How do you govern autonomous AI agents when "governed" still isn't clearly defined?

Getting pressure to show the board our AI agent rollout is under control, but "governed" is doing a lot of work in that sentence and nobody's defined it operationally yet. Inventory, policy docs, behavior logs, a monitoring dashboard, probably all of it, but I'm trying to figure out what a reasonable bar looks like given how young this space still...