AI governanceHuman in the loop only works if the approval is real
Human in the loop is the reassuring phrase everyone reaches for. But a person clicking approve on an action they cannot see, cannot scope, and cannot be held to later is not oversight, it is theatre. What a real AI agent approval actually needs.
AI governanceRole-based access was built for people. Your agents are not people.
RBAC answers which role is allowed to do a thing. It cannot answer which agent actually did it, acting as whom, on whose authority. That gap is where agent accountability lives, and it needs more than a permission set.
AI governanceAI governance is a gate, not a document
An AI governance policy describes what an agent should do. A gate is what actually stops it doing something else, before the action runs. The difference between describing control and having it.
AI governanceSelf hosted AI: what you actually control
What self-hosted AI gets you: control over agent permissions, approvals, budgets and evidence. A worked example, including what still leaves for a cloud model.