Agentic AI governance and risks: an investigator’s perspective

On 15 September 2025, Uganda’s Supreme Court dealt with a fraud involving misuse of a mobile-money system. The important evidence was digital: user IDs, login activity, and IP trails. The Court accepted properly authenticated system records as evidence linking digital activity to the people behind it.

Now change one fact. What if the user behind the transaction is not a person? That is the governance problem created by agentic AI.

A normal chatbot gives an answer. An AI agent can receive a goal, make a plan, consult databases, remember earlier information, invoke software tools and take action. Give it access to your ERP, email, procurement platform, customer database and payment API, and you have not hired a clever assistant. You have created a new digital operator.

Interestingly, Uganda’s Electronic Transactions Act already defines an “electronic agent” as a computer program or automated means used independently to initiate an action or respond in an automated transaction. More importantly, section 13 provides that an electronic agent can form a contract and that, subject to stated safeguards, the organisation using it can be bound even where nobody reviewed what the agent did. That should get every CEO’s attention.

Consider procurement. An agent monitors emails, reads quotations and prepares purchase orders. A compromised supplier document contains instructions the human eye does not notice. The agent interprets them, changes vendor details, and invokes a payment workflow. Technically, every system may have worked exactly as configured. The investigation therefore changes. I would not begin with, “Who clicked?”

I would ask: What authority did the agent have? What identity did it use? What information entered its context? Which tools could it invoke? What did it remember? What API calls did it make? What controls could stop it?

OWASP describes the danger as excessive agency: excessive functionality, excessive permissions or excessive autonomy can allow an AI system to perform damaging actions following manipulated or erroneous instructions. Agentic systems also introduce prompt injection, tool abuse, privilege escalation, data leakage and memory poisoning.

The evidence must survive scrutiny too. Our local locals namely, Uganda’s Electronic Transactions Act places the burden on the party relying on an electronic record to establish authenticity. Courts look at how the record was generated, stored, protected and attributed. A 2025 Court of Appeal decision similarly stressed forensic validation of electronic evidence.

So an agent audit trail must capture more than the final transaction. Preserve the prompt, retrieved documents, model version, memory state, tool calls, API responses, timestamps, permissions and human approvals.

Privacy adds another layer. Uganda’s Data Protection and Privacy Act requires reasonable technical and organisational safeguards and gives a person rights where a significant decision is based solely on automated processing, including a right to seek reconsideration.

The practical rule is simple: never give an AI agent more authority than you are prepared to lose.

Give every agent a named owner, separate machine identity, least privilege, transaction limits, approval thresholds, immutable logs, memory controls and an emergency stop. Require human approval before irreversible actions involving money, contracts, customer rights, sensitive data or system administration.

This is where strategy meets risk. Strategy tells the agent what outcome to pursue. Governance defines how far it may go to achieve it.

An organisation that pursues AI speed without designing authority, evidence and accountability into the structure is accelerating without knowing who controls the brakes. That is bad.

I remain, Mr Strategy.