provide continuous runtime oversight of agent activity across supported production environments. They monitor which tools each agent invokes, what data it accesses, how it behaves relative to its registered scope, and whether its actions cross a policy boundary. When behavior diverges from the approved use case, Guardian Agents surface the violation with the context needed to investigate, remediate, and update the governance record.
Monitoring covers agents running across Amazon Bedrock and AgentCore, Microsoft Azure AI Foundry, Databricks, and the Gemini Enterprise Agent Platform. Platform-specific signals including evaluation metrics, usage telemetry, guardrail status, and interaction log data are ingested and organized by agent, so teams can review production behavior at the system level rather than piecing together logs from separate environments.
The value of continuous monitoring is clearest in agentic systems because agents change behavior based on input, context, and the tools they have access to. Model behavior is typically assessed around defined updates, while agent behavior can change from session to session. An agent running in a dynamic environment can behave differently across every session. Guardian Agents keep governance current with what is happening in production, not just with what was approved six months ago.
Violations surface in the OneTrust AI Program Center with actionable remediation steps, policy context, and the agent's governance record. Teams can respond to a detected issue without manually reconstructing what the agent was approved to do, what it actually did, and what the applicable policy requires.
Protect Data Flowing Through Agent Workflows
Agents create a data exposure problem that static models do not. A single agent invocation can pull from a retrieval system, compose a prompt from internal data, call an external API, and write a response, all within a single session. Each step is an opportunity for proprietary data, PII, or confidential business information to reach a destination it was never approved to reach.
The OneTrust AI Guard SDK brings classification-based data protection into agent workflows using a Python SDK that integrates directly into the AI application layer. It inspects prompts and responses in real time, before the model processes the input or the output reaches a downstream system, and applies configured actions based on what it finds.
When the SDK detects sensitive data in a prompt, it can block the request, redact the sensitive content and allow the sanitized version to proceed, or escalate based on the applicable data policy. The same logic applies to model outputs before they are returned to users or written to connected systems. This means enforcement happens inline, not as a post-hoc review of what the model already processed.
Detection results and enforcement actions are measured and reported through OneTrust AI Governance. Teams can see which agents are triggering detections, what data types are appearing, how often content is being blocked or redacted, and whether detection rates are changing over time. That data feeds into both the agent's governance record and broader program reporting, so data protection in agent workflows is visible to security and governance leadership, not just to the engineers who built the integration.
The AI Guard SDK also supports validation during development, not only at runtime. Teams can use it to test agent workflows against data policies before deployment, reducing the likelihood of a data exposure issue reaching production.
Govern Multi-Agent Systems and Delegated Actions
As agentic AI matures, agents increasingly work in coordination. An orchestrator agent delegates tasks to specialized sub-agents. A research agent hands a synthesized output to a writing agent. A customer service agent escalates to an agent with elevated data access. Each handoff is a point where scope, permissions, and accountability can break down if governance does not extend across the full chain.
OneTrust extends governance across multi-agent systems through three mechanisms:
- Delegated action tracking. When an agent delegates to another agent, the delegating scope, the receiving agent's registered permissions, and the action taken are captured in the audit trail. Governance does not stop at the boundary of the first agent in the chain.
- Per-agent permission boundaries. Each agent in a multi-agent system carries its own registration record, its own policy object, and its own permission boundaries. A sub-agent cannot exceed its own registered scope even when instructed to by an orchestrating agent. The receiving agent's permissions govern what it can do, not the permissions of the agent that delegated to it.
- MCP governance. In Model Context Protocol (MCP)-enabled environments, OneTrust controls which tools each agent is permitted to invoke through the protocol layer, what data it can access, and how those permissions are documented for audit purposes. Tool-level actions made through MCP carry the same governance record as other permitted actions in the agent's audit trail, so MCP-connected environments are governed through the same program as the rest of the AI portfolio rather than managed separately in engineering tooling.
Revalidate As Agents Evolve
An agent's governance record reflects its purpose, scope, and approved behavior at the point of assessment. Agents change. The tools they have access to change. The data sources they retrieve from change. The use cases they are applied to change. A governance record that is not kept current becomes the wrong baseline for enforcement and the wrong evidence for compliance.
OneTrust triggers revalidation when material changes occur in an agent's environment. Changes to connected tools, retrieval sources, or permitted data that fall outside the original scope of the registered agent generate a revalidation requirement, routing the agent back through the appropriate assessment and approval workflow before normal operation resumes.
Revalidation is not a manual process that depends on someone noticing a change. OneTrust monitors the signals that indicate a meaningful change in an agent's operational context and surfaces those as governance events. Teams can define the thresholds that trigger revalidation based on their risk tolerance and the sensitivity of the systems the agent touches.
When revalidation confirms that updated controls have reduced the identified risk, the agent's governance record is updated with the new approved scope, the evidence of the revalidation process, and the accountable approvers. When revalidation finds unresolved risk, the issue escalates to the appropriate governance or security team for decision.
