Jul 2026· Universal Library of Innovative Research and Studies· 0 citations· 9 references
TL;DR
The central finding is that the same four points generalize without modification to AI coding agents and to general agentic workflows, where a defined purpose, an auditable trail, verification, and safe delivery produce tamper-evident evidence at every stage.
Abstract
This article examines how the four control objectives of the Continuous Compliance Control Protocol align with the requirements of ISO/IEC 42001 for managing an artificial intelligence system across its lifecycle, and how they generalize to autonomous agents. Organizations adopt artificial intelligence in regulated settings faster than they build the mechanisms that continuously prove governance, and a management system standard states what must be governed, while leaving open how durable evidence is produced as systems run. A baseline mapping establishes that the four control points meet the requirements of the standard for a conventional, human-in-the-loop deployment. The central finding is that the same four points generalize without modification to AI coding agents and to general agentic workflows, where a defined purpose, an auditable trail, verification, and safe delivery produce tamper-evident evidence at every stage. That evidence assembles into a chain of custody for the agent that supplies exactly the documentation an ISO/IEC 42001 audit expects. The work serves compliance leaders, audit professionals, and engineering teams who govern autonomous artificial intelligence.
Autonomous AI agents operating in enterprise environments require both standardized connectivity to production tools and a governance architecture for doing so safely. The Model Context Protocol (MCP), introduced in November 2024 and transferred to the Agentic AI Foundation under the Linux Foundation in December 2025, has reached 97 million monthly SDK downloads and adoption across all major AI providers within sixteen months of launch. The specification addresses connectivity; it does not address governance. Enterprise architects deploying agents in regulated, mission-critical environments face a structural gap: no architectural guidance exists for permission enforcement, risk-tiered execution, or audit trail requirements at the MCP protocol layer. This article reports three contributions derived from an eighteen-month production deployment connecting autonomous agents to fourteen enterprise systems across 270 globally distributed data centers. First, a three-tier integration pattern taxonomy maps tool risk profiles to appropriate governance mechanisms. Second, a permission manifest architecture embeds role-based access control (RBAC), rate limiting, and scope constraints into MCP server registration — making safety a protocol-level property rather than an application-level afterthought. Third, empirical measurement confirms a 73 percent reduction in per-tool engineering effort and complete cross-platform portability across three AI providers. These patterns provide enterprise architects with a validated governance framework for production MCP deployment.
Satish Chandra, Guruvelli· International Journal of Com...· 0 citations
As enterprises accelerate the adoption of autonomous and agentic AI, the need for robust governance has become a critical architectural priority. Large organizations operate under strict regulatory, operational, and financial constraints, where even a single incorrect payment, billing error, or missed reconciliation can lead to significant compliance violations, audit failures, and material financial losses. These environments depend on deterministic, traceable, and verifiable execution; therefore, AI-driven automation cannot operate freely but must be deployed on well‑defined “rails” that enforce consistency, accountability, and operational safety. This paper argues that the introduction of agentic AI requires a substantial expansion of traditional enterprise architecture principles to address new behavioral, security, and governance risks emerging from non-deterministic AI systems interacting with heterogeneous operational platforms-ERP, HCM, CLM, asset management, workflow engines, and domain-specific applications. We propose a governance-centered framework for safe agentic AI in enterprise settings, emphasizing lifecycle oversight (model management, testing, deployment, rollback), cross-system policy enforcement, and auditable decision lineage. Central to this framework is a security model grounded in Just‑In‑Time (JIT) and Just‑Enough‑Access (JEA) permissions, ensuring that AI agents receive only the minimal privileges required, only when needed, and never with long‑standing or system‑wide access. Additional safeguards include least‑privilege design, segmentation boundaries, continuous audit trails, agent identity isolation, controlled inter-agent communication, and human‑in‑the‑loop escalation for high-risk or sensitive tasks. These controls prevent unauthorized lateral movement, protect sensitive financial and HR data, and ensure agent actions remain aligned with organizational risk and compliance boundaries. By integrating these governance mechanisms with orchestration and policy engines, enterprises can achieve predictable execution, transparent reasoning, and resilient automation at scale. This work highlights why governance is not peripheral but foundational to the safe deployment of agentic AI
Elizabeth Koumpan, Vimal Dimpi· AHFE International· 0 citations
