From Assistive to Agentic: A Governance Category Shift
Generative AI assistants respond to a human prompt, produce output, and stop. The human remains in the action loop at each step. An agentic AI system receives a goal, plans a sequence of actions to reach it, and executes those actions using available tools — querying databases, retrieving and comparing documents, delegating subtasks to other models, and filing results — without returning to a human at each decision point.
NASCIO's March 2026 report, Beyond Generation: The Rise of Agentic AI in State Government, notes that eight states reported already having some agentic AI tools in production, and it highlights early efforts. NASCIO says that under a July 2025 executive order from then-Governor Glenn Youngkin, Virginia's pilot would use an agentic AI tool to scan existing regulations and guidance for conflicts with statute and redundancies (NASCIO, and Bank Info Security reported on March 4, 2026 that Virginia is piloting such a tool. NASCIO also reports that the Texas Department of Transportation is piloting an AI agent in its complaint-management system for case assignment (NASCIO. Alaska is considering agentic features for its myAlaska portal, including document retrieval and eligibility checks, and Tennessee is seeking an ERP system with agentic capabilities to flag procurement bottlenecks and compliance risks (NASCIO.
The governance challenge is not that agentic systems are inherently unsafe. It is that the accountability questions they raise differ structurally from those that existing state AI governance frameworks were designed to answer.
Three Accountability Problems That Existing Frameworks Don't Cover
Upstream decision-making undermines downstream review.
Governance design for assistive AI focuses on the quality of the output at the human review step: is the recommendation accurate, is the model's confidence appropriate, is the reviewer equipped to evaluate it? Agentic systems shift consequential decisions upstream. Objective setting, action sequence planning, tool selection, and intermediate data retrieval all happen before a human sees any result.
A May 2026 Tech Policy Press analysis by Nicolas Spatola argued that human-in-the-loop review in government AI can become procedural: agencies should ask whether officials are "being asked to interpret outputs or merely ratify them." Agentic workflows sharpen that problem. When the system has already chosen what to retrieve and how to sequence its steps, the reviewer at the end may be ratifying a trajectory rather than overseeing it. For a state program administrator, the standard human-in-the-loop control, a caseworker reviewing the AI's eligibility flag before acting, may not reach the upstream steps that determined what data was retrieved, how it was interpreted, and what intermediate choices the system made.
Agentic outputs may be public records.
Agentic systems raise a transparency issue without a clean parallel in assistive AI. When an agentic system executing a state government task produces intermediate outputs (summaries, retrieval results, routing decisions, draft documents), those outputs may constitute public records under state open records laws. The explanation of how those outputs were generated, including the action sequence the agent followed, may also be subject to disclosure requests. This is the article's own analysis, not a finding from a cited source, and the answer may differ by state because open records statutes define records differently.
Agencies deploying agentic systems should determine, before deployment, whether agent outputs and action logs fall within their state's public records definitions and how they would answer a records request for an agent's action log.
Agentic systems that act create a different security exposure than systems that generate text.
A generative AI system presents primarily a data exposure risk: it may reveal sensitive information or accept prompts that extract protected data. An agentic system that can create files, send queries to external systems, or file documents adds an execution risk layer. The system can be prompted to take actions that affect records and transactions, not merely return information.
The 2026 NASCIO-Deloitte Cybersecurity Study, which surveyed CISOs from all 50 states, the District of Columbia and the U.S. Virgin Islands, found that 78% rated security breaches involving third parties as a threat in the coming year, the highest of any category and up from 73% in 2024. Fifty-five percent rated AI-enabled attacks as a threat, down from 71% in 2024. Both figures matter for agentic AI: a system connected to external services creates integration-layer exposure, and a system that can initiate actions is a more consequential target for adversarial manipulation than one that only generates text.
What NASCIO and the Urban Institute Recommend
NASCIO's Beyond Generation report says its earlier generative AI recommendations "still stand" for agentic AI, and adds security practices adapted from the OWASP Top 10 for Agentic Applications: give agents only the minimum permissions needed for each tool or task, require human approval for destructive or sensitive actions, run agents in isolated environments, validate AI-generated plans against policy before execution, issue short-lived session credentials, and "keep detailed, tamper-proof records of AI actions." The Urban Institute playbook adds the ownership layer: each agent should have an accountable owner, and a responsible agentic AI lead should be empowered to pause or reject agents that do not meet the organization's criteria.
The Urban Institute's August 2026 Responsible Agentic AI Playbook, authored by Graham MacDonald (the Urban Institute's chief information officer and vice president of technology and data science, sets out principles for oversight and ownership, risk minimization and an accessible audit trail. It warns against "human rubber-stamping": where human oversight is called for, it "must be meaningful," and systems should measure how meaningful that review actually is. The federal Administration for Children and Families' TANF peer network lists the playbook as a resource to help TANF agencies decide where AI can improve operations and where human review remains essential.
At the April 2026 NASCIO Midyear Conference, Tennessee CTO Jerry Jones described workforce readiness as the biggest challenge in moving from AI that assists to AI that acts ("It's not IT, it's the people"), and said states must first establish enterprise security policies aligned to NIST frameworks and formal oversight bodies (StateTech, May 6, 2026. Security policy matters for agentic systems in a specific way: an agent needs credentials, permissions and access boundaries that behave consistently across routine tasks and edge cases alike.
