Skip to content
Vela
Tech FrontlineBiotech & HealthPolicy & LawGrowth & LifeSpotlight
Set Interest Preferences中文
Tech Frontline

The Era of Agentic AI: Governance Frameworks and Enterprise Security

Jason
Jason
· 2 min read
Updated May 5, 2026
A digital-themed image of a corporate network, with glowing pathways representing AI agent traffic.

From Preview to GA: The Governance Role of Agent 365

As autonomous AI agents become increasingly common in corporate workflows, "shadow AI"—the use of unauthorized, unmonitored AI tools—has emerged as a critical enterprise threat. In response, Microsoft last week moved its management platform, Agent 365, out of preview and into general availability. The product positions itself as a unified control plane, enabling enterprise IT and security teams to observe, govern, and secure autonomous agents across the entire organizational stack. This shift signals that Microsoft views the governance challenge of autonomous AI as an immediate, operational priority rather than a long-term theoretical concern.

Agentic Commerce: How Amex is Enforcing AI Transactions

In the financial sector, American Express (Amex) is pioneering secure infrastructure for agentic commerce. Amex is building a sophisticated system that allows AI agents to shop and make payments on behalf of users. According to VentureBeat, this framework relies on "intent contracts" and single-use tokens to strictly enforce the security and auditability of AI-driven transactions. While currently confined to its internal payment network, Amex's involvement in broader initiatives like Google’s Agent Pay Protocol (AP2) demonstrates an urgent industry-wide push to establish interoperable standards for agent-led commerce.

Beyond RAG: The Rise of Compilation-Stage Knowledge

With the shift toward agentic AI, the traditional Retrieval-Augmented Generation (RAG) pipeline is increasingly viewed as insufficient for the high-frequency, contextual needs of autonomous agents. The industry is witnessing a significant shift toward a "compilation-stage" knowledge layer. According to recent survey data, vector databases are seeing a decline in adoption share as hybrid retrieval intent—the capability to incorporate deeper context at the source—has tripled in strategic importance. This shift indicates that enterprise leaders are prioritizing architectures where knowledge is fundamentally baked into the AI’s compilation process rather than retrieved intermittently at runtime.

The Future of Enterprise Compliance

The strategic moves by both Microsoft and Amex suggest a clear path for the future: enterprise AI governance is shifting from a paradigm of prevention to one of controlled authorization. Instead of blocking the potential of automated AI, companies are adopting software-defined governance layers and cryptographic security architectures to ensure that every agentic action is visible, secure, and auditable. For IT executives, the challenge over the next two years will be building these infrastructure guardrails without sacrificing the speed and efficiency that agentic AI promises.

FAQ

What is 'Shadow AI' in an enterprise context?

Shadow AI refers to the unauthorized use of AI tools by employees without IT or security approval, posing significant data leakage and compliance risks.

How does Microsoft’s Agent 365 assist enterprises?

Agent 365 acts as a unified control plane, allowing security teams to observe, govern, and secure all AI agents running across the organization's infrastructure.

Why is traditional RAG becoming less effective for agentic AI?

Agentic AI requires deep, continuous contextual awareness, which traditional, intermittent RAG retrieval methods struggle to support at scale.