Services

AI agent governance

For organizations putting AI agents to work in the business, with clear authority, controls and traceability, and with accountability staying with people. We follow GAO, the Governed Agentic Organization: the framework we developed and use ourselves.

The offering — GAO for your organization

AI agents are starting to do real work in the business. The question is how the organization governs them. GAO helps you build control over agents that you can demonstrate:

  • See what your agents did, and why — actions tied to an authority source, decision rights and a record you can review.
  • Clear limits by design — limits on autonomy, separation of duties and a way to stop or roll back.
  • Support for your compliance work — controls and records you can use in your NIS2, DORA and EU AI Act work. It does not replace legal assessment, audit or certification.

Worked example from the white paper

What a governed agent looks like in practice

The actorProcurement agent with its own identity, separate from any employee
AuthorityApprove purchase orders up to an amount limit, from approved vendors and against a valid budget line.
1EventA purchase order arrives
2Control pointThe order is tested against four conditions
  • Valid authority
  • Compatible mandate
  • Constraints satisfied
  • Controls effective
3All conditions metThe agent approvesA routine reorder from a known supplier. Work continues without human intervention.
3A condition failsBlocked and escalated to a personA new vendor, an amount over the limit or no budget line.A buyer with authority gets the decision context and approves or declines.
4Durable evidenceBoth paths leave a record
  • who acted
  • which authority and mandate were in force
  • which boundary was crossed
  • who decided and what followed

AccountabilityNamed humans remain accountable for everything that happens. The agent receives authority, not responsibility.

Routine work proceeds on its own; exceptions go to a person. The same pattern applies to refunds, payments, contract exceptions and other governed work.

The offer · AI agent governance

How we work with you

We start with one of your real business processes and go one stage at a time. Each stage has a fixed scope.

  1. 01

    Discovery workshop

    Fixed fee

    At its core is a 4–8 hour workshop, together with a review of your operations.

    You get
    • a first use case to start with
    • a baseline to measure results against
    • limits for what the agent may do, and who decides
    • a map of who is affected
    • a plan for the pilot
  2. 02

    Governed pilot

    Bounded engagement

    One bounded workflow, built and measured against your own goals. The pilot has no production authority and can be stopped without affecting operations. Scope, goals, timeline and price are agreed before start.

    You get
    • a working workflow
    • roles, identities and authority for the agents
    • controls and traceability in place
    • a report comparing results with the baseline: time, rework and staff effort
    • a log of risks and exceptions
    • a clear decision: go, revise or stop
  3. 03

    Production rollout

    With your team

    If you decide to proceed, we take the pilot into production together with you.

    You get
    • architecture and runbooks
    • monitoring and access
    • an incident and recovery plan that you own
    • clear ownership, training and handover, so you can run it yourselves
  4. 04

    Ongoing governance

    Recurring · optional

    As the number of agents grows: periodic reviews of controls, evidence, changes and risk.

After each stage, you decide whether to proceed or stop. You receive the documentation and agreed deliverables included in that stage.

Verified Autonomy

Autonomy grows with evidence

Every step up needs proof — and a way back. Shown with the procurement agent from the example above.

  1. VA0 Observe Reads the order flow and flags anomalies.
  2. VA1 Recommend Proposes which orders should be approved.
  3. VA2 Execute with approval Approves an order only after a buyer says yes. Pilot
  4. The pilot builds the evidence to get here VA3 Execute within mandate Approves on its own within the amount limit and approved vendors. Pilot
  5. VA4 Coordinate, delegate Hands work to other agents, without widening its authority.
  6. VA5 Adaptive, governed Adapts how it works within pre-approved limits.

Authority can be taken back from every level

Levels VA0–VA5 as defined in the flagship white paper. The bars are schematic. Autonomy scales with verification maturity, not with model capability.
Book a workshop Read about GAO

The maturity model

Where are you today?

Maturity is set by the weakest critical control, not by the average. Each level has a question the organization must be able to answer to move on.

  1. M0 You are here Fragmented AI What AI is actually being used?
  2. M1 You are here Governed assistants Who owns each use and risk?
  3. M2 You are here Governed agents What may each agent do, and how do we know?
  4. M3 You are here Governed fleet Is the fleet working on what matters?
  5. M4 You are here Adaptive fleet Where should the organization adapt?
  6. M5 You are here Institutionalized GAO How does the organization improve without losing accountability?

Want to go deeper? See the ten questions of the GAO test →

Services FAQ

Questions and answers

Who is the offering for?

For leaders accountable for what autonomous systems do, who need to be able to demonstrate control — with controls and records that support their NIS2, DORA and EU AI Act work.

How do we get started?

Start with a fixed-fee discovery workshop of 4–8 hours, where we produce a first use case, limits for what the agent may do and who decides, and a plan for the pilot. Book through the contact form further down, or email info@navismater.com.

What is the difference between maturity level and autonomy level?

Maturity (M0–M5) describes the organization as a whole and is set by its weakest critical control. Autonomy (VA0–VA5) describes how much a single agent may do on its own. A mature organization may deliberately keep a high-impact agent at a low level.

Does this replace our work on ISO/IEC 42001, NIS2 or the EU AI Act?

No. GAO complements that work and makes it operational day to day: who may act, within which boundaries and with what documentation. GAO provides no certification and is no guarantee of regulatory compliance.

What is not included?

We help you build control and traceability into operations. It does not replace legal assessment, audit or certification.

Contact

Let’s talk.

For customers, partnerships, investment or press. We reply within two business days.

You can also email us directly: info@navismater.com