An agentic AI governance professional decides what an AI agent may do, on whose authority and within what limits, then proves that those limits held. The skills fall into eight areas: architecture literacy, authority and identity, risk and threat modeling, oversight and containment, evaluation, evidence, incident response, and regulation at scale. You prove each one with something you can produce, such as an authorization record, a tested kill switch or a reconstructed decision.
Agentic AI governance is the work of bounding, supervising and evidencing the actions that AI agents take for an organization. GAICC’s guide to agentic AI governance explains the discipline itself. The skills here are personal ones. They describe what you must be able to decide, sign and defend.
The map follows the eight domains that the Global AI Certification Council (GAICC) wrote for the GAICC Agentic AI Governance Professional (AAIGP). They are set out in the AAIGP Examination Content Outline (1st edition, 2026). Training routes, fees and enrollment for the GAICC AAIGP credential are on its own page.
If you are still weighing the credential itself, read what the AAIGP certification is and who it is for first.
What an agentic AI governance professional is accountable for
An agentic AI governance professional answers for two things: the authority an agent holds, and the evidence that the authority is safe to grant. GAICC’s content outline places every exam item in one of four decision seats. You authorize or refuse, escalate or contain, disclose or hold, and promote or demote autonomy.
Each seat rests on the same five-part question about the system: what the agent may do, who granted that power, where its limits sit, who watches it and how it stops. Every skill below exists to answer some part of that question in writing.
The GAICC Code of Ethics, which the content outline also calls the Code of Professional Conduct, turns the question into a personal duty for AAIGP holders. A holder must never recommend or approve more agent autonomy than the assurance evidence supports. Where the authority granted and the evidence held drift apart, the holder must say so in writing. That rule makes evidence literacy a skill of its own, because you need to know exactly what you hold before you sign.
Employers describe the same work. Three postings read on 27 October 2026 show the pattern:
- An identity security vendor’s identity governance role (first published 5 September 2026) lists experience governing non-human identities, AI agents included, as a plus.
- An AI model developer’s agent security compliance role (5 October 2026) includes defining which agent actions need human approval and owning the policy for agent risk acceptances. The posting notes that “very few people have governed AI agents at scale.”
- A European manufacturer’s live AI agent governance specialist ad wants every agent recorded with an accountable owner, a risk class, a permission model and a lifecycle status.
Read such ads closely, because many compliance postings now ask you to use agentic tools in your own work. Using an agent and governing one are different skills, and this page covers the second.
The eight skill areas and the evidence for each
The eight skill areas match the eight domains of the AAIGP content outline, and you can prove each one with an artifact or a test. The weights below are exam weights, so they show where the exam samples most heavily.
| Domain (exam weight) | What you can do | Evidence that proves it |
| I. Agentic AI Systems and Architecture Literacy (12%) | Read an agent design and find where the agent decides, what it can call and what it remembers | An action-surface inventory that tags every tool as read, write, transactional or irreversible |
| II. Agent Authority, Identity and Delegation (14%) | Grant, limit and withdraw authority, and trace it from the human principal through every sub-agent | An authorization record with owner, identity, scoped grants, limits, delegation map and release criteria |
| III. Agentic Risk Assessment and Threat Modelling (15%) | Find risks that exist only because the system acts, such as instructions hidden in content it reads | A threat model of every path untrusted content takes into the agent, and an agentic impact assessment |
| IV. Human Oversight, Control and Containment (14%) | Put human approval where actions cannot be undone, and design a stop that works under load | An approval-gate design with timeouts and safe defaults, and a kill-switch test record |
| V. Agent Evaluation, Assurance and Red Teaming (12%) | Commission tests of whole task sequences and turn results into an argument for release | Behavioral acceptance criteria, a red-team scope and an assurance case |
| VI. Observability, Audit Evidence and Forensics (10%) | Specify what an agent must record and rebuild a past action from those records | A trace specification and one written decision reconstruction |
| VII. Agentic Incident Response, Liability and Third-Party Governance (11%) | Run the response when an agent causes harm, and settle who pays before it does | An incident playbook for autonomous action and a liability map across the supply chain |
| VIII. Regulatory Frameworks and Enterprise Scaling for Agentic AI (12%) | Apply current law and standards to agents and report the whole portfolio upward | A framework mapping for one agent and a one-page autonomy report for a board |
Under the eight domains, the outline lists 38 competencies, five in most domains and four in Domains V and VI, and every exam item is written against their performance indicators. Domain III carries the largest weight, at 15 percent. The outline singles out Domain II as the domain that separates agentic governance from all earlier AI governance practice. If you come from policy or audit work, plan extra practice time there.
