courtesy: Project NANDA (LinkedIn)
At the India AI Impact Summit 2026, Cognizant's Responsible AI Office convened a session on governing autonomy in agentic and multi-agent systems. The panel brought together Ellie Sakhaee of Google, Alpesh Shah of the IEEE Standards Association, Apoorva Goyal of Insight Partners and Praveen Tanguturi of Cognizant AI Lab, with Amir Banifatemi of Cognizant co-moderating.
The session opened with two questions to the audience. How many had built or tried an AI agent? Most hands went up. How many were worried about what agents might do? Only a few. That gap captures the moment: the technology is reaching production faster than the governance needed to support it.
Autonomy is a continuum
Sakhaee rejected the idea that systems are simply agentic or not. Agents sit on a continuum across memory, planning horizon, ability to act and independence. A research assistant that gathers information sits at one end; an autonomous vehicle at the other. Oversight should match the position on that continuum, and it grows harder as agents begin to coordinate with other agents.
Panellists also argued that agentic governance cannot be added after scale, as earlier technology generations assumed. It has to run continuously, alongside the system, from the start. They pointed to India's digital public infrastructure as a model: standard interfaces and trust foundations, with open innovation on top.
Governance in five layers
Goyal described how his firm assesses AI companies against a five-layer governance stack:
Build time: data governance, model versioning and the choices that fix what the system can and cannot do.
Deploy time: policy tracking, permissions and secrets management as the system moves to production.
Run time: real-time observability, monitoring and the ability to intervene or stop the system.
Remediation: audit trails, incident response and rigorous review when things go wrong.
Accountability: reporting lines, compliance mapping and clarity on who is responsible for what.
In his experience, enterprise procurement now opens with governance questions before any technical evaluation. Buyers verify auditability, traceability, data handling and override mechanisms before signing. For agentic AI, governance is a condition of reaching the market, not something added after it.
The baseline before production
For teams without resources for full governance on day one, Goyal proposed a floor he called minimal viable trust. Four requirements, without which an agentic system should not be in production:
A defined identity for each agent: what it is, what it is for and where it came from.
Guardrails where agents are orchestrated: limits on what they can do and how they interact.
Real-time observability: visibility of what the system is doing at any moment, including decision paths and cost.
Defined oversight: who monitors, who can intervene, and when.
None is expensive. Each is a design decision best made at the start. Shah added that building such standards into development frameworks would let young companies be fast and trustworthy at once, and give regulators something concrete to measure.
From human-in-the-loop to human-in-command
Sakhaee drew a parallel with drone regulation. Rules first required pilots to keep a drone within visual line of sight. As detect-and-avoid systems proved more reliable than human watching, regulators began allowing flights beyond visual line of sight. The pilot remains in command and accountable, but no longer watches every moment.
Agentic AI can follow the same path. Human-in-the-loop, approving every action, suits most systems today. As evidence of reliability builds, oversight can move to human-in-command: people set objectives and limits, monitor performance and retain authority to intervene, without approving each step. The move should follow evidence, not a calendar.
Trust across many agents
The panel also addressed systems where agents from different providers work together. Each provider vouches for its own model, but no one can verify the whole chain alone. Panellists called for federated trust: shared, open foundations for identity and accountability across organisations, much as the internet solved identity and routing through open protocols. Goyal added that the field lacks a shared way to learn from failures, comparable to aviation's incident reporting.
A pre-production checklist
Can you name every agent in the system, and what it is for?
What stops each agent from acting outside its scope?
Can you see what the system did, and why, as it happens?
Who can intervene, how quickly, and how?
What evidence would justify relaxing oversight, and who decides?
How Mitochondria's agentic AI systems are governed
The approach. Governance is part of the shared foundation under every unit. Each unit has a defined scope and identity, works within guardrails set with the client before go-live, and runs with continuous monitoring and a full audit trail. Client data stays in client systems, and the operation is ISO/IEC 27001:2022 certified.
What it enables. Deployments begin with human-in-the-loop oversight, where every output is reviewed. As each stage produces evidence of reliability, oversight moves towards human-in-command for routine work, while exceptions still go to people. A named person attests every step that binds the client, at every stage.
The impact. Organisations gain the benefits of autonomy without taking on risks they have not measured. Procurement, compliance and audit teams get the evidence they ask for from the first conversation.
Read more about responsible AI at Mitochondria.
Sources
Cognizant session on governing autonomy, India AI Impact Summit 2026, as presented
—
Mitochondria builds agentic AI for evidence-led core operations. Research-led and model-agnostic. ISO/IEC 27001:2022 certified, with controls aligned to the GDPR, UK GDPR, India's DPDP Act and Australia's Privacy Act. Amsterdam and Pune. Request a working session →