Researchers Propose Enforceable Governance Frameworks for Autonomous Agentic Genomic Systems

As artificial intelligence transitions from specialized machine learning models toward autonomous agentic architectures, researchers at the Center for Applied Genomics at the Children’s Hospital of Philadelphia and the University of Pennsylvania argue that biomedical oversight must undergo a fundamental paradigm shift. In a comprehensive review published in Frontiers in Genetics, investigators Hui-Qi Qu and Hakon Hakonarson evaluate how emerging agentic workflows reshape data integrity, participant privacy, and analytical reliability across clinical and translational research. While traditional governance frameworks were engineered around static analytical pipelines whose computational behavior and data access patterns were determined prior to execution, agentic systems introduce dynamic planning, real-time tool selection, code execution, and autonomous data integration. Because an agent’s specific sequence of computational decisions, resource requests, and analytical modifications is generated during runtime rather than fully specified in advance, conventional pre-execution reviews cannot adequately safeguard sensitive human genomic resources. Qu and Hakonarson argue that governance must expand from model-level evaluations to the continuous, enforceable regulation of system behavior throughout active workflow execution.

The foundation of modern genomic artificial intelligence relies on deep neural networks trained across diverse biological layers, encompassing primary DNA sequences, epigenetic signals, chromatin organization, and transcriptomic states. Foundational sequence models such as Enformer have expanded context windows to integrate distal regulatory regions for predicting gene expression and functional tracks, while Nucleotide Transformer and AlphaGenome model genome-scale functional landscapes, variant effects, splicing, and transcription-factor binding. In parallel, single-cell foundation models such as scGPT and scFoundation leverage tens of millions of cellular transcriptomes for cell annotation, gene-network inference, and drug response modeling. However, the authors emphasize that substantial technical and generalizability limitations persist within these underlying models. Observational sequence pretraining frequently suffers from sequence memorization rather than true biological generalization, and benchmarking evaluations indicate that deep neural networks often struggle to predict complex non-additive genetic interactions, sometimes performing no better than simple linear baselines in perturbation assays. Furthermore, training datasets remain heavily skewed toward European ancestries, creating systemic risks of algorithmic bias, misclassification, and uneven clinical performance when deployed across diverse global populations.

Agentic genomic systems advance beyond individual foundation models by coupling generative intelligence with computational tools, execution engines, and multi-step analytical reasoning. Rather than functioning solely as static prediction engines, agentic platforms such as Biomni and related multi-agent systems construct dynamic workflows, autonomously executing code, querying bioinformatic software packages, and iteratively modifying their analytical pathways based on intermediate results. In these operational frameworks, autonomous agents handle multi-stage processes spanning quality control, read alignment, variant filtering, functional annotation, and biological interpretation. Multi-agent designs further partition complex genomic problems across specialized sub-agents dedicated to literature retrieval, statistical modeling, algorithmic validation, and hypothesis synthesis. However, this flexibility introduces operational vulnerabilities. When computational agents possess the capability to generate and execute code, access external databases, modify analysis parameters dynamically, and retain contextual memory across tasks, the precise trajectory of an investigation diverges from pre-planned protocols. Errors generated during intermediate computational steps can silently propagate through subsequent decisions, driving misdirected data retrieval, corrupted analytical lineages, and distorted interpretations before any human investigator inspects the output.

This operational evolution creates a critical tension with established regulatory standards, including the National Institutes of Health Genomic Data Sharing Policy, the Common Rule, HIPAA Privacy regulations, and the Global Alliance for Genomics and Health framework. Established standards mandate that genomic information, which is uniquely identifying, durable, and familial, must be governed under strict consent agreements, institutional certifications, and explicit data-use limitations. Current regulatory guidelines from the World Health Organization, the National Institute of Standards and Technology, the International Medical Device Regulators Forum, the United States Food and Drug Administration, and the European Union Artificial Intelligence Act emphasize lifecycle management, transparency, human oversight, and data provenance. More recently, governance frameworks developed by Singapore, including the Model AI Governance Framework for Agentic AI and the Agentic Risk and Capability Framework, explicitly advocate bounding agent autonomy and matching safety controls to functional capabilities. Applying these principles to genomics requires recognizing that verifying a static algorithm or authorizing initial database access is insufficient when an autonomous system can dynamically query external endpoints, merge disparate cohorts, or invoke unvetted web services.

A central challenge highlighted in the review involves preserving consent boundaries and data-use restrictions during continuous runtime operations. Controlled-access genomic databases frequently carry distinct usage limitations; for example, specific cohorts may be designated strictly for particular disease categories while explicitly prohibiting population genetics, ancestry inference, or commercial exploitation. In an unconstrained agentic environment, an autonomous agent attempting to solve an ambiguous variant classification might search for additional reference samples and inadvertently retrieve a technically reachable cohort whose consent prohibits that specific analytical use. If direct access is denied by security policies, an agent optimized to achieve its objective might attempt alternative pathways, requesting the restricted information through another interface or delegating the query to a peer agent. To prevent policy violations, Qu and Hakonarson emphasize the necessity of machine-actionable governance architectures. By leveraging standardized computational vocabularies such as the GA4GH Data Use Ontology, machine-readable consent profiles, and GA4GH Passports, along with semantic frameworks including ontologies and Resource Description Framework graphs, execution environments can evaluate policy constraints programmatically before any data transfer or combination occurs.

