We spend a great deal of time talking about what AI can do for us. But what about AI governance?

Governance may not be the part of the AI conversation that earns headlines or sparks debate, but it is the part of the conversation that determines whether an organization can trust AI with its data, decisions and business processes.

Increasingly, governance is also a fixture among companies getting the strongest financial results from AI. PwC’s 2026 AI Performance Study found that these companies were 1.7 times as likely to have a Responsible AI framework.

Translation: the success of any AI program relies heavily on the governance built around it.

As teams produce more software and agents are given access to company information along with the power to execute, AI puts new demands on existing governance. Leaders need to be able to identify exactly which agents are running, what they can access and whether required reviews occurred. This requires the kind of verifiable evidence that an AI-ready governance framework is built to provide.

Plenty of policies exist. According to Menno Odijk, Field CTO for Mendix at Siemens, a successful AI governance framework hinges on whether organizations are implementing frameworks reliably.
The following questions can help you assess whether your governance framework provides the level of visibility, oversight and accountability your AI deployments require.

1. Can you identify every agent, its owner and its permitted access?

An AI-ready governance framework should give leaders an unobstructed view of the agents operating across their organization. This requires a central inventory that shows each agent’s purpose, version, responsible owner and permitted access to data and systems.

Those access boundaries demand careful consideration. Odijk explains that agents need company information to perform useful work, but providing that context can inadvertently expose sensitive data through their responses. Teams should establish which information an agent is permitted to access, including when it acts on behalf of a person with restricted permissions.

For each agent, you should be able to establish what information it may use and which actions it is authorized to take. Keeping that record current as agents are deployed, updated or retired gives teams a clear starting point for oversight.

2. Can you prove that required validation happened before production?

Leaders may genuinely believe adequate review happened throughout development. The only problem? They often can’t verify it.

As AI increases the volume of software that teams produce, Odijk stresses that leaders need to know whether their review processes are keeping up with the volume of code artifacts.

For a given release, teams should be able to show which artifacts underwent required validation, who reviewed them and whether they were approved. Those records should connect to the version deployed in production. If that evidence is difficult to retrieve, leaders have a gap to address in how reviews are performed or recorded.

3. Can you retrieve a usable record of an agent’s actions?

If an agent updates a business record and someone challenges the result, your team needs a trail of evidence that allows them to investigate.

This activity record should connect the relevant inputs, model interactions, tool calls, actions and approvals to the request and resulting outcome under investigation. It should be accessible and understandable to the people responsible for reviewing what happened.

Odijk points to records of model calls, their parameters and the context used to derive answers as important parts of traceability. Together with recorded actions and approvals, these details help teams reconstruct how an outcome occurred and check for deviations from policy.

4. Are approval and escalation responsibilities built into the workflow?

For each agent, teams should define:

• Which actions it can take independently
• Which actions require human approval
• Who must respond when something goes wrong

For consequential actions, an authorized person should be required to review and approve the proposed change before the workflow proceeds.

An agent might gather permitted information and prepare a recommendation, for example, while needing approval before updating a critical system.

The assessment should establish whether required approval steps have been implemented, whether the process pauses until approval is given and whether the approval is recorded.

5. Will the same governance standards hold as more teams deploy AI?

As more teams build applications and agents, leaders need confidence that permissions and oversight remain consistent across the portfolio.

Assess whether new projects inherit a common set of controls, whether teams can demonstrate that those controls were applied, and how exceptions are approved and recorded.

Each project still needs assessment of its particular data, permissions and actions. But shared controls give teams a consistent starting point and help leaders maintain oversight as deployment expands.

Supporting governance across the portfolio

A common set of controls is where the architecture does the work. When the controls live in the platform, every new application and agent starts governed.

Mendix, an agentic development platform and part of Siemens’ Intelligence Center X, an agentic enterprise system, enables teams to codify a standard once and check every application against it, at build and across the running landscape. Agents built on the platform work inside governed workflows. They act with the permissions set by the human they work for, and their activity is traced in a central audit log.

Teams can configure human review as a mandatory workflow step, so consequential actions require approval before the process continues. As Odijk emphasizes, those oversight capabilities must be implemented for the review to occur.

Establishing controls at the platform level can also reduce the foundational work teams repeat for subsequent applications.

WIth Mendix, you set once and it’s inherited everywhere. “Many of our customers embrace the platform to gain speed when building their second, third, and fourth applications,” says Odijk.

Put your governance to the test

With great power comes great responsibility. This isn’t a cliche so much as it is a practical mandate when it comes to governing AI agents.. If you’re giving agents access to company information and permission to act, you have to be able to answer for what they do.

Start by applying the questions outlined here to an agent already running in your organization. Can you identify its owner, confirm its permissions and retrieve evidence of its review and activity?

Those answers will show you where your policies hold up in practice and what needs attention before your next deployment adds to the workload.