On September 14, 2026, a Reuters explainer, syndicated by Insurance Journal, set out how China is preparing for the risk of AI escaping human control. The reporting traces a deliberate policy arc. China's cyberspace regulator addressed loss-of-control scenarios in its AI safety framework in September 2024, including the possibility that an advanced system might autonomously obtain external resources or replicate itself. A September 2025 update sharpened the scenario into an "AI breaking loose" pattern. In May 2026, a joint policy from the cyberspace regulator, the economic planner and the industry ministry named "operational loss of control" as a security risk for AI agents and asked developers to improve discovery, intervention and recovery capabilities. A mandatory national standard for AI agent safety is reportedly in development.
Whether you find the more dramatic scenarios plausible is beside the point for an audit committee. Look at the vocabulary of the May 2026 policy: discovery, intervention, recovery. Those are not futuristic capabilities. They are the same three questions any internal auditor asks about any powerful system: do we know it exists, can we step in, and can we recover when it goes wrong. They can be tested this quarter, on the agents your organization has already deployed, with conventional audit technique and modern continuous monitoring.
Crest.Digital's Agentic Risk & Continuous Assurance practice builds the boundaries, approval gates, stop paths and evidence trails around the AI agents you already run, so control over an agent is something internal audit can verify rather than assume.
Explore Agentic GRCWhat China's Policy Arc Actually Signals for Enterprises
The Reuters account draws a contrast worth understanding. Where some Western voices call for slowing development, Beijing's stated posture is "trusted application, preventing loss of control": keep deploying, but through technical standards, state oversight and mandatory security assessments. Set the geopolitics aside and the enterprise takeaway is that regulators in more than one major jurisdiction are converging on the same operational expectation. Autonomous systems must be discoverable, interruptible and recoverable, and someone must be able to prove it.
The same expectation is surfacing elsewhere. Microsoft's draft AI code of conduct, which we examined in our analysis of human-in-control AI, requires its systems to accept interruption, correction and shutdown. The EY governance survey we covered in the AI governance gap piece found that governance still lags deployment. Model makers and regulators are writing down what control should mean. The enterprise-specific agent, with its own credentials and its own workflow, is left for the enterprise to evidence.
You Do Not Need to Debate AGI to Audit an Agent
A common reason boards defer this work is that "loss of control" sounds like science fiction. It helps to separate two things. The first is a speculative scenario about future systems. The second is operational loss of control, which is already an ordinary control-environment problem. An AI agent that holds a service account, reads policies and emails, calls an ERP interface and can approve or execute a transaction has a permission set, a blast radius and a failure mode. If it acts outside its scope, is manipulated by content it reads, or keeps running after someone wants it stopped, the organization has lost control of that agent in the only sense that matters to an auditor.
Most enterprises can describe their AI agents in general terms and very few can evidence them. The typical gaps are unglamorous. Agent identities are shared or over-privileged. Approval rules exist in a policy but are not enforced in the workflow. There is a "pause" button that nobody has pressed on a live agent. Logs record outputs but not the reasoning path or the tools called. Our earlier pieces on audit trails for AI agents and agent identity and access governance make the same point from the accountability and identity sides.
Crest.Digital's agents monitor AI-agent access, thresholds and overrides continuously across ERP, procurement, identity and vendor systems, and raise exceptions with a root-cause hypothesis and a named owner. The same intelligence extends to the third-party AI you depend on through the TPRM platform.
Six Questions That Turn "AI Safety" into an Audit Programme
Crest.Digital's practice reduces the abstract problem to six questions asked of every agent, in order. Each maps to evidence an auditor can request.
- What can the agent access? Systems, data, credentials, tools and external services, compared with what it needs for its defined task.
- What can it change? Where it is read-only, where it can write, and where it can trigger a payment, an access grant, a vendor-bank change or a journal entry.
- What requires approval? The threshold at which a human must approve, and whether that gate is enforced in the workflow or merely described in a policy.
- Can it override a control? Whether it can alter its own permissions, disable logging, bypass an approval or edit the rules that constrain it.
- Can it be stopped? Who can halt it mid-task, how quickly, and whether that has ever been exercised on a live instance.
- Is everything logged? Whether inputs, tool calls, decisions and outcomes are captured in a tamper-evident record that survives the agent.
