# Where does agent governance fit on the way to an agentic organisation?

**It is the step most companies skip. Governance is what lets a company go
from AI tools that people run to agents that run on their own, and in sales
it has to cover one thing above all: what those agents say to your customers
in your name.**

Mark Ajzenstadt recently set out seven steps from *tool adoption* to an
*agentic org*. His point was that most companies sit on step one, shopping
for step-seven technology, when what they need is the discipline of the
steps in between. It is a useful ladder, and it shows where a company
selling with agents gets stuck.

## The seven steps, briefly

| step | what it means |
|---|---|
| **1. Tool adoption** | AI tools across the company, each one run by a person |
| **2. A context layer** | each department's knowledge kept separate, behind its own access |
| **3. The harness** | quality checks and routing built first, with the model as a part you can swap |
| **4. Headless** | automations that run on a schedule, not on somebody's laptop |
| **5. Governance** | who may do what, an expiry on every agent, and retiring the ones nobody uses |
| **6. Agent to agent** | one agent's output handed to the next, checked at each handoff |
| **7. Orchestrated work** | agents handle the volume, people handle the exceptions |

## Why sales gets stuck between step four and step seven

Step seven's promise is *agents handle volume, humans handle exceptions*.
In go-to-market, an exception is not an error message. It is a sentence an
agent sent to a buyer: a discount nobody approved, a delivery date nothing
is in place to keep, a certification you do not hold.

Without something deciding which messages are exceptions, step seven means
one of two things. A person reads everything, and the agent saves nobody any
time. Or nobody reads anything, and you find out from a customer.

## What step five looks like for an agent that talks to customers

- **A context layer for what you are willing to say.** Every line an agent
  may repeat about your product, prices and terms, each with a named owner
  and a date somebody last confirmed it. A line nobody stands behind is one
  the agent may not use.
- **A check before every message.** The agent describes what a message will
  do, and gets back *allowed*, *needs approval* or *not allowed*, whichever
  model it runs on. That is step three's quality check, aimed at the buyer.
- **An expiry and a review.** Every agent works under a mandate with an end
  date, and if nobody has reviewed it for a set period, it goes back to
  asking for approval.
- **No dead agents with live keys.** Every key is named, owned and
  revocable, and every agent is on one map.
- **A record.** What each agent committed your company to, written as it
  happens, for the day somebody asks.
- **People handle the exceptions.** The messages that need approval go to
  the person who can give it, with words the agent can use in the meantime.

## What this does not do

Reynforce is not steps four or six. It does not host your agents or pass
work between them, and it works with whichever model and platform you
already use. It is step five for the part of your company where an agent's
output leaves the building and becomes a promise.

</ai-guardrails-vs-agent-governance.md> separates governance from
guardrails on wording.
</free-audit.md> shows what an agent could quote from your own site today.