Agentic AI in Healthcare Organizations in Viet Nam: How to Govern AI Agents, Tool Access, Action Authority and Human Oversight
IMPLEMENTATION INSIGHTS
Agentic AI in Healthcare Organizations in Viet Nam: How to Govern AI Agents, Tool Access, Action Authority and Human Oversight
IMPLEMENTATION INSIGHT
Last reviewed: 2 October 2026
Healthcare organizations are becoming familiar with generative AI that summarizes a document, drafts a note or answers a question. Agentic AI introduces a different governance problem. Instead of stopping at an answer, an AI system may be able to interpret a goal, plan several steps, retrieve information from different systems, use external tools and take actions toward that goal.
That difference matters in healthcare. An AI assistant that drafts an appointment reminder creates one type of risk. An AI agent that accesses scheduling information, creates an appointment and sends a patient message has been given a broader set of capabilities. A system that can retrieve clinical information, interact with other software or trigger downstream workflows raises still more important questions about authority, patient safety and accountability.
The practical governance question therefore shifts from simply “Is the AI output correct?” to something wider: What is this AI allowed to access, what is it allowed to do, which actions require human approval, and how can people intervene when something goes wrong?
This is becoming a real healthcare governance issue rather than a theoretical one. In June 2026, WHO South-East Asia devoted a session in its Responsible AI in Healthcare series specifically to agentic workflows and human oversight, examining the shift from assistive systems toward increasingly autonomous workflows in which AI can coordinate tasks, retrieve information and support operational or clinical decision-making with greater independence. Accountability, escalation pathways, reliability, transparency and meaningful human oversight were central themes.
At the same time, the clinical evidence remains immature. A 2026 scoping review identified only seven eligible studies, most exploratory and limited in scope, with only one involving patients. An evidence map published in July 2026 found that early deployments remain concentrated largely in administrative workflows, although agentic applications are expanding across the clinical patient journey. A broader survey of more than 200 studies similarly concluded that much of the research remains concentrated in benchmark and controlled-evaluation settings, with important challenges in reliability, privacy, governance and operational integration before routine clinical use. [11–13]
For healthcare organizations in Viet Nam, this is exactly when governance should begin: before greater autonomy becomes embedded in routine care.
What makes an AI system agentic?
There is not yet one universally settled definition of agentic AI in healthcare. Recent literature itself notes conceptual ambiguity between an AI agent, an agentic workflow and a more autonomous agentic system. A practical approach is therefore to focus less on the label and more on the capabilities the system has been given. [11]
A conventional chatbot typically receives an input and produces an output. A more agentic system may interpret a goal, break it into subtasks, select tools or data sources, execute multiple steps, evaluate intermediate results and continue until the task is completed or an escalation condition is reached. In healthcare, those capabilities might include retrieving information from an electronic health record, searching an organizational knowledge base, using scheduling or messaging functions, querying external data sources, preparing documentation or coordinating actions across other systems.
The degree of autonomy can vary substantially. One system may only suggest the next action. Another may prepare an action and wait for human confirmation. Another may execute a narrowly defined set of actions automatically within predefined limits. That spectrum matters more than the label.
The more useful governance question is therefore not simply “Is this agentic AI?” but “What capabilities has this particular system been given, and what can those capabilities change in the real world?”
Agentic AI is not a separate statutory risk category in Viet Nam
Viet Nam’s Law on Artificial Intelligence No. 134/2025/QH15 has been effective since 1 March 2026, with Decree No. 142/2026/NĐ-CP effective since 1 May 2026. The framework classifies AI systems as high-, medium- or low-risk and establishes different responsibilities depending on that classification. [1,2]
The legislation does not create a separate statutory category called “agentic AI,” “AI agent” or “autonomous agent.” An AI system should therefore not be treated as legally high-risk simply because it can plan tasks, use tools or execute multiple steps.
