Across regulated industries such as healthcare, pharma, banking, and insurance, the real AI governance decision is about allocating autonomy, not the technology itself.Enterprise AI architecture spans three different patterns:
Many technology teams follow the hype and re-label existing chatbots and rules engines as agents. The decision-making autonomy, however, remains the same. This is both an architecture and branding risk. Organisations struggle to estimate cost, risk, and trust when “agentic” can mean anything from a single LLM to a fully autonomous multi-agent swarm, and everything in between. This results in unclear business value and governance as an afterthought, rather than of governance by design. In regulated industries, where decisions such as claims settlement, drug safety triage, and regulatory submissions require a traceable approval trail, delegating them to unsupervised agents carries significant risk.
At the same time, treating every initiative as a rigid, rules-only workflow causes open-ended problems, such as competitive intelligence or scientific discovery.
The workflow-agent-hybrid choice can be resolved with a five-question approach.
1. Ask whether the process is ready for AI, whether its path is traceable and audit-critical, or needs adaptive reasoning, or if it needs both control and intelligence together. The answers to the above question point to workflow, agent, or hybrid.
2. Next, size the decision with an autonomy budget. The budget should have an explicit, process-level tolerance for unsupervised judgment. It should borrow from site-reliability engineering's error-budget discipline. This autonomy budget should be informed by regulatory exposure, reversibility, and the cost of catching an error late versus early.
3. Where should your autonomy budget live?
Give the autonomy budget a technical home. Separate a deterministic control plane — state machine, approval routing, audit ledger — from a bounded reasoning plane where agents interpret, draft, and negotiate. Auditable interfaces, such as the Agent-to-Agent (A2A) protocol and Model Context Protocol (MCP) connect the agents. Every path should have the same guardrails: human oversight, evaluation, cost ceilings, and audit logging.
4. Can every consequential action be traced back through a deterministic, logged control path, irrespective of the reasoning logic?
5. Does the interface between the control plane and the reasoning plane use a standard, auditable protocol? Or is autonomy designed as a part of single instruction?
Start with the workflow. Add agency only where reasoning earns it. Size it with an autonomy budget. Govern everything in between.
Applying this five-question approach changes AI outcomes in three measurable ways.
Figure 2: A decision flow for selecting the right architecture
As organizations adopt AI at scale across software development, data and analytics, healthcare, supply chain, and customer operations, the successful ones will not be those that deploy the most agents. Organisations that thoughtfully assess and define the appropriate level of autonomy for each problem will be the ones that derive genuine value from agentic AI.
I would like to extend my sincere gratitude to Sayanee Banerjee, Program Manager, Life Sciences and Healthcare business group, TCS, for co-creating this five-question approach with me.