AI governance needs to be built into the system, argues Forbes contributor

AI rules that live in a handbook can be ignored by people and agents alike. Pipefy chief executive Alessio Alionço argues that governance must be built into AI systems themselves, with clear limits on what agents may do and a record of every consequential action.

Watch Desk analysis

What happened

In a Forbes Technology Council article, Alionço sets out five recurring mistakes in governing agentic AI. His advice is to make rules and human intervention points part of the system’s architecture; limit agents to clearly defined permissions; keep enough records to trace who authorised an action and what it affected; and have the business teams that own the risks help set the boundaries. He argues that clear rules can let teams move faster, not simply add another approval hurdle.

Alionço also cites a Deloitte survey finding that 21% of organisations reported mature governance for agentic AI, while nearly three-quarters expected to use AI agents at least moderately within a year. Those are figures he attributes to the survey, not a measure of how safely organisations’ systems operate.

Why it matters

An agent with broad permissions can create trouble even when its underlying model has been carefully chosen. For organisations, the practical question is therefore not only which model to buy, but what it may access, which actions need human approval and whether someone can reconstruct what happened afterwards.

That shifts governance from a policy document towards decisions built into software and business processes. It also makes ownership harder to pass off as an IT-only concern: a hiring workflow, payment or customer record carries risks for the teams responsible for those areas.

Our read

Alionço’s strongest point is that a rule no one can enforce is more aspiration than guardrail. Start by defining what an agent can access and do, where a person must step in, and what needs to be recorded. The less glamorous work may be what makes useful autonomy possible.

What to watch

• Whether organisations translate governance policies into technical permissions and intervention points.
• Who gets to set those limits when an AI workflow crosses business teams.
• Whether companies publish evidence that their controls work in practice, not just that they have them.

Discussion spark: Should companies build strict limits into AI agents from the start, even if that slows deployment, or allow wider permissions and rely on monitoring to catch problems?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.