Decree No. 142 also makes an important distinction between an AI model and an AI system. It states that risk classification applies to AI systems, not to AI models in isolation. Where a model forms part of a specific AI system, the relevant classification is determined for that system in its deployed context. [2]
At the same time, several characteristics commonly associated with agentic systems are relevant to the logic behind Viet Nam’s high-risk framework. Article 8 of Decree No. 142 identifies factors such as the degree of automation, the extent to which the system supports the final decision and the ability of humans to supervise and intervene among the criteria used in developing the high-risk list. These criteria do not create a separate test that a healthcare organization can use to override the statutory list, but they help explain why greater autonomy and weaker human intervention may matter from a regulatory perspective.
Decision No. 33/2026/QĐ-TTg establishes the current high-risk list. Being agentic does not by itself place a healthcare system on that list, just as being outside the list does not establish that its clinical or operational risk is low. [3]
There is another healthcare-specific point. Article 6 of the AI Law requires stricter risk management in essential fields that directly affect life and health; for healthcare, it expressly refers to patient safety, reliability under real-world conditions and protection of health data. [1]
The practical principle is therefore: classify the system according to the law, but govern its autonomy according to what it can actually do.
When AI can act, governance must cover tools and authority
With conventional clinical AI, governance often concentrates on the quality of an output: accuracy, sensitivity, specificity, calibration, false positives, false negatives, bias or clinical usefulness. Agentic AI adds another dimension: the consequences of action.
Suppose an AI generates an incorrect recommendation. A clinician may detect and reject it before anything happens. Now suppose an AI can pass information to another system, modify a record, contact a patient or initiate a downstream workflow. The same underlying error may travel further before a person has an opportunity to intervene.
Multi-step workflows can also compound small errors. An incorrect interpretation at one stage may affect the next tool selected, which then supplies information that influences another step. The eventual action may appear internally coherent even though the sequence began with a faulty assumption.
Healthcare organizations therefore need to understand the whole action pathway: what goal is given, what information is accessed, which tools are used, what intermediate outputs influence later steps, what action is ultimately taken and what happens downstream.
Tool access needs to be governed explicitly. Giving an employee access to an AI application is not the same as giving that AI access to organizational systems. An agent may be able to retrieve patient information, search a clinical repository, use a scheduling platform, create documents, send communications, interact with an EHR or call another application. Each connection creates a different risk surface.
A useful practical principle is least privilege: an agent should receive only the access needed for its approved task and no broader permissions simply because broader access is technically possible. A scheduling agent may need to see appointment availability and create a booking; it may not need unrestricted access to the patient's entire clinical record. A documentation assistant may need information from a defined encounter but should not automatically have authority to modify medication orders.
Healthcare organizations should also distinguish read access from action authority. Reading information creates privacy, confidentiality and cybersecurity risks. Creating, modifying, transmitting, deleting or triggering an action can add direct operational and patient-safety consequences.
This makes the question “What may this agent do without another person confirming the action?” more useful than simply asking whether the system is autonomous.
The U.S. FDA’s August 2026 discussion paper on generative-AI-enabled medical devices illustrates the issue. For agentic capabilities, FDA raises planning and sequencing of multi-step tasks, appropriate tool use, recognition of erroneous tool outputs, human-oversight checkpoints before irreversible or high-consequence actions, graceful handling of tool failures and resistance to prompt injection. The document is explicitly a discussion paper seeking feedback; it is not draft or final FDA guidance and does not establish regulatory requirements for Viet Nam. [5]
Human oversight should be designed around actions, not just outputs
For a chatbot, human oversight may mean reviewing an answer. For an agent, oversight may need to occur at several points in a workflow. An authorized person may need to approve the goal before the workflow begins, confirm particular tool calls, authorize a consequential action, intervene when the system encounters uncertainty or review certain actions afterward.
Article 4 of Viet Nam’s AI Law establishes a strong human-centered principle: AI serves people rather than replacing human authority and responsibility, and human control and the ability to intervene must be maintained over decisions and actions of AI systems. [1]
This does not necessarily mean that a person must manually approve every technical step. It does mean that organizations should be cautious about designing workflows in which consequential AI actions become effectively uncontrollable.
An approval screen is also not meaningful oversight merely because someone can click “approve.” For higher-consequence workflows, the person needs enough information to understand what the agent is proposing, which information or tools are involved and what the foreseeable consequence is. At the same time, requiring approval for every trivial action can create alert fatigue and turn oversight into a ritual. The objective is not maximum clicking; it is to place human judgment where it can materially reduce risk.
