Governing agentic AI in a regulated pharmaceutical environment requires a fundamentally different architecture than chatbot-era governance. With over a dozen agents in production and 60,000 employees interacting with chat solutions each month, AstraZeneca learned this firsthand. Their existing governance frameworks were built around simple, single-input, single-output interactions. That model broke down when autonomous agents began making decisions, calling other agents, and accessing systems on behalf of humans without asking for step-by-step permission.
Brian Dummann, VP and Head of Enterprise AI Technology, shares what changed structurally after an internal AI audit provided eye-opening results. He breaks down the five core pillars needed in a multi-agent environment:
- Moving from human-in-the-loop to human-on-the-loop oversight
- Deploying defensive AI monitoring to catch drift and hallucination
- Programming agents to know when they are out of their depth so they can ask a human for help
- Designing flexible, adaptive risk frameworks
- Mandating complete observability by design
Instead of building defensive fences that stall deployment, AstraZeneca treats governance as the road itself. By pulling compliance into the platform infrastructure, they eliminated the friction of project-by-project reviews. This allows their teams to move safely, which is the fastest way to deliver outcomes for patients.
“Governance is the road, not the gate. Safe is the fast way.”
Brian Dummann
VP, Head of Enterprise AI Technology