The 2026 NASCIO State CIO Survey found that 78% of state CIOs reported adopting an AI governance framework, up from 65% in 2025. But as one state CIO put it, "virtually all options were selected with the caveat that these efforts are very early, immature and/or not strictly enforced." If that caveat is representative, it fits governance programs built for assistive AI running under the demands of systems that execute autonomously.
Four Governance Extensions State Executives Should Prioritize
An agentic AI governance extension does not require a separate framework. It requires augmenting the state's existing AI governance architecture in four specific areas.
Inventory authorized actions separately from capabilities. A system's capability inventory — what APIs, databases, and external services it can access — is not the same as its authorized action inventory — what it is permitted to do in production within each context. Governance documentation for agentic systems should record both. Gaps between the two create undefined operating space that functions simultaneously as a compliance gap and an attack surface.
Require action logs, not only output logs. The audit infrastructure that state AI governance programs built for generative tools records outputs and human review decisions. Agentic systems require logging at the action level: what the system queried, what it retrieved, what intermediate decisions it made, and what actions it executed. Without action-level logs, incident reconstruction and public records compliance are both impaired from the outset.
Apply pre-authorization gates at consequential action types. Rather than relying entirely on post-hoc review, governance for high-stakes agentic applications should designate action categories where the system must pause and return to a human before proceeding — eligibility determinations, document filing, resident-facing communications. This mirrors NASCIO's recommendation to require human approval for destructive or sensitive actions, and the Urban Institute's warning that oversight which merely approves agent output is not oversight: the review checkpoint belongs at the action gate, not only where the system delivers a final result.
Extend vendor contract requirements to agentic capabilities. When an enterprise software vendor adds agentic functionality to an existing platform — as many enterprise vendors have been doing — the state's existing AI governance documentation may not cover those new capabilities. Governance programs should require vendors to notify the state when agentic functionality is added, describe what actions the capability can initiate, and provide documentation of how actions are logged and bounded. Where a state already requires mid-contract review of generative AI updates, the same protocol should extend to agentic feature introductions.
A Credible Alternative: Proceed by Use Case, Not Platform
Not every agentic AI deployment carries the same accountability demands. A state agency that deploys an agentic system to retrieve and compile publicly available procurement documentation carries different exposure than one that deploys an agent with write access to eligibility records. One credible governance approach is to tier agentic deployments by action scope — read-only retrieval, internal document generation, external-facing action — and apply full governance extension requirements only where the system can initiate actions that affect residents, records, or third-party systems. This lets agencies move on lower-stakes research and summarization tasks while building the governance architecture for higher-stakes deployments in parallel. The limitation of this approach is that action scope tends to expand over time as systems prove useful, which means governance that was proportionate at deployment may become insufficient within months if not reviewed at each capability change.
Sources and further reading
- NASCIO, Beyond Generation: The Rise of Agentic AI in State Government (March 2026): https://www.nascio.org/wp-content/uploads/2026/03/NASCIO_Agentic-AI-Report_2026_.a11y.pdf
- Urban Institute, Responsible Agentic AI Playbook: A Practical Guide for State and Local Government Agencies (August 2026): https://www.urban.org/research/publication/responsible-agentic-ai-playbook
- NASCIO-Deloitte, 2026 Cybersecurity Study (2026): https://www.nascio.org/wp-content/uploads/2026/04/2026-NASCIO-Deloitte-Cybersecurity-Study.pdf
- NASCIO, The 2026 State CIO Survey: The State CIO in Motion — Priorities, Pressures, and Progress: https://www.nascio.org/resource/the-2026-nascio-state-cio-survey-the-state-cio-in-motion-priorities-pressures-and-progress/
- MeriTalk, "States Urged to Apply Generative AI Safeguards as Agentic AI Expands" (March 30, 2026): https://meritalkslg.com/articles/states-urged-to-apply-generative-ai-safeguards-as-agentic-ai-expands/
- Tech Policy Press, "AI Efficiency Can Undermine Accountability Even With Humans in the Loop" (May 5, 2026): https://www.techpolicy.press/ai-efficiency-can-undermine-accountability-even-with-humans-in-the-loop/
- Bank Info Security, "Agentic AI Emerges as the Next Frontier for State Government IT" (March 4, 2026): https://www.bankinfosecurity.com/agentic-ai-emerges-as-next-frontier-for-state-government-it-a-30916
- StateTech, "NASCIO 2026 Midyear: States Shift From AI That Assists to AI That Acts, Tennessee CTO Says" (May 6, 2026): https://statetechmagazine.com/article/2026/05/nascio-2026-midyear-states-shift-ai-assists-ai-acts-tennessee-cto-says
Spartan X has served as a trusted AI advisor to Colorado state leadership, including CDLE, OIT and the Governor's office, and extended that advisory model to Florida in 2025. Its AI governance and risk framework work covers areas such as bias, explainability, data provenance and compliance, which bear on the problems this article describes. The discipline that makes AI verification defensible in high-accountability contexts applies directly to the authorization architecture and incident-reconstruction capability state agencies need before agentic systems go into production.