Healthcare organizations therefore do not need to choose between completely manual workflows and broad autonomous execution. A practical approach can use progressive delegation. This is an implementation concept, not a statutory autonomy model under Vietnamese law.
An organization might initially use an agent in observation or recommendation mode, where it can gather information and propose actions but cannot execute them. After appropriate evaluation, some functions might move into an approval-required mode, where an authorized person confirms execution. Well-defined, reversible and lower-consequence actions may eventually be considered for bounded automated execution within predefined limits, while meaningful human supervisory control and the ability to intervene are preserved.
Broader action authority should therefore follow evidence rather than technical capability. Autonomy should be earned through evidence, not granted simply because the technology supports it.
Define the action boundary before deployment
Every agentic use case should have an explicit boundary around what the system may and may not do. That boundary needs to be operational, not limited to general policy language.
“Assist with patient coordination” is too vague. A clearer boundary might state that an agent can read appointment availability, propose options, create a booking after defined checks, send an approved template and escalate clinical questions to a human, but cannot interpret symptoms, alter a treatment plan or access unrelated clinical records.
The organization should also define what forces the agent to stop or escalate. Examples may include missing information, conflicting data, failure of a required tool, inability to verify identity, unexpected responses, clinical questions outside the intended use or any proposed action outside the approved authority.
A useful test is: Can users, supervisors and technical teams independently describe essentially the same permitted and prohibited actions?
If they cannot, the deployment boundary is probably not clear enough.
Memory, data access and cybersecurity need separate controls
Some AI agents can retain information across interactions or tasks. Persistent memory may improve continuity and reduce repetitive work, but it can also create additional privacy, safety and accuracy risks. An organization needs to know what the agent remembers, why that information is necessary, how long it is retained, where it is stored, who can access it and whether inaccurate information can be corrected or deleted.
This becomes particularly important when memory includes identifiable patient information, health information, employee information or confidential organizational data. The Law on Personal Data Protection No. 91/2025/QH15 has been effective since 1 January 2026, and Decree No. 356/2025/NĐ-CP includes health status in the list of sensitive personal data and requires additional access, processing and security controls for sensitive data. [6,7]
An agent's “memory” should therefore not be treated simply as a convenience feature. In healthcare, it can become part of the organization's information-governance architecture. Where external or overseas services are involved, the organization should also determine which applicable cross-border personal-data requirements are triggered by the actual data flow.
Agentic systems can also increase cybersecurity exposure because they may connect models, credentials, databases, APIs, retrieved content and operational systems. One important example is prompt injection. An agent may retrieve a webpage, document, message or tool output containing instructions designed to alter its behavior. If that agent also has powerful tools or credentials, the consequence can extend beyond an inaccurate answer.
A compromised chatbot may generate misleading content. A compromised agent may attempt an unauthorized action.
Tool access should therefore be appropriately scoped, attributable and revocable. Broad shared credentials should be avoided where more controlled access is possible, and higher-consequence actions may require additional authorization. Systems should also be evaluated for what happens when retrieved content, user input or tool output contains malicious or conflicting instructions. FDA's 2026 discussion paper specifically identifies prompt injection through user inputs, retrieved content and tool outputs as an issue for agentic GenAI-enabled devices.
These controls sit within a broader Vietnamese cybersecurity environment that now includes Law No. 116/2025/QH15 on Cybersecurity, effective since 1 July 2026. [8]
Agentic workflows need safe interruption, escalation and fallback
An agent may begin with a reasonable goal and encounter an unexpected situation halfway through execution. A tool may become unavailable, data may conflict, an integration may fail, a workflow may enter a loop or a downstream system may return an unexpected response.
The organization therefore needs more than a way to start the agent. It needs a practical means to pause, restrict or stop the workflow, clarity about who has that authority and a plan for partially completed actions.
Where an action is reversible, rollback may sometimes be possible. Where an action is difficult or impossible to reverse—for example, information has already been transmitted externally, pre-execution safeguards become more important.
Agents also need defined escalation pathways. Missing information, conflicting inputs, uncertainty, unexpected tool behavior or movement outside the intended scope should not automatically be treated as problems the AI must solve independently. In healthcare, sometimes the safest action is to stop and ask a qualified person.
