A deep dive into agentic AI in government: how federal agencies deploy AI agents, the OMB M-25-21 governance rules, security risks, and readiness frameworks.
Agentic AI has moved from a research curiosity to a line item in federal budgets. The Department of Health and Human Services alone reported a 65% jump in AI uses in 2025, including agentic pilots aimed at staff shortages, and the White House Office of Management and Budget issued OMB M-25-21 in April 2025 to accelerate federal use of AI while tightening oversight of high-impact systems. For agency CIOs, program managers, and the new Chief AI Officer (CAIO) role, the question is no longer whether to deploy agents. It is how to deploy them without breaking FedRAMP, NIST 800-53, or public trust.
This article covers what agentic AI in government actually looks like today: the use cases already in production, the governance rules that constrain them, the security risks agents introduce, and a practical path from pilot to production.
What Is Agentic AI and Why Governments Are Paying Attention
A working definition: software that pursues a defined goal by planning, sequencing steps, calling tools, and acting on digital systems. Not just producing text. The Government of Canada's guidance draws the line cleanly. Where generative AI produces outputs in response to a prompt, agentic AI carries out tasks, sequences steps, and interacts with digital systems within established bounds.
Governments care because the potential efficiency gains are large and the backlog of routine casework, eligibility checks, and document review is larger. Singapore's Government Technology Agency frames agents as a framework for autonomously pursuing objectives inside public-sector processes. Ukraine has already put a national AI agent, Diia.AI, in front of citizens to advise on and deliver government services through its Diia portal. The World Economic Forum's readiness framework for making agentic AI work for government organizes these efforts around governance, workforce, and infrastructure maturity.
AI Agents vs Generative AI and RPA
Three categories get conflated in agency memos, and the differences matter for risk classification.
| Category | What it does | Failure mode when inputs shift |
|---|---|---|
| Generative AI | Produces content (summary, draft, code) in response to a prompt | Hallucination, stale facts |
| Robotic Process Automation | Follows deterministic scripts against fixed UI paths | Breaks when the form changes |
| Agentic AI | Plans, calls tools, observes results, decides next step toward a goal | Drifts, loops, or misuses tools |
As one federal cybersecurity analysis put it, unlike generative AI, AI agents are autonomous systems rather than pattern-matched content generators. That autonomy is what makes agents useful for the messier long tail of RPA that never got automated. It is also what makes them a new governance problem.
Levels of Autonomy and Bounded Autonomy
Not every agent is a fully autonomous actor, and mature deployments deliberately live on the lower rungs. Bounded autonomy means the agent has narrow scope, a fixed toolset, hard step limits, and mandatory human review at defined checkpoints. Canada's guidance is explicit: start with a narrow, well-defined use case and set safe boundaries before scoping anything broader.
On Powabase, that boundary is a runtime property, not a policy PDF. Our agent loop ships with hard step caps, loop detection on repeated identical tool calls, and a forced text response when the limit is hit, per our published runtime documentation. Agencies otherwise have to build these guardrails themselves.
How Federal Agencies Are Already Deploying AI Agents
The 2024 inventory data shows how quickly this is scaling. The Government Accountability Office found that across 11 selected agencies, reported AI use cases nearly doubled from 571 in 2023 to 1,110 in 2024, with generative AI cases growing roughly nine-fold to 282. Agentic pilots are a small but fast-growing slice of that total.
Federal Agency AI Use Cases: Citizen Services, FOIA, and Document Processing
The workloads agencies are automating first share three traits: high volume, structured inputs, and clear success criteria. The most common federal use cases today include FOIA triage and redaction, benefits eligibility pre-checks, form completion assistance, contact-center deflection and tier-one response, document classification across immigration, health, and veterans' records, and identity verification and fraud screening.
HHS is a useful bellwether. Beyond the raw growth, its Administration for Children and Families disclosed a pre-deployment agentic system to verify the identities of adults applying to sponsor unaccompanied minors in the Office of Refugee Resettlement's care. It was flagged as a "high-impact" use case subject to additional risk management. That combination of meaningful autonomy plus consequential decisions is where the governance regime bites hardest.