The rapid diffusion of data‑driven automation and agentic AI systems is reshaping the foundations of work, decision‑making, and human–technology interaction. As organizations move toward Society 5.0— Japan’s vision for a human-centered “super smart” society in which cyber-physical intelligence augments human capability across economic and social systems—there is an urgent need for operational architectures that are not only technologically capable but also fundamentally human‑centric. This paper presents an applied model using Intelligent Operations framework that integrates agentic AI, enterprise data fabric, human‑in‑the‑loop governance, and secure multi‑system orchestration, and enterprise digital twins that simulate processes and operational states for context-aware decision support. The result is an adaptive socio‑technical system that enhances human decision‑making rather than replacing it, while simultaneously enabling automation at operational scale.The research builds on fieldwork across finance, supply chain, HR, and complex asset‑intensive environments, where organizational processes are distributed across heterogeneous platforms such as ERP, HCM, workflow systems, enterprise data lakes, RPA tools, and emerging AI orchestration layers. Traditional human‑computer interaction models are insufficient in these environments because workers face fragmented data landscapes, inconsistent process execution, and increasing cognitive load. The proposed Intelligent Operations framework addresses these pain points by introducing an orchestration layer that harmonizes data, interprets context (including real-time insights from digital twin models), and deploys agentic AI workers capable of completing multi‑step tasks across systems.A key contribution of this work is the definition of agentic AI in enterprise socio‑technical ecosystems—AI agents equipped not only with language models and planning capability but also with secure access to enterprise systems through structured patterns such as passthrough APIs, workflow orchestration, Model Context Protocol (MCP), and agent‑to‑agent (A2A) collaboration. Rather than relying on brittle rule‑based workflows, the agents dynamically interpret goals, assess context, and plan actionable sequences while maintaining traceability, decision lineage, and auditability. This supports a new form of “digital labor” that works alongside human employees to augment cognitive, administrative, and analytical tasks. However, the framework insists on human‑in‑the‑loop governance, recognizing that human oversight remains essential for ethical, safe, and responsible AI deployment. The DMO acts as a security and compliance boundary—enforcing identity controls, audit trails, approval checkpoints, policy enforcement, and anomaly detection throughout the agentic automation lifecycle. This hybrid model ensures that automation amplifies human capability without bypassing institutional safeguards or creating new forms of risk.The paper also discusses the human‑centric business implications: reduced cognitive load for knowledge workers, increased transparency of decision processes, improvements in cross‑functional collaboration, and the redefinition of roles as humans transition from transactional executors to supervisors, interpreters, and strategic actors. Proposed framework becomes the backbone for Society 5.0 organizational design—linking people, processes, data, and intelligent systems through a unified operational fabric.This research demonstrates that when designed with ergonomics, human values, and socio‑technical principles at the center, agentic AI become powerful enablers of human‑centric, resilient, and adaptive enterprises.
Elizabeth Koumpan, Laurentiu Gabriel Ghergu, Łukasz Strack et al.· AHFE International· 0 citations
AI agents are moving into production workflows where they retrieve information, call tools, maintain state, and act on behalf of users or organizations, but many release decisions still rely on capability signals, demos, or behavioral tests that do not show whether an agent is ready to operate under production constraints. Capability is therefore not production readiness. This paper introduces the ProofAgent Index (PAI), a governance readiness index for AI agents. PAI combines four dimensions of deployment evidence: Evaluation, Context, Compliance, and Governance. Evaluation measures observed behavior, Context measures the operating environment that shapes that behavior, Compliance measures alignment with applicable rules and controls, and Governance measures whether the organization can authorize, monitor, audit, and control the agent during operation. PAI is implemented inside ProofAgent Harness, an open source infrastructure for auditable AI agent evaluation and governance. Validation across two heavily regulated domains, healthcare and finance, shows that PAI carries held out readiness signal and separates higher risk from lower risk configurations. The results show that context engineering strongly changes reliability, capability improves behavior but does not determine readiness, and governance evidence must remain visible rather than averaged away. PAI reframes agent release from a faith based deployment decision into an auditable readiness decision.
A dependency-aware OTA orchestration framework that addresses challenges in improving update success rates, efficiency in execution time and update requests through optimized scheduling, and feasibility in maintaining system-wide integrity by successfully reconciling stringent safety requirements and diverse update sensitivity constraints is proposed.
Juyeon Park, In-Young Ko· SIGSOFT FSE Companion· 0 citations
: As cybersecurity regulations such as ISO/IEC 27001 and the NIS2 Directive continue to expand in scope and complexity, organizations face growing challenges in translating regulatory obligations into actionable security policies and audit-ready evidence. Conventional compliance approaches rely on manual interpretation of regulatory texts, fragmented documentation repositories, and ad hoc audit preparation, introducing operational bottlenecks and exposing organizations to non-compliance risks. This paper presents a compliance management platform that operationalizes regulatory requirements through structured, expert-guided control implementation. It combines NLP extraction with human-supervised annotation to convert regulatory texts into machine-readable frameworks, enabling multi-framework management (ISO/IEC 27001:2022 and NIS2), control mapping, evidence tracking, and role-based audit workflows. In a task-based usability study with twelve participants, the platform scored 83.3 on the System Usability Scale (SUS), rated “excellent,” indicating that embedded guidance can reduce expertise barriers in cybersecurity compliance management.
M. Andrade, J. Almeida, José L. Oliveira· Proceedings of the 23rd Inte...· 0 citations