The Governance Vacuum in Agentic HR
Why the first enforcement action is closer than vendors are pricing in.
Enterprises are deploying AI agents into HR, learning, and workforce systems faster than they are building the identity governance required to control them. 74% of organizations are running AI agents that require credentials. 63% cannot prevent those agents from accessing data beyond authorized scope. Fewer than 10% have a mature strategy for managing the resulting non-human identities.
The gap is not a maturity curve that will close on its own. It is a structural exposure. We assess that the first material enforcement action — by a state attorney general, a federal regulator, or a class-action plaintiff's firm, naming an enterprise AI agent in an HR or workforce decision context — is likely within the next 12 to 18 months. The organizations that will be named are already running the deployments that will name them.
- Enterprise AI agents currently operate with employee-level system permissions but without the identity registry, attestation, or off-boarding workflows that govern human employees. This is the load-bearing risk of the current deployment wave.
- The execution gap between AI agent adoption and AI agent production deployment is not a technology problem. It is a governance and work-redesign problem. Gartner projects that 40% of agentic AI projects will be canceled by the end of 2027; by Gartner's own analysis, the cause is inadequate work redesign, not technology failure.
- 82% of Chief Human Resources Officers intend to adopt AI agents in HR functions within 12 months. Deployment will move faster than the regulatory and audit infrastructure can support.
- The strongest counterargument — that existing identity and access management frameworks extend cleanly to non-human actors — is technically correct and operationally insufficient. Service-account governance designed for batch processes does not handle agents that make consequential decisions in real time across multiple systems.
- The governance vacuum is bidirectional. Beyond the employer-side risk, employees are already using AI agents to complete compliance training and upskilling programs on their behalf, creating a measurable gap between completion rates and learning outcomes. Both directions of failure trace to the same underlying gap: no infrastructure exists to authenticate, audit, or attest to the actions of non-human actors operating inside HR and learning systems.
The auditability gap is structural.
Traditional identity governance assumes a fixed map between actor and authority. An employee has a role. The role has permissions. The permissions trigger workflows. When the employee leaves, an off-boarding process revokes the permissions and closes the audit log. This model was built for humans and adapted for machines; for 30 years, it has worked well enough.
Agentic AI breaks the model in three ways. First, the actor is not fixed: the same agent can act on behalf of different employees, different roles, and different organizational contexts within a single session. Second, the authority is not fixed: the agent's effective permissions are the union of the credentials it has been granted plus whatever it can chain together by calling other tools. Third, there is no off-boarding event: agents do not leave organizations the way humans do. They are silently retired, replaced, or upgraded, often with no revocation step.
This is the structural diagnosis offered by the California Management Review in March 2026: existing governance and operating models are ill-suited to software that can independently perceive, decide, and act. The contribution is not the observation of the gap — practitioners have been documenting it for a year — but the assertion that the answer is a new operating model rather than an extension of the old one. We agree with the diagnosis.
The vendor disclosure problem is two cycles behind.
Most enterprise software vendors disclose AI agent capabilities in release notes and security bulletins. They do not disclose the permission scopes those agents request, the data they access, or the audit trails they generate. Buying organizations are not asking either: the procurement questionnaires that drove the last decade of software-as-a-service governance assume a static permission model that AI agents do not fit. As a result, AI agents are being procured on the same forms built for static analytics tools, and security teams discover the actual permission scope only after deployment.
The 76% surge in non-human identities documented in enterprise environments since the start of widespread agent deployment quantifies the procurement-side blind spot. Fewer than 10% of those organizations have a mature strategy for managing the new identity volume.
Internal mobility is the soft target.
The most likely first enforcement action will not be against an external-facing AI agent that handled a customer transaction. It will be against an internal AI agent that touched an employee's record — one that made or supported a decision about hiring, promotion, performance, or termination without an auditable trail back to a human decision-maker. The legal exposure is sharper here than in any external-facing deployment because employment law has well-developed doctrine on adverse action, disparate impact, and reasonable accommodation, and that doctrine does not contemplate non-human actors.
