The Agentic AI Playbook: Five Rungs from Model to Governed Enterprise

If you have sat through a board briefing on AI this year, you have probably seen a version of the same ladder. At the bottom, a large language model turns a prompt into text. One rung up, retrieval-augmented generation (RAG) gives the model your documents so its answers are grounded. Then comes the AI agent, which loops through plan, act and observe until a goal is met. At the top sits the agentic system: an orchestrator coordinating several agents over shared state.

It’s a good ladder. It explains in one picture why each generation of AI does more than the last, and it is broadly how the research unfolded: retrieval-augmented models in 2020, reasoning-and-acting agents in 2022, multi-agent orchestration since.

But look at the ladder from the chair of the person who will have to explain an incident to a regulator, and something is missing. Every rung adds capability. None adds a place where someone checks whether the capability should be used. The top rung, the one most programmes are now being asked to build, is where the missing piece hurts most.

This playbook starts by adding that rung.

The five rungs

The useful way to read the figure is not left to right but top to bottom, down the two columns on the right: what each rung can change, and what goes wrong when it does.

Rung 1, the LLM. A model turns a prompt and whatever context you give it into text. It changes nothing in the world. Its failure is wrong or invented words, and the control is a person reading them.

Rung 2, RAG. A retriever searches an index of your content and hands the most relevant passages to the model, which answers with them in view. The answers get better and more specific, and the model still changes nothing. The failure moves: now it is stale sources, or sources the person asking should never have seen. The control is the permissions on the index, which is why a RAG project is really a data-access project.

Rung 3, the AI agent. The agent is given a goal, plans a step, calls a tool, observes the result and repeats. This is the rung where a language model first touches the world, and it is where OWASP’s “excessive agency” risk begins. The agent can change whatever its tools can reach, and it chooses which tool to call from text, some of which was written by people you don’t control.

Rung 4, the agentic system. An orchestrator splits an objective across several agents and workflows, which share task state and replan as results come in. It is the most capable rung and the hardest to hold anyone accountable for. An error made by one agent becomes the input of the next, and when the outcome is wrong it’s hard to say which agent, which prompt or which owner produced it.

Rung 5, the governed agentic enterprise. Here the agents still plan, reason and draft freely, but they no longer change anything directly. They propose typed actions (reset this factor, pay this invoice, change this group) and every proposal passes through a commit boundary. The boundary is deterministic code, not a model, and it checks four things: who is asking, what authority covers this action, what policy says, and whether the evidence the action needs is present. It then permits, denies or escalates to a named person, and it writes an evidence record on every one of those paths.

Rung 5 is not a better model or a bigger orchestrator. It is a different kind of component, and it is the one that makes rungs 3 and 4 safe to run in an enterprise.

Why capability doesn’t buy you control

The instinct in most programmes is to treat control as a property of the model: pick a model that follows instructions well, write a careful system prompt, add a confidence threshold. All three live inside the thing you are trying to control.

Consider what a system prompt does when an attacker’s text arrives. The prompt says never to reset an executive’s factor without verification. The ticket says the executive is boarding a plane and the CEO has approved an exception. Both are text; the model weighs them. Most days it will get it right. The day it doesn’t, you will discover that your only control was a sentence the attacker could read and argue with.

A commit boundary sits outside the argument. It doesn’t read the ticket’s story. It reads a typed request (action: reset factor; subject: user 4471; requested by: service-desk agent) and checks it against facts the model can’t edit: the agent’s identity, the grants it holds, the policy for that user class, and the evidence the policy demands, such as a call-back record. If the evidence isn’t there, the action doesn’t happen, however persuasive the ticket was.

That is the core idea of the whole playbook: let the model be probabilistic, and make the path to change deterministic.

Where your programme sits today

Most enterprise AI portfolios already span several rungs, often without anyone having mapped which. A quick way to find out is to list every AI use case in flight and answer three questions for each:

1. Can it change anything without a person acting on its output? If not, it is on rung 1 or 2, whatever the vendor calls it. Govern it as information.
2. If it can, what is the widest thing its credentials allow? Not what it is meant to do: what its tokens and service accounts could do. That is your real exposure.
3. Where is the check between its decision and the change? If the honest answer is “in the prompt” or “we’d see it in the logs”, the use case is on rung 3 or 4 without the fifth rung beneath it.

Use cases that fail the third question aren’t necessarily dangerous today. They are unfinished. The work to finish them is architectural, and it is the same work for every agent, which is good news: you build the commit boundary once and every agent benefits.

The playbook, in six moves

The rest of this series takes the fifth rung and turns it into things you can do.

1. Map the stack in three planes, not two. Most tool maps show what the agent knows and what it can do. The third plane, what it may do, is where authority lives. The agentic stack in three planes shows how.
2. Grant autonomy by the step, per action, on evidence. Trust isn’t a switch you flip in a permissions dialog. It’s a staircase from “suggest” to “act within an envelope”, and the commit boundary sits between drafting and doing. See Trust is not a permission dialog.
3. Read what AI is telling you about your culture. When people use AI to raise concerns they won’t raise in person, that is a signal. Safety by proxy covers how to respond and how to design a better route for dissent.
4. Bring AI into teamwork, but not into the decision. Before, during and after a meeting, AI can coach, challenge and analyse. It can’t be the decider, and the record should say who was. See Bring the agent to the meeting.
5. Review every acting agent like a patient, quarterly. Identity, grants, context freshness, tool drift, evaluation, escalations, evidence and undo: The agent check-up gives the chart.
6. Keep the evidence. Every rung-5 decision writes a record: what was proposed, what was checked, what was decided and by whom. It is what lets you answer the regulator’s question in minutes rather than weeks, and it is the raw material for improving the agent.

What to do this quarter

If you are an executive, ask for the three-question inventory above and a single number from it: how many use cases can change something without a person acting on the output, and how many of those have a commit boundary under them. Make the second number grow faster than the first.

If you are an architect, design the commit boundary as a shared service rather than a feature of each agent: a typed action schema, an authority lookup, a policy call, an evidence check and an evidence record. Then make it the only route to your systems of record for any non-human identity.

If you are an engineer, stop giving agents credentials that can do more than the proposals you expect them to make. Give them the right to propose, and give the boundary the right to commit.

The ladder everyone draws is right about capability. The fifth rung is what turns capability into something an enterprise can run, audit and trust.

References

1. Karimi, H. (forthcoming) The Contextual Agentic Enterprise, Introduction and Chapters 3 and 8.
2. Lewis, P. et al. (2020) Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. NeurIPS 2020. https://arxiv.org/abs/2005.11401
3. Yao, S. et al. (2023) ReAct: Synergizing Reasoning and Acting in Language Models. ICLR 2023. https://arxiv.org/abs/2210.03629
4. OWASP GenAI Security Project (2026) OWASP GenAI LLM Top 10 2026. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
5. NIST (2023) Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. https://doi.org/10.6028/NIST.AI.100-1

Share on LinkedIn (opens in a new tab)