How do you govern autonomous AI agents when "governed" still isn't clearly defined?

Getting pressure to show the board our AI agent rollout is under control, but "governed" is doing a lot of work in that sentence and nobody's defined it operationally yet. Inventory, policy docs, behavior logs, a monitoring dashboard, probably all of it, but I'm trying to figure out what a reasonable bar looks like given how young this space still is. For those who've had to answer this to a board or audit committee: what did you actually show them? Not looking for vendor pitches, just what other security leaders consider credible evidence today.