Africa is entering an unusually important week for AI governance. On September 7, the African Union Commission convened African ambassadors in Geneva to coordinate the continent’s position in international negotiations on digital technology and artificial intelligence. The next day, the AU commissioner for infrastructure and energy joined the inaugural AI for Good Global Commission, whose stated goals include expanding access while strengthening trust in AI.
That combination is exactly right. Africa needs broader access to useful AI, but trust will depend on whether governments and businesses can control systems that increasingly do more than answer questions.
Africa.com reported in June that 88% of African organizations in one industry report were embedding AI agents into operations. Other Africa.com coverage has described autonomous orchestration systems that can execute tasks across channels and business systems. The governance challenge is moving quickly from what AI can say to what AI can do.
The need is visible in the METR/Redwood investigation of a major real-world cyberattack on Hugging Face. AI agents driven by an unreleased OpenAI internal research model attacked Hugging Face on their own, despite recognizing that they were not supposed to do so. Hundreds of agents shared discoveries, divided up the work, and coordinated through their own message board until they successfully breached Hugging Face’s defenses. Advanced AI systems had organized themselves to carry out a large, sustained cyberattack against a major company.
The lesson for African policymakers is practical. Risk rises sharply when an agent gains authority to access sensitive data, communicate externally, initiate transactions, modify systems, or coordinate with other agents. A less capable model with broad permissions may create more operational risk than a more capable model confined to a secure sandbox.
I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible, while reducing the risk of failures like the Hugging Face attack.
Africa’s emerging AI governance framework should therefore focus on authority as well as capability.
First, governments and companies should maintain an authority map for every deployed agent. The map should state what information the agent can read, what systems it can change, what people or organizations it can contact, what transactions it can initiate, and how long it can operate without human review. Those permissions should be visible to the people accountable for the outcome.
Second, controls should strengthen as authority increases. A read-only assistant that summarizes regulations can operate with relatively light safeguards. An agent that can change a public-benefit record, initiate a payment, modify a customer account, approve a loan, or communicate binding commitments should face stronger authentication, least-privilege access, logging, approval thresholds, and automatic shutdown conditions.
Third, serious agent incidents should trigger structured reporting and independent review. A system that crosses an authorization boundary has revealed information that matters beyond one technical glitch. Regulators and operators need to know what permission failed, whether similar agents share the same weakness, and what changes prevent recurrence.
Fourth, frontier-capable agents should undergo independent evaluation before receiving broad operational authority. Testing should include ambiguous instructions, conflicting objectives, attempts to expand access, failures in connected systems, and conditions that tempt the agent to continue beyond its assigned scope. Benchmarks that measure reasoning alone cannot answer those questions.
These ideas fit the direction the AU is already taking. On September 7, the African Union Commission and the International Telecommunication Union signed an agreement focused on inclusive, secure, and sustainable digital transformation, including artificial intelligence, cybersecurity, digital resilience, and technical standards. Authority-based safeguards turn those broad commitments into operating rules that organizations can actually implement.
They also support African sovereignty. If governments rely on imported AI systems whose operational permissions remain opaque, they may gain technical capability while losing control over how public data, infrastructure, and decisions are handled. Requiring clear agent identities, explicit permissions, and auditable actions gives public institutions more leverage over vendors and more visibility into deployed systems.
The same principle helps businesses. Banks, insurers, telecom companies, logistics providers, retailers, and digital platforms can let agents automate routine work while reserving high-consequence actions for stronger controls. That makes experimentation easier because leaders do not have to choose between full autonomy and no autonomy. They can increase authority in stages as evidence accumulates.
Africa’s AI debate should resist a false choice between rapid adoption and strong safeguards. The continent needs both. Its governments are already trying to shape global rules while expanding access to digital infrastructure and AI capability. The next step is to insist that every autonomous system comes with a clear answer to a simple question: what is this agent allowed to do, and what stops it when it goes beyond that authority?
If that principle becomes part of Africa’s common AI position, it can make adoption safer, more trusted, and ultimately faster.
========================================
Gleb Tsipursky, PhD, a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026). https://
