From Assistive to Agentic: A Governance Category Shift
Generative AI assistants respond to a human prompt, produce output, and stop. The human remains in the action loop at each step. An agentic AI system receives a goal, plans a sequence of actions to reach it, and executes those actions using available tools — querying databases, retrieving and comparing documents, delegating subtasks to other models, and filing results — without returning to a human at each decision point.
NASCIO's March 2026 report, *Beyond Generation: The Rise of Agentic AI in State Government*, documents state pilots across document review, case routing, regulatory analysis, and benefits workflow tasks. Virginia's IT office piloted an agentic system for reviewing regulatory documents, allowing the system to search, retrieve, compare, and summarize across regulatory sources with limited manual checkpoints. Similar explorations are underway in other states for benefits coordination and procurement research.
The governance challenge is not that agentic systems are inherently unsafe. It is that the accountability questions they raise differ structurally from those that existing state AI governance frameworks were designed to answer.
Three Accountability Problems That Existing Frameworks Don't Cover
Upstream decision-making undermines downstream review.
Governance design for assistive AI focuses on the quality of the output at the human review step: is the recommendation accurate, is the model's confidence appropriate, is the reviewer equipped to evaluate it? Agentic systems shift consequential decisions upstream. Objective setting, action sequence planning, tool selection, and intermediate data retrieval all happen before a human sees any result.
A May 2026 analysis of government AI accountability, published in *Tech Policy Press*, observed that in agentic workflows human review often arrives at the end of a decision chain after upstream logic has already shaped the outcome. At that point, reviewers are ratifying a trajectory rather than exercising genuine oversight. For a state program administrator, the standard human-in-the-loop control — a caseworker reviews the AI's eligibility flag before acting — does not reach the upstream steps that determined what data was retrieved, how it was interpreted, and what intermediate choices the system made.
Agentic outputs may be public records.
An April 2026 IANS Research symposium on agentic AI in state and local government flagged a transparency issue without a clean parallel in assistive AI. When an agentic system executing a state government task produces intermediate outputs — summaries, retrieval results, routing decisions, draft documents — those outputs may constitute public records under state open records laws. The explanation of how those outputs were generated, including the action sequence the agent followed, may also be subject to disclosure requests.
State agencies operating under public records obligations have not systematically analyzed whether agentic AI outputs fall within those obligations, or how they would respond to a records request for an agent's action log. IANS noted that state and local agencies face stricter and more fragmented transparency obligations than federal agencies — obligations that differ by state based on how records are defined in statute.
Agentic systems that act create a different security exposure than systems that generate text.
A generative AI system presents primarily a data exposure risk: it may reveal sensitive information or accept prompts that extract protected data. An agentic system that can create files, send queries to external systems, or file documents adds an execution risk layer. The system can be prompted to take actions that affect records and transactions, not merely return information.
The 2026 NASCIO-Deloitte Cybersecurity Study found that 78% of state CISOs cite third-party vendor breaches as their most anticipated threat, and 55% flag AI-enabled attacks as a growing concern. Both converge on agentic AI: a system connected to external services creates integration-layer exposure, and a system that can initiate actions is a more consequential target for adversarial manipulation than one that only generates text.
What NASCIO and the Urban Institute Recommend
NASCIO's *Beyond Generation* report recommends applying oversight practices developed for generative AI to agentic deployments before they go live. Specifically: designate an accountable owner for each agentic system, document what actions the system is authorized to initiate, establish authorization boundaries that limit access to the minimum required for the task, and build audit logs that capture the action sequence and not only the final output.
The Urban Institute's August 2026 playbook for state and local government officials, authored by Graham MacDonald (the Urban Institute's Chief Information Officer), frames the governance imperative as establishing accountability structures before agentic systems become embedded in public services. The playbook covers oversight design, security, and transparency, and explicitly flags that human review remains essential in high-stakes program areas — including TANF and similar safety-net programs — regardless of system capability.
Tennessee's CTO noted at the April 2026 NASCIO Midyear Conference that the biggest challenge in deploying agentic AI is not the technology itself but preparing the enterprise security policy architecture to accommodate systems that act on their own. Enterprise security policies designed for human access to tools do not map cleanly onto agentic systems: an agent needs credentials, permissions, and access boundaries that behave consistently across routine tasks and edge cases alike.
The NASCIO State CIO Survey released in 2026 found that 78% of state CIOs reported adopting an AI governance framework, up from 65% in 2025 — but CIOs described those frameworks as "very early, immature, and not strictly enforced." That characterization fits governance programs built for assistive AI running under the demands of systems that execute autonomously.
Four Governance Extensions State Executives Should Prioritize
An agentic AI governance extension does not require a separate framework. It requires augmenting the state's existing AI governance architecture in four specific areas.
