For decades, systems auditing has rested on an implicit premise: software does what it is programmed to do. Controls are designed on top of that predictability — rules, permissions, approval flows and logs are reviewed, and conclusions are drawn about behaviour that is, in essence, deterministic.

AI agents break that premise. An agent does not execute a predefined flow: it interprets a goal, decides on a sequence of actions and uses real systems — email, repositories, ERPs, internal tools — to carry it out. Behaviour is no longer written in the code; it emerges at runtime.

Where the risk appears

That change of nature produces risks that current control frameworks do not handle well:

  • Effective vs. formal authorisation. An agent with valid credentials can chain individually legitimate actions into an outcome nobody authorised. Classic segregation of duties was not designed for identities that execute thousands of operations per hour.
  • Traceability of reasoning. When an agent concludes and acts, the "why" is not captured in any conventional log. Without a record of the context, the instructions and the tools invoked, there is no auditable evidence.
  • Behavioural drift. The same agent, given the same goal, may act differently after a change of model, prompt or context data. The concept of a "deployed version" blurs.
  • Cognitive supply chain. Models, system prompts, connected tools and context sources are critical dependencies — each with its own change cycle, often outside the organisation's perimeter.

The audit question stops being "does the system do what the design says?" and becomes "what could it do, and how would we know?".

A starting point for the auditor

There is no need to wait for a definitive regulatory framework to begin. Three concrete fronts:

  1. Inventory. Know which agents operate in the organisation, with which credentials, over which systems and under whose responsibility. Today, in most organisations, this list does not exist.
  2. Verifiable limits. Action budgets, allowed-tool lists, human approval for irreversible operations — and evidence that those limits are enforced technically, not just stated in a policy.
  3. Audit-proof records. Context, decisions and actions of every run, retained and protected like any other critical record.

The profession has absorbed changes of this scale before — computerisation, the cloud, mass data. The difference is speed: agents are being deployed in months, not decades. The time to build the risk map is now, while the inventory still fits on a single page.