The AI assurance gap: CIOs need proof that agentic AI controls actually work

The document recommends rigorous assurance and governance for coding agents with operational authority: maintain an approved baseline, boundary-test results, a history of behavioral drift, and exception/intervention logs so management and auditors can review actions without relying on technical staff memory; autonomy should only scale as assurance, and internal teams remain responsible while independent board-level review is required.