Flood Watch
So there I was...
This morning it was just coffee and work. No mile in the pool, no post holes, because the Austin area is under a flood watch and the rain has been coming down like it holds a grudge. The creeks out here in the hill country do not mess around when this happens; they go from dry gravel to brown freight train in an hour. So I am at my desk with the second cup, and because I am who I am, Stevie Ray Vaughan's version of Texas Flood is on the speakers, the one he made his own off Larry Davis's 1958 original, and there is no sweeter twelve-bar blues on this earth. The man in that song is determined to head out into the water. I am determined to do no such thing. Even the statue on the front page of this blog is sitting out there on the lakefront getting soaked, and he is bronze.
What I was reading, while the rain worked the windows, was a write-up of new guidance from the law firm Mayer Brown on governing agentic AI, the kind of AI that does not just answer you but acts for you: chains tools together, delegates to sub-agents, touches real systems, spends real money. The guidance says most companies do not need to tear up their AI governance and start over, but that agents need dedicated controls that ordinary AI programs never demanded. It even names them like catalog parts: permission boundaries, autonomy limits, human-in-the-loop gates for irreversible actions, behavior monitoring, a readiness assessment before deployment.
And sitting there listening to the rain, I realized the guidance is describing flood control.
Think about how we actually live with water in Texas. We do not stop the rain, and we do not follow every drop around with a supervisor. We build for it. Channels that decide where water is allowed to go, which is a permission boundary. Spillways rated for how much can pass before somebody has to make a call, which is an autonomy limit. Floodgates that a human must open on purpose, because some releases cannot be taken back, which is exactly what a human-in-the-loop gate for irreversible actions is. Stream gauges up every creek, reporting all night, which is behavior monitoring. And before anyone builds a neighborhood down in the bottomland, an engineer signs a study, which is your deployment readiness assessment. The vocabulary is new. The engineering is five thousand years old.
The guidance also names the quiet risk, the one I find most honest: agent drift, the slow deviation of an agent's behavior from what you intended. That is not the flash flood. That is the creek moving its own channel a few inches a season until one year the water is somewhere it has never been, and the map is a lie. Water does not ask permission and it does not announce itself. It finds the gap. An autonomous system with broad permissions and nobody watching the gauges will find the gap too, at scale, before any human notices, in your data, your accounts, your customers' trust.
I will tell you where this got personal. A machine helps me run this blog, you know this because I told you, and reading the guidance I realized my little operation already has its floodgate: the machine can draft, but it cannot publish. Every word goes live only when I push the button myself. I did not set it up that way because a law firm told me to. I set it up that way because publishing is the irreversible part, and the irreversible part is where the human belongs. That is the whole principle in one sentence, and it scales from a one-man blog in the rain to a bank running ten thousand agents: the more permanent the consequence, the more deliberate the hand on the gate.
So here is my question for you, from a dry desk while the creeks rise. Somewhere in your shop, right now, somebody is wiring up an agent because agents are the year's big thing. Do you know what its channels are, where its spillway tips over, which of its actions cannot be undone?
And when that water starts moving, and it will, is there a hand on the gate, or just a very confident weather forecast?
Source: Agentic AI Governance Demands Dedicated Controls, Mayer Brown Guidance Finds, AIGovernance.com
#AI #AgenticAI #AIGovernance #RiskManagement #Compliance #STIW