Technical literacy for agents, defined
You need to read agent designs, permission scopes and logs; you do not need to write code. The content outline pitches Domain I at the depth a governance decision needs, without asking you to become an engineer. It also says no exam question can be answered from vendor terminology.
In practice, that literacy covers six abilities:
- Telling an assistant, an automated workflow, a single agent and a multi-agent system apart, and spotting when a copilot starts acting on its own.
- Reading a tool list and sorting each action into read, write, transactional or irreversible.
- Following a control loop to see where the model plans, where fixed code decides, and what ends the loop, such as a step budget or recursion limit.
- Naming the kinds of agent memory, from session context to long-term and shared stores, and saying which ones hold personal data.
- Asking what a tool connection is allowed to do. The Model Context Protocol (MCP) authorization rules of 28 July 2026 build on the OAuth 2.1 draft. Scopes and tokens are the questions to raise.
- Reading a trace line by line: inputs, retrieved context, tool calls and parameters, approvals and outcomes.
Product and framework names change often. Study the patterns underneath them, because those are what the decisions turn on.
Does your background transfer?
Every common starting point carries some of the domains with it, and none carries all eight. Find your row, then plan your practice around the gap column.
| Background | What transfers (domains) | Gap to close |
| AI governance (policy, AI management systems, model risk) | Impact assessment, risk registers, ISO/IEC 42001 scope and controls, reading regulation (III.D, III.E, VIII.A, VIII.B) | Architecture literacy (I), authority design for non-human actors (II), oversight at machine speed (IV) |
| Privacy or legal | Data protection exposure of agent memory (I.D), breach notification (VII.B), contracts and liability (VII.C), automated decision rights (VIII.A) | Reading tool surfaces and traces (I, VI), containment design (IV.C), threat modeling (III.B) |
| Security or identity and access management | Non-human identity, credential rotation, least privilege, threat modeling, red teaming (II, III.B, III.C, V.B) | Impact on people who never use the agent (III.D), meaningful oversight and automation bias (IV.A), board reporting (VIII.E) |
| Internal or external audit | Evidence standards, three lines of defense, telling asserted assurance from evidenced assurance (V.D, VI.D, II.C) | Behavioral evaluation (V.A), threat modeling (III.B), explaining non-deterministic behavior honestly (VI.B) |
| ML or platform engineering | Architectures and control loops, evaluation harnesses, production monitoring (I, V.A, V.C, VI.C) | Accountability allocation (II.C), liability (VII.C), regulation (VIII.A), the human operating model (IV.D) |
| Enterprise, operational or third-party risk | Risk appetite, taxonomies, escalation triggers, vendor due diligence (III.E, VII.D) | Agent-specific risk types such as goal drift and runaway loops (III.A), architecture (I), trace evidence (VI.A) |
Two Handbook rules matter while you plan. The credential requires no work experience, and 32 contact hours of training is the only entry rule. GAICC strongly recommends AI governance fundamentals first, through its Certified Professional in AI Governance (CPAIG) or an equivalent credential, because AAIGP does not re-teach them. Choosing a route from each starting point is a separate question, which GAICC’s forthcoming guide on how to become an agentic AI governance professional will answer.
With the gaps named, the useful next step is to build each skill on a case you can show other people.
One practice case for all eight domains
Build every practice artifact on one invented agent, so the pieces connect the way they do in a real program. The case below is illustrative and uses no real company.
The agent works in accounts payable at a mid-size firm. It reads supplier invoices from a shared mailbox and matches each one to a purchase order in the finance system. It then drafts a payment run and may release payments below a limit you set. A second agent, called by the first, checks supplier bank details before payment.
This invented agent is useful because it holds every feature that makes agents hard to govern. It reads untrusted content in the form of invoice attachments. It holds a credential to a finance system, takes an action that is hard to reverse, and delegates to a sub-agent.
Work from a written description, and keep employer data out of your files so you can share them later. Never test a live agent at work without written rules of engagement and the owner’s approval.
Building authority and architecture skills (Domains I and II)
You build these skills by mapping the agent’s action surface first, then writing the authorization that bounds it. Five steps produce both artifacts:
- List every tool, API and connector the invoice agent can call, and tag each action. Note which memory survives between runs.