Inventory authorized actions separately from capabilities. A system's capability inventory — what APIs, databases, and external services it can access — is not the same as its authorized action inventory — what it is permitted to do in production within each context. Governance documentation for agentic systems should record both. Gaps between the two create undefined operating space that functions simultaneously as a compliance gap and an attack surface.
Require action logs, not only output logs. The audit infrastructure that state AI governance programs built for generative tools records outputs and human review decisions. Agentic systems require logging at the action level: what the system queried, what it retrieved, what intermediate decisions it made, and what actions it executed. Without action-level logs, incident reconstruction and public records compliance are both impaired from the outset.
Apply pre-authorization gates at consequential action types. Rather than relying entirely on post-hoc review, governance for high-stakes agentic applications should designate action categories where the system must pause and return to a human before proceeding — eligibility determinations, document filing, resident-facing communications. This is the governance principle the Urban Institute's playbook identifies for safety-net programs: the review checkpoint belongs at the action gate, not only at the point where the system delivers a final result.
Extend vendor contract requirements to agentic capabilities. When an enterprise software vendor adds agentic functionality to an existing platform — as many enterprise vendors have been doing — the state's existing AI governance documentation may not cover those new capabilities. Governance programs should require vendors to notify the state when agentic functionality is added, describe what actions the capability can initiate, and provide documentation of how actions are logged and bounded. Several state IT programs have begun developing mid-contract AI review protocols for generative AI updates; the same protocol should extend to agentic feature introductions.
A Credible Alternative: Proceed by Use Case, Not Platform
Not every agentic AI deployment carries the same accountability demands. A state agency that deploys an agentic system to retrieve and compile publicly available procurement documentation carries different exposure than one that deploys an agent with write access to eligibility records. One credible governance approach is to tier agentic deployments by action scope — read-only retrieval, internal document generation, external-facing action — and apply full governance extension requirements only where the system can initiate actions that affect residents, records, or third-party systems. This lets agencies move on lower-stakes research and summarization tasks while building the governance architecture for higher-stakes deployments in parallel. The limitation of this approach is that action scope tends to expand over time as systems prove useful, which means governance that was proportionate at deployment may become insufficient within months if not reviewed at each capability change.
Sources and further reading
- NASCIO, *Beyond Generation: The Rise of Agentic AI in State Government* (March 2026): https://www.nascio.org/wp-content/uploads/2026/03/NASCIO_Agentic-AI-Report_2026_.a11y.pdf
- Urban Institute, *Responsible Agentic AI Playbook: A Practical Guide for State and Local Government Agencies* (August 2026): https://www.urban.org/research/publication/responsible-agentic-ai-playbook
- IANS Research, *Agentic AI: Adoption and Transparency Considerations for State and Local Government Agencies* (symposium, April 22, 2026): https://www.iansresearch.com/symposiums/details/2026/04/22/2026-symposium/april-22-agentic-ai—adoption-and-transparency-considerations-for-state-and-local-government-agencies
- NASCIO-Deloitte, *2026 Cybersecurity Study* (April 2026): https://www.nascio.org/wp-content/uploads/2026/04/2026-NASCIO-Deloitte-Cybersecurity-Study.pdf
- NASCIO, *The 2026 State CIO Survey: The State CIO in Motion — Priorities, Pressures, and Progress*: https://www.nascio.org/resource/the-2026-nascio-state-cio-survey-the-state-cio-in-motion-priorities-pressures-and-progress/
- MeriTalk, "States Urged to Apply Generative AI Safeguards as Agentic AI Expands" (NASCIO Midyear, April 2026): https://meritalkslg.com/articles/states-urged-to-apply-generative-ai-safeguards-as-agentic-ai-expands/
- Tech Policy Press, "AI Efficiency Can Undermine Accountability Even With Humans in the Loop" (May 5, 2026): https://www.techpolicy.press/ai-efficiency-can-undermine-accountability-even-with-humans-in-the-loop/
- Bank Info Security, "Agentic AI Emerges as the Next Frontier for State Government IT" (March 4, 2026): https://www.bankinfosecurity.net/agentic-ai-emerges-as-next-frontier-for-state-government-it-a-30916
Spartan X has worked on AI governance architecture for state government programs, including oversight design for AI systems operating in high-stakes eligibility and service delivery environments. The agentic AI accountability problems — action-level audit design, authorization boundary documentation, and pre-deployment behavioral testing — sit within the same AI assurance and verification domain where Spartan X's advisory and technical practices operate. The discipline that makes AI verification defensible in high-accountability operational contexts applies to the authorization architecture and incident-reconstruction capability that state agencies need before agentic systems go into production.
