Control and Governance of Generative and Agentic AI: An AIS Lifecycle Framework for Privacy and Security

Generative artificial intelligence (GenAI) and agentic AI architectures are rapidly being integrated into organizational information systems and automation frameworks. While these technologies promise efficiency gains in knowledge work, automation, and decision support, their autonomy, system-level access, and coordinated actions introduce significant privacy and security risks. These risks differ from those associated with traditional software or analytics systems. From an Accounting Information Systems (AIS) perspective, these developments challenge assumptions of bounded execution, stable role-based access, and auditable transactions supported by systematic audit trails. Agentic AI systems may autonomously invoke tools, access sensitive organizational data, and interact with other agents in ways difficult to observe or constrain using conventional internal controls. This research letter proposes an AISoriented privacy and security control framework for GenAI and agentic AI systems integrating five control dimensions: identity and access control, governance and policy design, monitoring and audit mechanisms, cryptographic guardrails, and agentic resilience.