- Mark where the model decides and where fixed code decides, and write down the conditions that end each run.
- Draft the authorization record. Give each agent its own attributable identity and a named human owner. Set scoped grants per environment, a payment limit, a daily volume limit and the threshold above which a person must approve.
- Draw the delegation chain from the finance manager to the agent to the bank-check sub-agent. Mark each hop where accountability could thin out. Then test for a confused deputy: could the sub-agent spend the main agent’s authority on a request nobody made?
- Write the release criteria and the decommission steps, covering revoked credentials, cleared memory and returned data.
A good self-test is to hand the record to a colleague. If they cannot say what the agent is forbidden to do, the record is not finished. The controls behind these records, such as distinct agent identities and permissions scoped by consequence, are explained in how to govern AI agents that take autonomous actions.
Building risk and oversight skills (Domains III and IV)
Risk and oversight skills come from one exercise: find where the invoice agent could cause harm, then place the human check and the stop at those exact points.
Start the Domain III work with indirect prompt injection. Suppose a supplier’s PDF carries hidden instructions to change the bank account on file. Trace every route by which outside content reaches the agent’s context, including the mailbox, attachments and tool outputs. Next, ask whether the agent could send supplier bank data outside the firm through its email tool.
Then write an agentic impact assessment. Cover people who never touch the agent, such as suppliers paid late or paid twice. Rate reversibility, how quickly anyone would notice, and the time from error to harm. The scoring method belongs to a full AI agent risk assessment, and your skill is applying it and defending each score.
Domain IV turns those findings into oversight. Place approval gates at payment release above the limit and at any bank-detail change. Leave routine matching ungated, because asking a person to approve every single invoice breeds approval fatigue, and tired reviewers stop reading what they sign. Give the reviewer enough context to refuse. Then decide what happens on timeout: the payment waits.
For containment, name who may halt the agent, by what mechanism and how fast. Write a kill-switch test to run in a sandbox. Finally, set a promotion path: shadow mode first, explicit graduation criteria, and automatic demotion after an incident or a failed evaluation.
Where the European Union Artificial Intelligence Act (EU AI Act) applies, these skills meet a legal duty. Article 14 of the EU AI Act asks that a person can interrupt a high-risk system through a “stop” button or similar procedure. It applies to Annex III high-risk systems from 2 December 2027.
Building assurance and evidence skills (Domains V and VI)
Assurance skills mean commissioning tests of behavior and turning the results into an argument someone can audit. Evidence skills mean specifying the trace and rebuilding a decision from it.
For Domain V, write behavioral acceptance criteria for the invoice agent. It must call the right tools in the right order, match before paying, and refuse when a purchase order is missing. Model benchmarks score what the model outputs. Trajectory evaluation scores the agent’s whole sequence of steps, which is what tells you whether payments are safe.
Next, scope a red-team exercise covering injection, privilege escalation, data leakage and unsafe payment. Agree the rules of engagement first. Require a re-test after every fix, and again before any promotion to more autonomy. Treat a vendor’s model update as a change-control event that reruns your regression suite.
Then write the assurance case. State the claim, for example that the agent may release payments below the limit. List the controls, the evidence for each, and the residual risk someone has accepted by name. Mark any point where assurance is asserted and nobody has evidence.
For Domain VI, draft the trace specification. Record inputs, retrieved context, reasoning artifacts, tool calls with parameters, results, approvals and outcomes, across both agents. Set retention against data minimization, and protect the logs from tampering by people and by agents. A 2024 peer-reviewed paper, Visibility into AI Agents, assessed agent identifiers, real-time monitoring and activity logging as three ways to make agents visible.
Finally, reconstruct one decision. Invent a duplicate payment, write the trace it would leave, and explain from that trace how it happened. Separate the mechanism from any talk of intent. Admit where non-determinism limits what you can say, and keep the explanation plain enough for a finance director.
Building response, liability and scaling skills (Domains VII and VIII)
You practice these skills on paper, with a tabletop incident, a liability map and a page for the board.
For Domain VII, run the tabletop. The invoice agent has paid a supplier whose bank details a fraudster changed. Sequence detection, containment, halt and evidence preservation, and keep the traces before anyone fixes anything. Scope every payment the agent made since the change, plan recovery, then decide on disclosure. If you decide not to notify someone, write down why.
