Controls must travel with the work
When an agent moves between project management, source code, infrastructure and reporting, the relevant data and approval boundaries change. Governance needs to be applied at each transition rather than assumed from a single global policy.
Evidence should be designed in
It is difficult to reconstruct why a system acted after the event if sources, tool calls and outcomes were never linked. Traceability is most effective when it is part of the workflow architecture from the beginning.
Compliance evolves
Regulation, vendor behaviour and organisational risk all change. Controls therefore need named owners, review dates and a method for propagating updates into the systems agents actually use.