Agents Multiply Reasoning. Ungoverned Agents Multiply Ungoverned Reasoning.
The industry is racing to deploy agentic AI — systems that plan, call tools, evaluate results, and iterate toward goals. Every step in that loop is a reasoning event: a decision about what to do, what a result means, whether to continue or revise. A single agent task generates dozens to hundreds of them; an enterprise fleet generates millions. Nearly all of it is unrecorded — tool-call logs capture what the agent did, never why — and the new interagency model-risk guidance explicitly scoped agentic AI out, so no tailored framework is coming soon. Enterprises spent two years learning that single LLM outputs need reasoning-level governance. Agents multiply that need by the step count. The wave is not a new problem. It is the old problem, compounding.
The multiplication
A chat deployment produces one reasoning event per interaction: prompt in, answer out. Whatever governance you wrap around it — review, sampling, logging — scales with the number of answers. An agent breaks that arithmetic. Given a goal, it decomposes the task (a reasoning event), selects a tool (another), interprets the tool’s result (another), decides the result is insufficient and revises its plan (two more), spawns a sub-task, evaluates when to stop. A modest document-processing agent might make forty such judgments per task. An agentic workflow orchestrating sub-agents can make hundreds. Each one is a place where the system can be wrong, and — more dangerous — each one conditions everything downstream. A misread API response at step 7 doesn’t fail the task; it silently reshapes steps 8 through 40, which proceed flawlessly from a false premise. Single-pass generation at least confined its errors to one output. Agent errors compound inside a process, and surface — if they surface — as an outcome nobody can explain.
Tool logs are not reasoning records
The standard rebuttal is that agent frameworks are observable: every tool call logged, every token traced, replay available. This mistakes the artifact for the account. A tool log tells you the agent called the account-lookup API at 14:02, the search endpoint at 14:03, and the refund service at 14:07. It does not tell you why the agent believed a refund was warranted, what it concluded from the lookup, which alternatives it weighed, or whether it noticed the discrepancy in the search results and dismissed it. The reasoning between the calls — the part that made every call happen — lives in transient context and evaporates at task completion. We made this distinction about single models years ago: logging captures what a system did, governance requires how it reasoned. Agents make the gap wider precisely because their action logs are so rich. An institution can drown in agent telemetry and be unable to answer the only question that matters after an incident: at which step did the reasoning go wrong, and what would have caught it?
No framework is coming to save this
Timing makes the gap sharper. The April interagency model-risk guidance — SR 26-2 — explicitly placed generative and agentic AI out of scope, which we’ve argued elsewhere creates a vacuum rather than a pass: full supervisory exposure under general prudential authority, no tailored framework to comply with. For agents, the vacuum is deeper still, because even the informal disciplines enterprises evolved for single LLMs — output review, response sampling, human sign-off — do not transfer. You cannot human-review forty intermediate judgments per task across a fleet. Sampling final outcomes misses the mid-process errors that self-corrected this time and won’t next time. Sign-off on the outcome ratifies a process nobody inspected. The governance tools scale with outputs; the risk now scales with steps.
Governing the steps
The answer is not to slow the agents down; the economics are real and the capability is not going back in the box. The answer is that agentic execution needs the same move that made any consequential AI governable: the reasoning must be externalized into structure — and agents, it turns out, are the most natural fit this architecture has. An agent’s loop already wants to be a graph: plan nodes, action nodes, interpretation nodes, revision edges. Run it as an explicit graph instead of an improvised loop and the properties change categorically. Every judgment persists as an inspectable node bound to the evidence it acted on — the interpretation of the API response is recorded, not vapor. Gates run during execution: a verification node between interpretation and action means the misread result at step 7 fails a check at step 7, not an autopsy at step 40. Abstention and escalation become designed outcomes — the agent that cannot ground its next step hands off to a human with a structured account of where and why it stopped, which is the difference between a safety property and a stall. And the completed trace is a decision record per task: what was considered, checked, revised, and concluded, at every step — the artifact an examiner will ask for when agentic decisions reach the workflows that get examined. That is also the honest standard for the make-or-buy conversations happening right now: not can we build an agent that completes the task — anyone can, that is the problem — but can it show its work at every step it took?
Enterprises are about to run more reasoning per hour than their governance functions were built to review per year. The step count isn’t negotiable — the visibility is. Govern the steps, or accept that your most consequential processes are executed by something whose thinking you’ve chosen not to see.