Then map liability across the model provider, the platform and tool vendors, the builder and your firm as deployer. List the contract terms you would want, such as audit rights, warranties and indemnities. Note where substantially modifying a high-risk system, or changing a system’s intended purpose so that it becomes high-risk, makes a deployer count as a provider under Article 25 of the EU AI Act. Close with a post-incident review that examines authority and oversight design, so the operator is not the default culprit.
For Domain VIII, map the invoice agent to the frameworks you already run. Show where it sits in an ISO/IEC 42001 management system scope. Then show how the Govern, Map, Measure and Manage functions apply from the AI Risk Management Framework of the National Institute of Standards and Technology (NIST). Extend impact assessment with ISO/IEC 42005:2025. The NIST framework does not discuss AI agents, and its generative AI profile names autonomous agents only once, in a list of security threats, so your mapping has to fill that gap with reasoning.
Write the board page last, drawing on the agent registry so no shadow agent is missed. Show how much autonomy the firm has granted, the main risks, the incident trend, and every place where authority runs ahead of assurance. Agent guidance is also appearing outside the EU and US, as Singapore’s framework for agentic AI shows, so add one line on which regimes you watch.
Once the artifacts exist, the work moves to showing them to others and keeping them current.
Proving the skills in interviews and at work
Hiring panels trust artifacts and reasoning, so bring invented or redacted records and expect scenario questions about what you would decide. The questions below are illustrative, written for governance, risk and assurance roles.
| Domain | A question you may be asked | What a strong answer shows |
| I | Here is a design document for a support agent. Where does it act without saying so? | You find write tools, persistent memory and sub-agent calls, then classify each action |
| II | A product team wants its agent to run under a shared service account. What do you say? | You ask for an attributable identity, scoped and time-bound grants and a named owner, and explain what traceability is lost |
| III | The agent reads customer emails and can send replies. What worries you most? | Injection through email content, data leaving through the send tool, and testing sized to the authority granted |
| IV | Reviewers approve hundreds of agent actions a day and reject almost none. Is oversight working? | You spot nominal oversight and automation bias, move gates to irreversible actions and check reviewer context |
| V | The vendor upgraded the model overnight. What happens before the agent runs again? | Change control, a rerun of behavioral regression tests, and autonomy held until results are in |
| VI | A regulator asks why the agent declined a claim. What do you hand over? | A reconstruction from traces, honest limits on certainty, and an explanation a claimant can follow |
| VII | An agent sent confidential files to the wrong client. What are your first moves? | Contain and halt, preserve traces before fixing, scope every action taken, assess notification, then review the authority design |
| VIII | The board asks how much autonomy the company has granted. How do you answer? | A portfolio view from the agent registry, autonomy tiers, incident trend and gaps where authority exceeds assurance |
On a resume, name the decision and the artifact. A line such as “designed approval-gate placement and kill-switch tests for a payments agent” says more than a list of tools. Leave out efficiency percentages you cannot evidence, because a panel will ask for the record behind any number.
Describe your role honestly. Governing an agent means you set or reviewed its authority, oversight or evidence. Building one or using one in your own work is a different claim. If you hold the credential, write the full name, GAICC Agentic AI Governance Professional (AAIGP), so nobody confuses it with a similar acronym from another body. Titles, demand and pay for these skills will be the subject of GAICC’s forthcoming guide to agentic AI governance careers.
Keeping the skills current
Agent governance moves faster than its rules, so keep a short watch list and record the governance work you already do as development. For AAIGP holders, the Candidate Handbook (v1.2, 21 October 2026) sets 60 hours of continuing professional development (CPD) per three-year cycle. Those hours split across GAICC’s AI Competence Triangle as Technology 27, Humanity 12 and Strategy 21, with no elective category. Hours can come from agent authorization, agentic risk assessment, oversight design, evaluation, audit or incident response.
