Agentic AI fundamentally alters software development by enabling autonomous actions without constant human oversight. Unlike earlier AI code completion, where humans reviewed every step, agents can now perform complex tasks like opening merge requests or modifying configurations. This shift necessitates new governance strategies focusing on an agent's permissions and actions, not just code quality. Organizations are concerned about code attribution, traceability to intent, and scalable documentation with AI-generated code.A robust governance framework addresses what agents can access and do, ensuring actions are provable. Key control points include a central catalog for approved agents and flows, composite identity linking agent actions to humans, and tool approval guardrails. Prompt guardrails are also crucial to prevent agent hijacking. Data privacy concerns arise, leading to the importance of self-hosted AI and bring-your-own-model options for sensitive code.Governance involves deliberately defining where human review remains essential. Interactive work typically retains direct human approval, while automated workflows require pre-action controls or post-action audit trails. Metrics for measuring AI rollouts should encompass adoption, acceptance quality, risk, remediation, and return on investment. A practical checklist for GitLab Duo Agent Platform users includes reviewing data usage, approving agents, setting tool guardrails, and defining human-in-the-loop checkpoints. Continuous reassessment of governance is vital as new AI capabilities emerge.