As AI agents move from pilots into everyday business operations, the way organisations think about security and oversight is changing. Agents do not just generate answers. They take actions across multiple systems, often at a speed and scale that traditional controls were never designed for. For businesses in Asia Pacific, this raises a question that goes beyond protecting systems: how do you govern what an AI agent actually does?
Governments and regulators across Asia Pacific are putting frameworks and guidance in place, but policy alone does not make an organisation ready. Readiness comes down to three practical questions: can an organisation replace the safeguards that people once provided, can it control what its agents do at the speed they work, and does someone own the outcome when something goes wrong?
In this edition of Inside the Firewall, three technology leaders turned the lens on what AI governance and readiness mean for businesses in Asia Pacific, each from a different angle: Shanker Selvadurai, Chief Technology Officer of IBM Technology Asia Pacific, on the safeguards people have quietly provided; Dan Mountstephen, Senior Vice President and General Manager of Okta APJ, on controls that keep pace with agents; and Lilly Ryan, Head of Enterprise Security Architecture at Thoughtworks, on ownership and preparedness. Together, they set out what responsible AI governance should look like and what being ready for AI agents requires.
The evidence trail that doesn’t exist yet
For Shanker Selvadurai, readiness in Asia Pacific depends less on whether a framework exists than on what happens once an agent is already inside the business. It starts with how the agent gets its access.
“The most common mistake isn’t skipping security checks. It’s letting the agent act under a person’s login or a shared service account,” Selvadurai said.
An agent on borrowed credentials already holds everything that person or account can reach, he explained, so there is no safeguard to bypass. Before go-live, he said, three things should be in place:
- The agent has its own identity, with access limited to what it is explicitly permitted to use.
- Every action is traceable to the specific agent and the version that was approved.
- There is a tested way to stop the agent and revoke its credentials as quickly as it can act.
Without them, nothing marks an action as the agent’s own, and the record breaks down. Across the region, he sees governance frameworks taking shape faster than the systems needed to back them up.
“The frameworks are taking shape. In many enterprises, the evidence trail does not yet exist,” he said.
His test is simple: can an organisation establish, within an hour, which agent took an action, on whose authority, which version was running and what data it touched?
A missing record also means a missing way back. In many organisations, a person has quietly been that way back, catching a failure and fixing it before it spreads.
“Today, the human is often the rollback. When a task spanning three systems fails at step three, a person notices, stops and fixes it,” Selvadurai explained.
Few organisations have built a formal way to undo that sequence because the person was providing the safety net in practice. Replace the person with an agent and that safety net can disappear.
His answer is to give agents autonomy in proportion to how easily their actions can be undone, with drafting and triage under light oversight, and payments, customer commitments and data deletion under human approval until each step can be reversed.
If access was granted before the agent ever acted, the limit has to be set earlier, and the question is how to set it without slowing the business. Okta’s Mountstephen starts there.
Governance must keep pace with the agent
For Dan Mountstephen, the pressure point is speed. Across APJ, he sees deployment moving faster than governance can mature, with many organisations still approaching AI access the way they did before agents arrived.
“Being “AI-ready” has very little to do with launching an internal pilot or writing an AI aspirational statement. True readiness means possessing the identity security posture and governance architecture required to scale autonomous agents without losing operational visibility,” Mountstephen said.
In practice, that means finding unmanaged agents and fixing misconfigurations before they are exploited. Before go-live, he said, leaders should be able to say where their agents are, what they can access, what actions they can take and how fast they can be shut down.
The risk grows when an agent is treated as a trusted insider.
“The most common and dangerous mistake organisations make is granting broad, standing privileges because the agent is deemed an “internal trusted application.” In identity security, trust is not an entitlement; it is a continuously verified state,” he said.
High-impact operations, such as financial transactions or access to personal data, should have automated guardrails and human approval.
Caution, he argued, should not mean slowing the business down.
“The traditional enterprise debate that pits innovation against security is an outdated false dilemma. If your security team’s only lever is saying “no,” teams will simply route around you—fuelling shadow AI and unmanaged risk,” Mountstephen explained.