WHO South-East Asia specifically identifies accountability, escalation mechanisms, continuous monitoring and evolving human oversight among the issues institutions need to address as agentic workflows become more operationally embedded. [4]
Auditability and monitoring should follow the action pathway
Agentic workflows can be difficult to reconstruct if one component plans a task, another retrieves information, another executes an action and important intermediate events are not recorded.
For clinically or operationally significant use cases, the organization should be able to reconstruct the important operational sequence: what task was initiated, which system and configuration were used, what approved tools or data sources were accessed, what consequential actions were proposed or performed, which human approvals or escalations occurred and what outcome or exception resulted.
This does not mean an organization needs access to, or should attempt to preserve, a model's private internal reasoning. The objective is operational traceability, not chain-of-thought collection.
Auditability also needs to be proportionate. Logs may themselves contain prompts, patient information, tool responses, authentication metadata or confidential organizational information. Healthcare organizations should define what genuinely needs to be recorded, who may access it, how it is protected and how long it is retained. The aim is an evidence trail sufficient for monitoring, incident investigation and accountability without creating an uncontrolled new repository of sensitive information.
This becomes even more important with multi-agent systems. If several agents retrieve, analyze, review or act on information, accountability should attach to the overall deployed system and workflow. One agent checking another should not automatically be treated as evidence of safety; several agents may share the same model limitations, data problems or faulty assumptions.
Post-deployment monitoring should therefore extend beyond model accuracy and technical uptime. Depending on the use case, organizations may need to monitor attempted actions, inappropriate tool calls, actions blocked by controls, human overrides, failures to escalate, tool failures, repeated loops, unexpected access attempts, workflow completion, clinically significant mistakes and changes in behavior after model, prompt, tool or integration updates.
Human behavior also matters. Staff may gradually permit an agent to perform tasks outside its original scope. Human approvals may become automatic. Users may stop checking because the system has appeared reliable over time. The configured permissions may be unchanged while the effective autonomy of the system has increased.
Agentic monitoring should therefore ask not only “Is the system operating as configured?” but also “How much authority is it actually exercising in the real workflow?”
Vendor governance needs to cover the full agentic stack
A healthcare organization using an AI agent may depend on several parties at once: a foundation-model provider, an agent-platform vendor, a health-information-system vendor, a cloud provider and external tool or data providers.
The agent's behavior can also change even when the underlying model remains the same. A vendor may modify orchestration logic, system prompts, retrieval sources, memory behavior, available tools, default permissions or safety controls.
Vendor governance should therefore go beyond recording the name and version of the foundation model. Healthcare organizations should understand which components may change, how material changes will be communicated, whether specific tools or permissions can be disabled, what operational evidence will be available for investigation, how incidents will be handled and which changes should trigger renewed testing or governance review.
Approval of an agentic platform should not amount to approval of an indefinitely expandable black box.
Agentic AI may also raise medical-device questions
The term agent does not determine whether software is a medical device.
Under Viet Nam's current medical-device framework, software is included within the medical-device definition where the relevant statutory conditions are met and the software is intended for specified medical purposes. Consolidated Document No. 08/VBHN-BYT dated 6 March 2026 reflects the current consolidated framework, while Circular No. 24/2026/TT-BYT, effective from 1 July 2026, addresses medical-device risk classification and management measures. [9,10]
A scheduling agent and software intended to perform patient-specific diagnostic or therapeutic functions should therefore not automatically be treated as the same type of regulatory product. Whether a particular agentic system falls within medical-device regulation depends on the specific product, intended purpose and applicable legal criteria.
This analysis is separate from classification under the AI Law. A system may need to be assessed under several regulatory frameworks at the same time.