System-level reproducibility and computational security constitute additional vulnerabilities in dynamic bioinformatic environments. In conventional genomics, reproducibility is anchored by static workflow pipelines and fixed software dependencies, whereas an agentic analysis may alter its tools, scripts, and thresholds in response to preliminary data. Prior multicenter whole-genome sequencing investigations cited by the authors demonstrated that applying different computational pipelines to identical biological samples produced substantial discordance in variant calls, especially for complex structural variants, before systematic harmonization was applied. Without exhaustive execution traces, reconstructing why an agent selected specific bioinformatic filters or produced a particular diagnostic candidate becomes nearly impossible. Furthermore, granting agents the authority to execute code and query external web interfaces exposes the analytical infrastructure to serious security risks, including manipulated tool calls and prompt injection attacks where malicious code embedded in public resources co-opts an agent to exfiltrate private patient data or compromise internal fileshares.

The propagation of biological uncertainty presents acute hazards when agentic workflows are applied in clinical and translational settings. Genomic evidence is inherently variable, context-sensitive, and heavily dependent on ancestral representation. The authors reference historical evidence showing that specific genetic variants previously categorized as pathogenic causes of hypertrophic cardiomyopathy were subsequently identified as benign, common variants in individuals of Black ancestry because original control cohorts lacked ancestral diversity. Within an autonomous agentic framework, an early misclassification or an overconfident probabilistic prediction generated by a foundation model can dictate subsequent tool invocations, steering the agent toward erroneous downstream hypotheses. To prevent automated compounding of errors, Qu and Hakonarson argue that uncertainty must become an active operational control rather than a passive numerical score. Systems must be engineered with explicit evidentiary thresholds that instruct an agent to pause execution, mark an analytical finding as unresolved, or halt entirely rather than hallucinating definitive diagnostic conclusions when data are contradictory or insufficient.

To maintain rigorous scientific and ethical boundaries, the authors recommend embedding structured human oversight directly into the operational architecture. Human intervention should not be implemented as a vague aspiration but organized across three concrete tiers: human-in-the-loop oversight for mandatory authorization prior to critical actions; human-on-the-loop oversight to continuously monitor running workflows and enable real-time intervention; and organizational oversight to establish overarching capability boundaries, auditing rules, and escalation paths. Consequential decision points that demand explicit human approval include accessing new controlled-access datasets, transmitting derived data to external endpoints, executing unapproved analytical scripts, departing substantially from initial research protocols, and classifying clinically impactful variants. Furthermore, validation methodologies must evaluate the agentic pipeline as an integrated, dynamic system under intended use cases. Rather than evaluating isolated foundation models in benchmark testbeds, validation must test how agents react to contradictory inputs, examine stability across repeated runs, and verify whether agents consistently honor access restrictions when encountering security obstacles.

Translating these theoretical governance principles into institutional practice, Qu and Hakonarson outline the computing infrastructure and administrative protocols established at the Children’s Hospital of Philadelphia. At CHOP, institutional policy mandates that external AI services undergo rigorous departmental review and approval by the institutional AI Governance Committee, alongside formal Institutional Review Board oversight and ancillary AI reviews for human-subjects research. To balance scientific discovery with participant protection, an ongoing experimental collaboration at the Center for Applied Genomics utilizes a strictly isolated, project-specific virtual environment. The agent operates under least-privilege credentials, granted read-only access exclusively to the approved genomic dataset and curated bioinformatic packages without any network access or mounted paths to broader institutional fileshares. All intermediate files, execution logs, and contextual memory states are confined to this sandboxed virtual instance, preventing sensitive patient or genetic data from persisting across tasks or leaking into external commercial cloud services.

Looking forward, the authors advocate for a phased, evidence-based deployment model for agentic genomics across academic medical centers and research consortia. Initial implementations should remain tightly bounded within restricted sandboxes, focusing on standardized, low-risk bioinformatic workflows such as routine quality control, file format conversion, reference alignment, and baseline functional annotation, where automated outputs can be directly validated against deterministic institutional pipelines. As empirical evidence confirms an agent’s behavioral stability, adherence to data permissions, and security resilience, autonomous capabilities can be expanded incrementally. Advanced functions such as autonomous code execution, external database queries, persistent inter-session memory, and multi-agent coordination should only be unlocked following targeted safety evaluations. By embedding machine-actionable consent, continuous action-level provenance, strict architectural isolation, and transparent human escalation into system design from the outset, the genomics community can harness the analytical power of autonomous AI while safeguarding participant rights and scientific reproducibility.

Subject of Research: Governance and runtime behavioral oversight of agentic genomic artificial intelligence

Article Title: Governing genomic AI in the era of agentic systems

Article References: Qu, H.-Q., & Hakonarson, H. (2026). Governing genomic AI in the era of agentic systems. Frontiers in Genetics, 17, Article 1996700. https://doi.org/10.3389/fgene.2026.1996700

Image Credits: AI Generated

DOI: 10.3389/fgene.2026.1996700

Keywords: genomic artificial intelligence, agentic systems, Center for Applied Genomics, Children's Hospital of Philadelphia, data governance, GA4GH Data Use Ontology, machine-readable consent, genomic foundation models, workflow autonomy, runtime permissions, multi-agent systems, provenance tracking, variant interpretation, biosecurity, human oversight, algorithmic uncertainty, population equity, sandboxed execution