If any answer is "we believe so" rather than "here is the evidence," that is the first finding. Because agents choose their own sequence of steps at run time, a one-off test is weak assurance. Behaviour varies between runs, which is why the audit model is shifting from periodic sampling to continuous assurance.
Auditing Autonomous AI: 10 Controls Internal Audit Should Test
The six questions expand into ten testable controls. Each can be assessed as designed and operating, and most can be monitored continuously once the agent is connected to identity, workflow and logging systems.
A Complete, Owned Agent Inventory
Every agent, including those embedded in SaaS tools and built by business teams, is registered with an owner, purpose, model provider and risk tier. You cannot govern what you have not discovered.
Documented Access Boundary
Each agent's reachable systems, datasets and tools are written down and mapped to a control owner, so an auditor can compare the boundary with what the agent can actually touch.
Least-Privilege, Non-Shared Credentials
Agents run under their own identities with the minimum entitlements, short-lived where possible, reviewed on the same cycle as privileged human users. Shared service accounts are a finding.
Defined Change Authority
The list of actions the agent may take in a system of record is explicit. Read, recommend and execute are separated, and moving an agent from one to the next is itself an approved change.
Enforced Approval Thresholds
Value, risk and sensitivity thresholds trigger human approval inside the workflow, so the agent cannot proceed without it. A threshold that lives only in a policy document is not a control.
Protection Against Control Override
The agent cannot modify its own permissions, disable logging, edit its guardrail rules or route around an approval. Attempts are detected and treated as control failures.
A Tested Stop Mechanism
A named individual can halt the agent mid-task, revoke its credentials and quarantine its queue. The procedure has been exercised on a live instance under a defined scenario, like a continuity failover, not assumed.
Immutable, Complete Logging
Inputs, tool calls, decisions, approvals and outcomes are recorded in a tamper-evident store the agent cannot alter, with retention that matches audit and regulatory needs.
Monitored Exceptions With Named Owners
Out-of-scope actions, threshold breaches and anomalies raise an alert with a root-cause hypothesis, assigned to an accountable person and tracked to closure, not left for someone to notice.
A Recovery and Rollback Path
The organization can reverse or contain what an agent did: restore records, recall payments, revoke grants. The recovery has been rehearsed, and its evidence is retained for the audit file.
Controls seven and eight do most of the diagnostic work. An enterprise that has never stopped a live agent, or cannot reconstruct what an agent did from a record the agent could not edit, has a policy rather than a control. Those two findings tend to surface fastest and carry the most weight with an audit committee.
Executive Takeaways
- Regulators are converging: China's discover, intervene, recover language echoes Microsoft's override-and-shutdown code and the direction of enterprise AI governance surveys.
- The risk is operational today: credentials, tool access and the ability to change systems of record are enough to justify an audit programme.
- Evidence beats assurance: a tested stop path and a tamper-evident log are the two fastest indicators of real control.
- Continuous beats periodic: agent behaviour varies by run, so continuous controls monitoring outperforms annual sampling.
A Six-Step Playbook for Auditing Autonomous AI
Crest.Digital delivers this as a configurable "Risk Automation Pod" rather than a bespoke software build. The reusable stack includes integration connectors, an agent orchestration layer, a workflow and approval engine, a rules and risk-scoring engine, an evidence repository, AI logs and explainability, role-based access and audit trails. The client-specific portion is mostly data mapping, control logic, workflow and dashboards, applied first to the agents that carry the most consequential permissions.
The Discover → Design → Connect → Deploy → Validate → Transfer Model
- Discover: Inventory every deployed or planned agent, its credentials, reachable systems and possible actions, and flag agents with no boundary, stop path or log.
- Design: Define the access boundary, approval thresholds, stop authority and evidence each of the ten controls requires, mapped to named owners.
- Connect: Integrate with identity, ERP, GRC, ITSM and orchestration systems so boundaries, approvals and stop actions are enforced and logged in the workflow.
- Deploy: Implement continuous tests for the prioritized agents and route every exception to a named owner with a root-cause hypothesis.
- Validate: Run parallel scenarios that deliberately attempt out-of-scope actions, overrides and emergency stops, and calibrate thresholds before wider rollout.