The watch list below holds the sources that most often change what an agent governor should do. Status is as at 27 October 2026.
| Source | What to watch | Status |
| EU AI Act, Articles 14 and 26 | Human oversight design; deployers must give oversight to people with the competence, training and authority to do it | Apply from 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I, after Regulation (EU) 2026/1744 |
| Regulation (EU) 2026/1744 | An amending act that names agentic AI only inside a notified-body designation code | In force since 27 July 2026 |
| NIST Center for AI Standards and Innovation (CAISI) | The AI Agent Standards Initiative: industry standards, open protocols, agent security and identity research | Announced 17 February 2026 |
| NIST National Cybersecurity Center of Excellence (NCCoE) | A concept paper on software and AI agent identity and authorization, covering delegation, logging and provenance | Draft; comments closed 2 April 2026 |
| OWASP GenAI Security Project | The Top 10 for Agentic Applications, a list of agent-specific security risks | Published December 2025 |
| Model Context Protocol | Authorization and security best practice for tool connections | Version dated 28 July 2026; OAuth 2.1 is still an IETF draft |
| ISO/IEC JTC 1/SC 42 | Any standard written for AI agents | No project with “agent” in its title as at 14 October 2026; AI red teaming (ISO/IEC TS 42119-7) listed as an approved work item |
| Infocomm Media Development Authority (IMDA), Singapore | The Model AI Governance Framework for Agentic AI, issued as guidance for organizations | Launched 22 January 2026; updated May 2026 |
Pick two or three rows that touch your agents and check them each quarter. When one moves, update the artifact it affects, then log the hours against the right competency. The habit also serves the Professional Competence principle in GAICC’s code, which asks holders to stay current in a field that changes faster than its regulation.
Where the skills lead next
The skills lead in three directions: a credential that tests them, a specialism in one domain, or a lead role across all eight.
GAICC’s AAIGP exam tests the eight domains through scenarios, and 85 percent of its items sit at the application or analysis level. A specialism suits people who want depth. Identity and delegation, red teaming, forensics and liability each support a career of their own. A lead role needs all eight, plus the Domain VIII habit of telling a board plainly where authority has outrun assurance. Whichever direction you choose, keep your practice artifacts as a working file. Each new agent you govern will need the same eight records, and the next reviewer will compare them with your last set.
How agentic AI governance differs from general AI governance as a discipline will be set out in a forthcoming GAICC comparison. The argument for why AI governance professionals need these skills now will get its own GAICC article as well.
Frequently Asked Questions
Which agentic AI governance skill is hardest to learn?
GAICC’s content outline points to authority design, Domain II, as the domain that separates agentic governance from all earlier AI governance practice. It asks you to trace authority across delegation hops, spot a confused deputy and size an agent’s blast radius before release. Model-era governance had no direct equivalent for those tasks, so give this domain the most deliberate practice.
Can I practice these skills on a live agent at work?
Only with written rules of engagement and the agent owner’s approval. The content outline expects red teaming against live or production-like systems to run under agreed rules and safety controls. Without them, testing can trigger the very harm you are trying to prevent. Start on an invented case or a sandbox copy, then move to production work through your employer’s change process.
Do I need the AAIGP credential to work in agentic AI governance?
No. The work itself has no licensing rule, and the EU AI Act asks for competence, training and authority without naming any credential. A credential gives you a structured syllabus and an independent test of judgment, which helps when you cannot yet show past work. The AAIGP requires 32 contact hours of training and no work experience, so you can sit it while you build your artifacts.
Is there an ISO standard written for AI agents?
Not yet. ISO’s published project data showed no project under ISO/IEC JTC 1/SC 42 with “agent” or “agentic” in its title as at 14 October 2026. Governance professionals apply ISO/IEC 42001 and ISO/IEC 42005 to agents and add organization-defined controls where those standards say nothing. Treat any claim of an “ISO agent standard” with care until a project appears.
How do agent security skills differ from agent governance skills?
Security specialists build and test the controls: identity, credentials, sandboxes and adversarial tests. Governance professionals decide how much authority an agent should hold, where people must approve, what evidence must exist and who answers for the result. The two overlap most in Domains II, III and V. Many strong governance practitioners come from security, then add oversight, impact and board skills.
What is the difference between human in the loop and human on the loop?
With a human in the loop, a person approves an action before it happens. With a human on the loop, the agent acts and a person monitors, able to step in or stop it. A human out of the loop means no person reviews actions as they happen. Matching the mode to how reversible and how frequent each action is forms a core Domain IV skill.
Does the EU AI Act require people with these skills?
For high-risk AI systems, yes. Article 26(2) requires deployers to assign human oversight to people with the necessary competence, training and authority, plus support. That duty applies to Annex III high-risk systems from 2 December 2027. The Act does not set rules by agency as such, so an agent falls under these duties only when its use is classed as high-risk.