What the AI Use Case Inventory 2025 Reveals
OMB now publishes the consolidated inventory openly on GitHub. The current repository documents 56 total agency submissions in the 2025 Federal Agency AI Use Case Inventory. Read across the entries and a pattern emerges. Agents cluster in back-office document work, RAG-based knowledge assistants for staff, and constrained citizen-facing chat. Very few are yet operating at the "agent-executes-a-final-benefits-decision" tier, and the ones that are, are correctly flagged as high-impact.
The Governance and Policy Landscape
The regulatory frame for federal agentic AI tightened significantly in 2025.
OMB M-25-21 and Executive Order 14179
Executive Order 14179 reset the federal AI posture toward acceleration, and OMB M-25-21 operationalizes it for agency use. The memo requires each agency's Chief AI Officer to maintain the AI Use Case Inventory and stand up processes to determine, document, measure, monitor, and evaluate high-impact AI applications, with explicit oversight of risk management compliance. It doesn't stop agentic deployments. It accelerates them, on the condition that agencies can show their work.
High-Impact AI Use Cases and the Chief AI Officer Role
M-25-21 enumerates categories presumed to be high-impact when AI serves as a principal basis for an agency decision or action, covering functions tied to critical infrastructure and to rights, benefits, and access to essential services. The list is illustrative, not exhaustive; final classification sits with the CAIO.
For agent designers this creates a fork:
| If your agent… | Expect… |
|---|---|
| Influences a decision in a high-impact category | Pre-deployment testing, ongoing performance measurement, impact assessments, human alternative or appeal path |
| Supports staff without making consequential decisions | Inventory listing, monitoring, and standard security controls |
| Runs internal automation with no external effect | Inventory listing plus baseline logging |
The CAIO owns classification, risk acceptance, and the authority to pause or shut down a system. In agencies where that role is bolted onto an existing CIO shop without staff or budget, the governance layer is nominal.
Security, Risk, and Oversight Challenges
Recent academic work on public-sector agent governance found strong evidence that existing governance structures face severe challenges adapting to agents, often as an intensification of problems already familiar from earlier digitalization projects. Three technical risk classes deserve specific attention.
Prompt Injection, Identity, and the Model Context Protocol
An agent that reads a citizen-submitted PDF and can also call a database write tool is, functionally, a confused deputy waiting to happen. Prompt injection — hostile instructions embedded in retrieved documents, emails, or web pages — turns the agent's own reasoning against it.
Model Context Protocol makes this worse before it makes it better. MCP standardizes how agents connect to tools and data, which is genuinely useful, but every MCP server is a new trust boundary. Agencies should treat MCP endpoints as privileged infrastructure: signed manifests, allowlisted servers, tool-level scopes, and audit logging on every invocation.
Identity propagation is the subtler failure mode. If an agent runs with elevated service credentials but is invoked by end users, it can leak data across authorization boundaries. Powabase's own documentation is direct about this: by default we do not forward end-user JWTs to agent tools, so builtins like database_query run as superuser regardless of who invoked the run unless you scope them down. The fix isn't clever prompting. It's designing the tool layer so agent capabilities match the caller's actual authority.
Automation Drift and Human-in-the-Loop Controls
Automation drift is what happens when an agent works well on Monday's data distribution and quietly degrades against Friday's. Model updates, changed upstream schemas, new document formats, and shifting user behavior all pull agent performance off its calibration point. Without continuous evaluation the drift is invisible until a citizen complaint or an IG audit surfaces it.
Human-in-the-loop controls are the compensating mechanism, but "human review" has to be designed, not asserted. That means sampling policies for low-risk actions, mandatory review gates for high-impact ones, reviewer interfaces that surface the agent's reasoning trace and cited sources, and reviewer override rates tracked as a drift signal.
Deploying Agents in Compliant Government Infrastructure
Governance answers what you're allowed to do. Compliant infrastructure answers where you're allowed to run it.