We assess a material enforcement action — defined as a state attorney general investigation, an Equal Employment Opportunity Commission charge, or a credible class-action filing — naming an enterprise AI agent in an HR or workforce decision context as likely within the next 12 to 18 months.
This brief tracks five observable signals between now and the next quarterly review:
- State attorney general inquiries naming enterprise AI agents in workforce or HR contexts.AG press releases and enforcement docket filings.
- A Fortune 500 company disclosing an AI-agent-related employment incident in a Securities and Exchange Commission filing or formal investor communication. This is the leading canary that the broader enforcement environment is shifting from theoretical to actual.SEC EDGAR filings, public investor disclosures.
- Vendor terms-of-service amendments for HR-adjacent AI tooling that introduce explicit non-human-actor identity language.Vendor portals and customer notices.
- Cyber and employment-practices liability insurance carriers beginning to underwrite AI-agent-related risk as a distinct rider.Carrier rate filings and broker advisories.
- Plaintiff-bar publications and conference panels addressing AI agents as a discrete category of employment exposure.American Bar Association Labor and Employment Law section publications, plaintiff-side practice journals.
For Chief Human Resources Officers.
Audit current AI deployments for permission scope before the next internal audit cycle. The question is not whether AI is being used, but what credentials each AI agent currently holds and whether those credentials would survive a regulatory subpoena. If they would not, the remediation budget is smaller now than it will be after the first enforcement action.
For Chief Learning Officers.
Vendor selection and renewal cycles in the next 90 days will set governance for the next 2 years. Insert agent-identity questions into the procurement process now: on whose behalf does this agent act, what audit trail does it generate, and what is the off-boarding workflow when the agent is replaced? If the vendor cannot answer, the deployment becomes the buyer's risk. Separately, audit completion-data integrity for AI-mediated training and certification programs. Completion rates that do not correlate with measurable skill gains are evidence that the integrity gap is already operative.
For Chief Information Security Officers.
The IAM extensibility argument is technically correct. Operationalize it. Service accounts for AI agents require shorter rotation cycles, tighter permission scoping, and explicit audit-trail mapping that ties each agent action back to a human authorizing context. The standard non-human-identity pattern designed for batch ETL jobs is not sufficient.
For vendor strategy and product leaders.
Disclosure standards for agent capabilities are about to become a buying criterion. Vendors that publish clear permission scopes, audit-trail formats, and off-boarding workflows for their AI agents will close enterprise deals; those that do not will lose them. This is a near-term differentiator, not a long-term one.
We considered two material counterarguments.
The first: existing identity and access management frameworks already handle non-human actors at scale (service accounts, robotic process automation, integration tokens), and AI agents are simply the latest entry in that category. With principle-of-least-privilege configuration, regular credential rotation, and standard audit logging, existing IAM infrastructure should extend cleanly. On this view, the governance-vacuum framing in this brief overstates a gap that is better understood as an operational lag.
We assess this counter as partially correct: technically sound, operationally insufficient. Service-account governance was designed for batch-processing actors with fixed, predictable behavior. AI agents are real-time decision-makers operating across system boundaries with behavior that emerges from the interaction of their tools, their context, and their training. The IAM framework can be extended to cover them, but the work to do so is the work this brief is calling for.
The second counter is harder. Current agentic AI systems may not yet be capable of the consequential decision-making this brief assumes. Empirical observation of deployed systems suggests that they reliably handle only the simplest 15 to 20% of HR requests; complex cases — promotion, termination, accommodation — escalate to human decision-makers. If this remains structurally true, the enforcement-action thesis is premature.
We assess this counter as plausible but mis-timed. The window between an AI agent making a recommendation and an AI agent being involved in the decision such that liability attaches is narrower than the dissenting view assumes. Plaintiffs and regulators do not need the AI to make the final call; they need it to have been in the chain of decision in a way that cannot be audited. Current deployments already meet that standard.