Does Your AI Need a Boss? The Case for Employee-Style Controls for Agentic AI

This article for Debevoise & Plimpton’s Data Blog from authors Charu A. Chandrasekhar, Avi Gesser, Mari Grace, Kendall Howell & Adam Shankman reflects on the growing use of AI agents to perform tasks traditionally handled by employees and the need to govern those agents through robust controls. The authors argue that delegating work to AI does not reduce a company’s legal or regulatory obligations. Regulators, including FINRA and federal banking agencies, increasingly expect firms to address risks such as unauthorized actions, data mishandling, and inadequate supervision.

The authors suggest adapting established employee governance practices to agentic AI. Companies should distinguish system access from actual authority and supplement written instructions with technical safeguards such as permissions, approval gates, monitoring, logging, and restricted access. AI agents with significant authority should also be periodically tested under realistic and adversarial conditions to determine whether they follow restrictions, protect sensitive information, defer to human approval, and resist attempts to manipulate or expand their authority.

Finally, firms should establish corrective measures when agents exceed their authority, including restricting permissions, reconfiguring or retraining the agent, suspending its use, or decommissioning it. While no control framework can eliminate misconduct, the authors emphasize that well-designed controls can reduce risk and demonstrate responsible governance if an AI agent acts improperly. As with employee oversight, the challenge is to strike the right balance between meaningful safeguards and allowing agents sufficient autonomy to support innovation and productivity…

CONTINUE READING…