Governance Strategies for AI Agents Executing Workflows in Operational Systems

Question for the folks experimenting with AI agents. If an agent can analyze signals and then take action across CRM, marketing automation, and data tools, it essentially becomes part of your operational stack. Which raises an interesting challenge: how do you control system access for those agents? Some architectures are introducing a gateway layer between agents and GTM systems so permissions, audit trails, and guardrails sit in one place. Curious how teams here are thinking about governance when AI starts executing workflows, not just analyzing data.