Agent governance is a continuous operating process, not a one-time approval followed by unchecked production operation.
Agent Governance Works With Runtime Controls
Agent Governance and Runtime Controls work as a connected system. Runtime Controls provides the policy-as-code enforcement layer, the live AI inventory, and the telemetry-driven observability that applies across models, agents, and AI applications. Agent Governance extends that foundation with the agent-specific capabilities: structured agent registration, Guardian Agents behavioral monitoring, multi-agent handoff governance, and the revalidation processes that keep the agent's governance record current as its environment changes.
Together they close the gap between written AI policy and the controls that actually govern what agents do in production.
OneTrust Named a Visionary in the 2026 Gartner® Magic Quadrant™ for AI Governance Platforms
See why Gartner recognized OneTrust as a Visionary in the inaugural Magic Quadrant for AI Governance Platforms.
Frequently Asked Questions
Guardian Agents provides runtime monitoring across Amazon Bedrock and AgentCore, Microsoft Azure AI Foundry, Databricks, and the Gemini Enterprise Agent Platform. Platform-specific signals including evaluation metrics, usage telemetry, guardrail status, and interaction log data are ingested into OneTrust and organized by agent.
Governance teams see production behavior at the system level rather than piecing together logs from separate platform consoles. Agents running across multiple environments are governed through a single program rather than through separate tools for each deployment platform. New agents discovered through platform integrations that lack a registration record are automatically routed into the governance workflow.
AI models have relatively predictable behavior between updates. An agent running in a dynamic environment can behave differently across every session because it acts on context, invokes tools, and makes decisions in response to inputs that change in real time.
Governing a model means controlling what it outputs. Governing an agent means controlling what it can do, what it can access, and how it behaves relative to its approved scope across every session in production. The governance requirements are also structurally different: agents require permission enforcement at the tool and API level, continuous behavioral monitoring, multi-agent handoff tracking, and automated revalidation when their operational environment changes.
Model governance programs that do not extend to these capabilities leave agentic AI uncontrolled from intake approval onward.
OneTrust translates the scope defined during agent registration into policy objects that govern what the agent can do at runtime. Permitted tools, approved data sources, and allowed action types are codified as structured records attached to the agent's registration record.
When an agent attempts an action outside those boundaries, OneTrust can block the action, escalate it for review, or route it based on the applicable policy, before the action completes. Policy updates apply automatically: when the policy record changes, the enforcement boundary changes with it, with no manual sync step required. Policy exceptions require a documented owner, an expiration date, and a rationale, so deviations from standard scope are tracked rather than invisible.
The full enforcement history—including what was permitted, what was blocked, and which policy version applied—is captured in the agent's audit record. That is the difference between a documented intent and an actively enforced boundary.
OneTrust captures governance evidence as part of normal operations rather than as a reporting exercise run before a review. For each agent, the audit record includes:
The registered scope and approved use case at the time of assessment
The tools and data sources the agent was permitted to access
All permission policy versions applied over the agent's lifecycle
Actions permitted and blocked at runtime, with timestamps and applicable policy context
Policy exceptions with accountable owners and expiration dates
Approvers and documented evidence from each revalidation event
When a material change in the agent's environment triggers revalidation, that process and its outcome are added to the same record. The result is a continuous evidence trail that reflects the agent's full governance history without requiring teams to reconstruct it from separate platform logs ahead of a board review or regulatory inquiry.
The OneTrust AI Guard SDK integrates directly into the AI application layer using Python and inspects prompts and responses in real time, before the model processes the input or the output reaches a downstream system. When the SDK detects PII, proprietary data, or confidential business information, it can block the request, redact the sensitive content and allow a sanitized version to proceed, or escalate based on the applicable data policy. The same logic applies to model outputs before they are returned to users or written to connected systems.
Detection results and enforcement actions are reported through OneTrust AI Governance, so security and governance teams can see which agents are triggering detections, what data types are appearing, and whether detection rates are changing over time. The AI Guard SDK also supports validation during development, so teams can test agent workflows against data policies before deployment rather than discovering data exposure issues in production.
Learn more about our Responsible AI principles.
Agent governance extends the OneTrust AI governance program rather than sitting alongside it as a separate product. Each agent is registered in the same inventory used to govern models, datasets, and AI use cases. Policy enforcement, behavioral monitoring through Guardian Agents, and audit evidence all flow into the OneTrust AI Program Center alongside governance activity from the rest of the portfolio.
That means a security or governance team reviewing the AI program sees agent behavior, model outputs, and data protection enforcement in one place rather than in separate consoles. Agents surfaced by OneTrust AI Discovery and Registry that lack a formal registration record are routed automatically into the governance workflow. The full agent lifecycle, from intake through revalidation, is managed within the same platform used for the rest of the organization's AI governance obligations.
You May Also Like
Govern AI Agents with Confidence
Give your security and governance teams defined control over what each agent is permitted to do, continuous oversight of what it is actually doing, and audit-ready evidence of how it was governed at every stage.