- Transfer or manage: Hand the tested control set to internal audit, risk or compliance, or run it as a Crest.Digital-managed service as the agent inventory grows.
Human-in-the-loop governance stays in place throughout. The agents handle the repetitive testing, evidence collection and follow-up. The auditor decides what matters, what is a finding and what the committee should hear. Start with one or two agents that already touch payments, vendor-master data or privileged access, so the validate step yields a clear before-and-after comparison. For the third-party dimension, the same tests apply to AI embedded in vendors' products, which is why the agentic AI capabilities on the Crest platform pair naturally with vendor due diligence.
What Internal Audit Should Tell the Board
Audit committees do not need a view on whether advanced AI will one day escape human control. They need a defensible answer to a narrower question: for the AI agents we run today, can we show that we know where they are, limit what they can do, step in when needed and reconstruct what happened? The IIA's Global Internal Audit Standards already expect internal audit to evaluate governance and control design, and COSO's Internal Control–Integrated Framework has long held that an untested control cannot be relied on. ISACA's 2026 guidance on securing AI agents applies the same identity and monitoring rigor to agents that organizations apply to privileged humans.
A workable board pack has three parts: the inventory and risk-tiering of agents, the pass/fail result for each of the ten controls on the highest-risk agents, and a remediation plan with owners and dates. Repeat it quarterly and the pack becomes evidence of a maturing programme. The regulatory direction, in Beijing, in Redmond and in the audit standards, points the same way, and the organizations that can already answer these questions with evidence will find the next requirement a formality rather than a scramble.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
According to a Reuters explainer published on September 14, 2026, China's cyberspace regulator has addressed loss-of-control scenarios in its AI safety framework since September 2024, including the possibility that AI could autonomously obtain external resources or replicate itself. A framework update in September 2025 sharpened the 'AI breaking loose' scenario, and a May 2026 policy from the cyberspace regulator, the economic planner and the industry ministry named 'operational loss of control' as a security risk for AI agents, requiring developers to improve discovery, intervention and recovery capabilities. A mandatory national standard for AI agent safety is reportedly in development. The approach favours technical standards, state oversight and mandatory security assessments over a slowdown in development. For enterprises, the useful signal is the vocabulary: discover, intervene and recover are exactly the capabilities an internal audit function can test on its own agents today.
No. The audit case does not depend on any debate about artificial general intelligence. Today's enterprise AI agents already hold credentials, call tools, read and write to systems of record and trigger actions such as payments, access grants and vendor-master changes. The relevant risk is operational loss of control: an agent that acts outside its intended scope, cannot be stopped quickly, or leaves no reliable record of what it did. That risk exists at current capability levels, it is testable with conventional audit techniques, and it is consistent with guidance from bodies such as ISACA and with the Global Internal Audit Standards' emphasis on governance and control design.
Ten controls cover the ground: a complete agent inventory, a documented access boundary, least-privilege credentials, a defined change authority, enforced approval thresholds, protection against control override, a tested stop mechanism, immutable logging, monitored exceptions with named owners, and a recovery or rollback path. If time is limited, start with three: whether the agent's access matches its documented boundary, whether a named person can stop it mid-task and has proved it, and whether every action leaves a tamper-evident record. An organization that cannot evidence those three does not yet have human control over that agent, whatever its AI policy says.
A traditional application executes deterministic logic that can be tested once and re-tested on change. An AI agent chooses its own sequence of steps at run time, may call different tools on different days and can be influenced by the content it reads. Audit therefore shifts from testing code to testing boundaries and evidence: what the agent can reach, what it can change, what forces human approval, whether it can bypass a control and whether the record of its behaviour is complete. Because behaviour varies between runs, sampling is weaker than continuous monitoring, which is why continuous controls monitoring of agent activity is becoming the natural assurance model.
Yes. Crest.Digital's Agentic Risk & Continuous Assurance practice starts by mapping each deployed agent against the six-question chain of access, change authority, approval, override, stop and logging, then tests the ten controls through parallel testing rather than rebuilding what already works. Where a control is missing, most often a tested stop path or a tamper-evident action log, Crest designs and connects it using the same configurable Risk Automation Pod approach used across the practice, customized to the organization's own systems, permission model and control language. Human-in-the-loop governance stays in place throughout: the auditor remains the decision-maker.