FedRAMP, NIST 800-53, and GovCloud Considerations
Any agent handling federal information will inherit FedRAMP authorization boundaries and NIST 800-53 control obligations. Audit logging (AU family), access control (AC), system and information integrity (SI), and configuration management (CM) apply as much to agent runtimes as to any other workload. In practice, agent orchestration, vector stores, LLM inference, and tool endpoints all need to sit inside authorized boundaries, typically an agency's GovCloud or FedRAMP High enclave, with data residency and key management to match.
Two architectural choices pay compounding dividends. First, per-project isolation. Shared multi-tenant vector databases and shared logical databases are hard to reconcile with agency segmentation requirements. Powabase provisions each project on its own dedicated stack, per our product architecture, which maps cleanly onto agency tenancy expectations. Second, self-hostability. An open, portable runtime you can deploy inside an existing ATO boundary is easier to authorize than a black-box SaaS that pulls data outside it.
For the broader picture of how these workloads fit into wider enterprise automation portfolios, our pillar on enterprise AI workflow automation use cases covers the cross-industry patterns agencies can borrow from.
Workforce and Organizational Impact
The workforce story is more nuanced than either the "agents will replace civil servants" or "agents change nothing" framing suggests. HHS's own pilots are pitched explicitly against staff shortages, using agents to absorb repetitive triage so scarce specialist time goes to complex cases. The realistic near-term impact is task shift, not job elimination. Caseworkers spend less time on document ingestion and more on adjudication. Contact-center staff handle exceptions instead of tier-one questions.
That shift needs three organizational investments. Reviewer capacity: every high-impact agent creates a queue of human reviews that has to be staffed and trained. Prompt and workflow authorship as a job function, sitting closer to program offices than to central IT. And a CAIO with actual authority over inventory, risk classification, and shutdown decisions.
Public-sector governance research finds agencies often lack the institutional readiness to absorb agentic systems safely. Closing that gap is a people and process problem before it is a technology one.
Building Readiness: From Pilot to Production
The World Economic Forum's readiness framing and Canada's design guidance converge on a practical sequence for moving from experiment to durable capability.
- Pick a narrow use case with structured inputs, clear ground truth, and a bounded blast radius. Internal knowledge assistants, FOIA triage, or form pre-population before benefits adjudication all qualify.
- Classify against M-25-21 high-impact criteria before you build, not after.
- Instrument from day one. Log every tool call, reasoning step, human override, and model or prompt version so any decision is reconstructable six months later.
- Constrain the runtime with hard step limits, loop detection, tool allowlists per agent, and forced text responses when limits are hit. On Powabase those are defaults, and orchestration coordinates specialized entity agents through a coordinator that delegates and synthesizes, so multi-domain workflows don't require a single omnipotent agent with an unbounded toolset.
- Ground answers in citations. Agents that answer from an authoritative knowledge base with citations are auditable in a way that agents relying on parametric memory are not. Powabase's RAG pipeline uses hybrid search over ChunkEmbed indexes with optional reranking as the citation layer under a policy or benefits assistant.
- Plan the exit. Every pilot should have documented conditions under which it gets promoted, paused, or pulled.
The agencies moving fastest are the ones willing to kill projects early, not the ones with the biggest launch announcements.
Getting Agentic AI Right in the Public Sector
Federal agentic AI in 2026 is a narrow window. It is fast enough that avoidance is no longer a strategy, early enough that the deployments made this year will set the templates and the trust baseline for the next decade. The agencies that will look good in the 2027 GAO retrospective are the ones treating agent autonomy as a spectrum to be dialed in: bounded scope, hard runtime limits, real human review on high-impact decisions, and infrastructure inside their existing authorization boundaries.
The concrete next step for most program teams is unglamorous. Pick one narrow, non-high-impact workflow. Stand it up on a runtime with built-in safeguards and per-project isolation. Wire it into the inventory and monitoring processes the CAIO already owns. Measure it against a human baseline for a full quarter before scoping the next one.