Agentic AI Workflows in GRC

Breadth is what kills these programmes. Six half-automated cycles produce no defensible assurance and no credible number; one complete cycle produces both, and it is the artifact you take to the board for funding.

Good enough to answer: which obligations does this control satisfy, and who owns it. Perfection is not required; completeness for the chosen cycle is.

Leave it manual. The last 30% of sources will consume 70% of the integration budget and cover controls you test annually. Automate them only once the core is stable.

Because trust is the constraint, not capability. Give the organisation a quarter of watching evidence arrive correctly before you let anything draw a conclusion from it.

Run it silently alongside the analysts for one cycle and measure agreement. You want the disagreements — they tell you where the procedure is ambiguous, which is a finding in itself.

Orchestrator-mediated, with a shared knowledge graph for state. Avoid peer-to-peer entirely until you have an audit trail you would defend in front of a regulator.

Trend your override rate. If humans approve everything without change, the gate is theatre and should be re-tiered. If they override often, your policy or your model is wrong.

Bring them in during this phase, not after. An auditor who has agreed the evidence model in advance is a collaborator; one who meets it at fieldwork is a risk.

Because they are the two domains where executives most want to start and where an immature spine fails most publicly. Earn the credibility on control testing first.

Because you will not be able to prove it worked. Teams that skip the baseline end up arguing about whether things improved, which is an argument security always loses.

Yes. Pointing a model at an incoherent finding stream produces confident summaries of noise, and you only get one first impression with developers.

Complete enough to answer: which fielded versions contain this component, and who owns the fix. If you can answer that in minutes, the graph is good enough to build on.

Every dismissal is reversible and logged, and you review a sample every cycle. Measure the disagreements; they tell you where your rules are ambiguous.

Set a precision floor and hold to it. Comment on fewer things than you could; the restraint is what makes the comments read.

Good enough to argue with, which is the point. The value is that a review now happens at all for the two hundred features that previously got none.

Orchestrator-mediated with a shared graph for state. Peer-to-peer only inside one trust boundary, with mirrored logging.

Because it is the most visible and least forgiving place to be wrong. Earn the reliability on triage first.

Make registration the path to something they want — approved model access, a faster gate, a shared prompt library. Enforcement alone drives shadow deployment, which is worse than the problem you started with.

As a floor, yes. The value comes from the second pass, where you ask which of these your product's specific data and tool access actually make exploitable.

Your own first run. Measure, agree a floor no worse than that, then ratchet. Borrowed industry thresholds will not survive their first argument with a release date.

Start with a few hundred payloads covering each ingestion path, and grow it from your own findings. Every bypass anyone discovers against your product becomes a permanent regression test.

Because silent version drift is the failure mode most likely to invalidate your evidence without anyone noticing. It deserves the repetition.

Good at identifying well-known components, weaker on modified or statically-linked code. Sufficient to answer the exposure question at triage, which is the job it needs to do.

Usually service or commercial operations, not security — which is exactly why it needs an executive sponsor. Security is a consumer of this data, not its owner.

Documented, communicated and justified mitigation for a product that cannot be patched is a recognised outcome. Silence is not. The failure mode regulators penalise is the absence of a decision, not the absence of a patch.

It should, proportionately. A register that surprises them later is far more damaging than one that informs them now, and the first version is always the worst one you will ever show.

Yes, and that is the point. A baseline nobody is uncomfortable with is a baseline nobody measured properly.

It can, badly and repeatedly, at cost. Joining once at ingest is cheaper, faster and produces evidence with consistent provenance.

Yes. Automating triage on a broken detection set encodes the noise and makes it harder to see.

Because trust is the constraint. Let the team watch it be right for a quarter before it is allowed to decide anything.

Disproportionately. Most bad SOC calls are confident single-hypothesis calls, and a cheap second opinion is the correction.

Narrower than feels necessary. Widen on measured agreement between agent recommendation and human decision, never on optimism.

Your own incidents and your threat model, not a generic top-twenty. Coverage of what actually targets you beats breadth.

When the remaining human decisions are the ones you would want a person making anyway. That point arrives sooner than most teams expect and later than most vendors claim.

Because they are excluded from every existing control and hold most of the standing privilege. It is the largest gap and the least contested to close.

Draft by machine, confirmed by the owner. Unconfirmed descriptions are a hypothesis, and should be labelled as one in the review.

Because it needs an answer to what the person no longer needs, which nobody owns. The delta comparison is what makes it tractable.

When agreement in a risk band has been high for a quarter, and the action is reversible. Promote one band at a time.

Rarely, if last-used data drives it and restoration is trivial. Pilot on a friendly population and publish the restoration numbers.

On the elevation being slower than the shortcut. Optimise the elevation path obsessively before widening the policy.

Baseline them, freeze new ones immediately, and burn the backlog down on a published schedule. Freezing first is what stops the problem growing.

Anything that cannot be reversed quickly, and anything affecting more identities at once than you have rehearsed rolling back.

Because it predicts adoption better than anything else. A programme with a high invalid rate is spending credibility it will need later.

Usually not. This is a normalisation layer over the tools you have, and building it first tells you what a platform would need to do.

The application owner, with security as reviewer. Security-assigned tiers get argued with; owner-assigned ones get defended.

Sampled and reviewed every cycle, and reversible. The disagreements tell you where your rules are ambiguous, which is itself a finding.

Hold a precision floor and start with the highest-confidence categories. Ten merged diffs beat a hundred ignored ones.

Good enough to argue with, which is the point. The win is that a review happens at all for the features that previously got none.

Strict where the tier justifies it and advisory everywhere else. A uniformly strict gate is a uniformly ignored one.

Because it only works once the pipeline of record and the tiering exist. Built earlier it becomes another spreadsheet.

Partly. Tools give you inventory; what they rarely give you is ownership and data classification joined to it, and those are what turn a finding into an action.

Derive what you can, then run a one-off reconciliation with the business. Do it once properly rather than tagging repeatedly and badly.

Only if exposure is computed badly. Sample the deprioritised set periodically and check - the sample is cheap and it keeps the ranking honest.

Because an agent that can change infrastructure without these properties is the largest self-inflicted risk in the whole programme.

Yes, disproportionately. Letting engineers ask the graph plain questions is how the graph earns its keep and how you find out where it is wrong.

Then that is the finding. Bring the highest-risk estate under code first; remediating manually managed infrastructure is an endless job.

Narrower than feels necessary. Every widening should point at a quarter of data showing the agent and the engineers agreed.

Because it depends on the graph, the ownership data and the evidence pipeline. Built first it becomes another dashboard nobody opens.