What actually changed
For three years, AI produced drafts, summaries and suggestions. You read the output and decided what to do with it. If it was wrong, you noticed.
AI systems can now use tools, read your systems and take actions in them — research a supplier, raise a purchase order, submit it, chase it. The capability arrived faster than the controls around it, because the people building the capability were solving a different problem. That gap is where the risk currently sits.
A poor chatbot answer wastes a few minutes. A poor agent action spends money, discloses information, accepts terms, or creates an obligation in your name.
Five questions, before anything else
When an agentic deployment fails, it is rarely because the model gave a stupid answer. It's because the system around the model had no answer to one of these.
Identity
Who is this agent, who operates it, and who does it represent?
Fails as impersonation. Agent traffic is already being spoofed at scale in production web traffic.
Authority
What has it actually been authorised to do?
Fails as a valid signature on a transaction nobody approved. Authentication is not authorisation.
Constraints
What limits apply — spending caps, approved suppliers, prohibited actions, human approval thresholds?
Fails as two agents drawing on the same budget and both being told yes. A prompt is not a control.
Evidence
Can you reconstruct what it was asked to do, what it did, and on what basis?
Fails as an invoice with altered bank details, paid, with nothing showing what the approval was bound to
Recourse
When something goes wrong, can you correct it, compensate where appropriate, and determine accountability?
Fails as discovering that stopping an agent and undoing what it did are two very different capabilities. A global pause halts new commitments — it cannot reverse a settled transfer.
We describe these as governance because that's the language boards and regulators use. From a customer's side of the counter they're simpler: consent, accountability, evidence and redress — the things people already expect from commerce. Agentic systems don't get an exemption from them.
What this looks like on one real workflow
Take a procurement agent that replenishes supplies for a Melbourne site. It holds a mandate: A$5,000 per order, A$12,000 per week, approved suppliers only.
Anything outside that — a new supplier, changed bank details, non-refundable terms, a late delivery — stops and waits for a person.
Then the failure arrives, as it does: an invoice from a known supplier, with the payment details changed, against a delivery that was only partly fulfilled.
Answering that properly means eight control points, each with named evidence and an accountable role:
Objective
What was the agent actually asked to achieve, and by whom?
Access
Which systems and data can it reach, under whose credentials?
Supplier & terms
Is this counterparty approved, and on what terms?
Budget
Reserved against a shared ledger — not checked and hoped.
Exception
What forces a stop, and who is on the other end of it?
Payment
Bound to a verified beneficiary and amount, re-validated on change.
Completion
Did the goods arrive? Payment succeeding is not the outcome.
Failure & review
Who owns the recovery, and what does the record have to show?
This is an illustrative example we use to structure the conversation, not a client engagement. We build the equivalent against your workflow.
What we produce
Each of these arrives as a document with named owners, stated residual risks and acceptance criteria — something you can hand to a board, an auditor or a regulator.
-
A regulatory perimeter and responsibility map, dated — which obligations actually attach to this activity, and who holds each one.
-
A mandate and control specification — the limits, the approvals, and where each is enforced.
-
Protocol and vendor due diligence — what the tooling genuinely provides versus what you still have to configure.
-
Adversarial and failure test results — prompt injection, changed beneficiaries, stale state, concurrent spending, service failure.
-
An evidence and retention design — what gets recorded, how long it's kept, and how it's protected.
-
An incident and dispute playbook — who stops it, who tells the customer, who makes them whole.
Reviews can be scoped to APRA-regulated entities, existing financial services providers, or businesses preparing for the digital asset platform changes.
Autonomy is delegated, not switched on
The instinct is either to ban agentic tooling or to let it run and hope. Neither survives contact with a board. The workable path looks like how you already handle people — a defined role, explicit delegations, supervision, and authority that grows as trust is established. The difference with software is that most of those controls can be made explicit and machine-enforceable.
-
Read-only. The agent can see, and nothing else.
-
Proposed actions. It drafts; a person decides.
-
Approved execution. It acts, on a human decision, inside recorded limits.
-
Bounded autonomy. It acts alone, within limits you have tested and can evidence.
Widen the mandate along separate axes — transaction size, counterparty, how reversible a failure would be — rather than all at once. Start where the inputs are structured, the outcome is checkable, the exposure is capped, and someone owns the exceptions.
What we don't claim
We design AI management systems aligned to ISO/IEC 42001, adopted in Australia as AS ISO/IEC 42001:2023, and prepare organisations for third-party certification. We are not a certification body, and no adviser can certify your compliance — that requires an accredited certification body auditing you.
The five pillars are recommended control objectives. Your actual legal obligations depend on your entity and your activities, and we identify those specifically rather than assuming them. We don't provide legal advice, and where a question needs it we say so and tell you who to ask.