Instead, guardrails should match the risk, with each agent given the minimum access it needs for the length of the task and nothing more.
Speed does not change who is accountable, and regulators across the region do not accept “the algorithm decided” as a defence. Mountstephen called for an unbroken, auditable chain of delegation that can answer three questions:
- Which human or system initiated the request?
- What scope of authority was granted?
- What actions were executed?
AI automates the execution, he said, but the business keeps the liability. Controls set the limit, but someone still has to answer for an agent when it fails. Thoughtworks’ Ryan picks up from there.
Responsibility follows control
For Lilly Ryan, the starting point is to stop treating agents as something exotic. Underneath the hype, she said, they are still software, running on machines with credentials, network access and the ability to change things in other systems. Who answers for them is therefore a practical question, though she noted that she is not a lawyer and that the legal picture is still shifting.
“From a security point of view, however: responsibility should follow control. Whoever decides what an agent can see, touch and do is the one who owns the consequences of those decisions,” Ryan said.
Vendors usually control how an agent is built, so secure design, sensible defaults, clear documentation and quick notice when something breaks sit with them. What data the agent can reach, which decisions it is trusted with and how closely it is monitored sit with the business. Her practical answer is a named human owner for every agent in production, not a team, a supplier or another bot.
Control, she argued, also has to be real rather than requested. Agents need their own scoped, time-limited credentials, with authority delegated from whoever they act for, so the audit trail shows whose authority was used.
“Anything that is a hard system control needs to be deterministically applied. This includes allowlists for tools and traffic, spending caps and stop conditions,” she explained.
Readiness, for Ryan, is knowing what to do when control fails. For every agent, an organisation should be able to say what it can touch, who owns it, how it will know if it goes wrong, how it will stop it and what it will tell anyone affected.
“Planning for failure is never an easy sell when you’re time constrained, given that you’re spending time and effort on something you hope will never happen. But when it does happen, and the threat landscape makes that increasingly likely, preparation is the thing that will help you recover fastest,” Ryan noted.
Regionally, she said, policy is still moving. Australia, for one, has opted to rely on existing legal frameworks rather than mandatory AI guardrails, which leaves organisations carrying more of the work themselves. Agents are being deployed regardless, so readiness has to be on an organisation’s own terms.
From protecting to governing
Every technology shift reaches a point where the old way of thinking stops working. For AI agents, the three leaders say that point has arrived, and it starts with how organisations see the agent.
For Selvadurai, it starts with recognising who is acting. “Organisations need to shift from protecting systems to governing actions. Enterprise IT was built around two familiar kinds of actors: scripted software that follows predefined instructions, and people who exercise judgement at human speed,” Selvadurai said. Agents, he added, should be treated as actors in their own right, with distinct identities, permissions and records.
Mountstephen reaches the same point through identity, arguing that agents must become first-class identities with a designated human owner and credentials that can be revoked on demand. “As we move into an agentic economy, the central security question is no longer just “Who has access to our systems?” It is: “What has access, what authority did we grant it, and can we instantly revoke that access right now?”” Mountstephen said.
For Ryan, it starts with the words organisations use, since an AI system is not a person or a consciousness. “Layering mysticism over the top of our work makes protecting and defending activities much harder than they need to be. We need to frame our discussions about this technology in terms of machine actions, controls and engineering practices,” Ryan said. In practice, that means describing agents by what they do and how they are controlled.
Together, they point to one shift: readiness across Asia Pacific will depend on how clearly agents are identified, owned and governed as the actors they are.
**
The three leaders come from different corners of the enterprise, yet they land on common ground: an AI agent can only be governed as far as an organisation can see, limit and answer for what it does. Their safeguards line up: limit what an agent can access, keep a record of what it does, require human approval for high-impact actions, and be able to stop it and recover. The difference is where each starts: Selvadurai with the evidence trail, Mountstephen with the speed of deployment, and Ryan with ownership.
The takeaway for businesses is to settle three questions before an agent goes live: who or what is acting, can its actions be traced and controlled, and who answers when it fails. As agents move into everyday work, those answers need to be in place before deployments multiply.
