The agentic enterprise
Agents are arriving on every platform at once
Super intelligence has moved from pilot projects into the core platforms that government agencies already run. ServiceNow is placing agents inside workflow and case handling. Salesforce is placing them inside service and constituent engagement. Pega is placing them inside case management and decisioning. Databricks is placing them next to the data they are trained and grounded on. Microsoft is placing them inside the productivity and security tooling that nearly every agency uses daily.
The effect is that an agency does not adopt agents once. It adopts them five or six times, on different schedules, under different vendor roadmaps, with different consoles and different defaults. Each platform team can make a sound decision on its own and the agency can still end up with an estate it cannot describe, let alone govern.
An agent that can think must not be free to act. The distance between reasoning and action is where governance lives.
One governance model, not five
The instinct is to let each platform govern its own agents, because each vendor ships its own controls. Varmoda’s experience is that this works until the first incident, and then it fails in a predictable way. When an agent takes an action that turns out to be wrong, the questions are the same regardless of which platform it ran on. Who authorized it. What data did it see. What was it permitted to do. Who reviewed it. Where is the record.
If each platform answers those questions differently, nobody can answer them for the agency. Varmoda’s teams build one control model that every platform is mapped to, and then implements that model using whatever native controls each platform provides. The model is the constant. The implementation varies.
The common control model
Six controls cover the ground. They are deliberately plain, because a control that needs a specialist to interpret will not be applied consistently across five platforms.
| Control | What it means | How it is applied |
|---|---|---|
| Identity first | Every agent has its own identity | Agents are registered as service identities, not run under a person’s account. Permissions are granted to the agent, reviewed on a schedule, and revoked when the agent is retired. |
| Bounded autonomy | Scope is set before the agent runs | Each agent has a written list of the systems it may reach and the actions it may take. Anything outside that list fails rather than being attempted. |
| Approval gates | High impact actions wait for a person | Actions that move money, change entitlements, alter records of record, or communicate externally are queued for human approval with the agent’s reasoning attached. |
| Grounded data | Answers come from approved sources | Agents retrieve from governed data products with the same access rules as the people they serve. An agent never sees records its requester could not see. |
| Audit and observability | Every run leaves a record | Prompt, retrieved context, tools called, action taken and approver are written to a log the agency controls, retained to the agency’s schedule. |
| Evaluation | Quality is measured, not assumed | Each agent has a test set and accuracy thresholds checked before release and on a schedule afterwards. Falling below threshold takes the agent out of service. |
These map cleanly onto the NIST AI Risk Management Framework and onto the agentic risk categories the security community has converged on, so an agency implementing them is not inventing its own standard.
Making it real across the estate
Varmoda’s teams work through six steps when bringing an existing estate under one model.
- Inventory the agents. Most agencies have more agents running than they expect, because platform teams enabled vendor features without a central record. The first deliverable is a list with an owner, a purpose and a platform for each one.
- Classify by impact. An agent that drafts a summary for a caseworker to read is not the same risk as an agent that closes a case. Classification decides how much of the control model applies.
- Keep people in the loop where it matters. Approval gates are placed by consequence, not by platform. The same rule holds whether the action originates in ServiceNow or Salesforce.
- Unify identity and access. Agent identities are issued and reviewed centrally, so an access review covers the agents as well as the staff.
- Enforce guardrails at run time. Scope is checked when the agent acts, not only when it is configured, because configuration drifts and vendor defaults change.
- Measure outcomes and incidents. Accuracy, approval override rates and incident counts are reported together. An agent with high accuracy and a high override rate is telling the agency something.
The Varmoda approach
Varmoda’s teams carry platform certifications across ServiceNow, Salesforce, Pega, Databricks, SAP, Oracle and Microsoft, which means the control model is implemented with each platform’s own mechanisms rather than bolted on beside them. That matters for support: an agency that governs agents through custom middleware owns that middleware forever.
Varmoda’s experts begin with the inventory and the classification, because those two artifacts usually change what an agency thinks it needs. Agents that nobody owns are retired. Agents doing useful work under no supervision are brought under approval gates. Only then is new capability added, on a base the agency can describe to an auditor, an inspector general or a committee.