Start with bounded, lower-consequence workflows
Given the current evidence base, broad autonomous clinical operation should not be treated as a mature default. The 2026 scoping review by Collaco and colleagues found a small, heterogeneous evidence base with limited rigorous clinical validation. The evidence map published later in the year found early deployments concentrated in administrative workflows while clinical applications were expanding, and the larger survey by Xu and colleagues found that much of the literature remained in benchmark and controlled-evaluation settings rather than mature real-world clinical integration. [11–13]
For healthcare organizations, that supports a cautious implementation sequence. Agentic systems can often be evaluated first in bounded tasks where consequences are limited, actions are reversible and human escalation is straightforward. More consequential clinical uses require stronger evidence, tighter permissions, clearer action boundaries, more meaningful human oversight and more intensive monitoring.
That is not an argument against innovation. It is an argument for matching authority to evidence and risk.
A practical Agentic AI Governance Gate
Before granting an AI agent access to organizational systems or authority to take actions, a healthcare organization can ask:
Purpose and boundary: What exact goal is the agent allowed to pursue, and which tasks are explicitly outside its scope?
Tools and systems: Which applications, databases, APIs and external services can it access?
Permissions: What may it read, create, modify, send, delete or execute, and are those permissions limited to what is necessary?
Action authority: Which actions may occur automatically, which require human approval, and which are prohibited?
Clinical consequence: What could happen if the agent misunderstands information, chooses the wrong tool or performs the wrong action?
Human oversight: Where are meaningful supervision, approval, intervention and escalation points located?
Data and memory: What personal, health or confidential information can the agent access or retain, for how long and under what controls?
Cybersecurity: How are credentials, prompt injection, compromised tools, unauthorized access and untrusted external content addressed?
Auditability: Can the organization reconstruct consequential tool calls, actions, approvals, exceptions and outcomes without unnecessarily retaining sensitive information?
Failure and escalation: Can the agent stop safely when a tool fails, information conflicts or the workflow moves outside its approved boundary?
Evidence and testing: Has the complete agentic workflow—not only the underlying model—been evaluated under conditions relevant to the intended use?
Monitoring and change control: What agent-specific signals will be monitored, and what changes to models, prompts, tools, permissions, integrations or workflow require reassessment?
Accountability: Who owns the use case, who can expand or reduce the agent's authority, who can suspend it, and who responds when something goes wrong?
This Agentic AI Governance Gate is a practical organizational framework. It is not a statutory AI risk-classification method, conformity-assessment procedure, medical-device classification method or substitute for any legal requirement applicable to the specific system.
Approval should attach to the capability set, not only the product name
One of the most important governance lessons for agentic AI is that approval should not simply say “Product X is approved.”
The risk depends heavily on what capabilities have been enabled. The same platform may create limited risk when permitted only to search an internal knowledge base but a substantially different risk when connected to patient records, communications, scheduling or another operational system.
A stronger approval record should therefore identify the approved use case, tools, data sources, permissions, action authority, human checkpoints, escalation conditions and monitoring requirements.
If those capabilities materially change, the organization should ask whether the original approval, risk assessment and evidence still apply. This is especially important because agentic capability can expand through configuration without a visibly new product or major interface change.
What this means for healthcare organizations in Viet Nam
Agentic AI represents a meaningful shift in healthcare AI governance. The important difference is not simply that a system may appear “smarter.” It is that the system may be given the ability to do more.
That changes what healthcare organizations need to govern. Model performance still matters, but it is no longer enough. Organizations also need to understand tool access, permissions, memory, action authority, escalation, interruption, traceability, cybersecurity and the consequences of multi-step workflows.
Viet Nam's AI framework already provides a relevant foundation through human-centered control, statutory risk classification and stricter risk-management expectations for healthcare. But the law does not create a special statutory category for agentic AI, and healthcare organizations should not invent one. The applicable classification and other legal obligations need to be determined for the particular deployed system.
At the same time, the international evidence supports caution. WHO South-East Asia is explicitly examining how human oversight, accountability and escalation need to evolve as AI becomes more agentic, while current peer-reviewed reviews continue to describe a fast-moving field whose clinical validation and routine real-world implementation remain comparatively immature.
For healthcare leaders, the useful question is therefore no longer only “Can this AI generate a good answer?” It is “What authority are we prepared to give this AI to act, and what evidence and controls justify that authority?”
A responsible healthcare organization should not grant an AI agent broader access or action authority simply because the technology makes it possible. The safer progression is to define the task, restrict access, limit authority, preserve meaningful human control, monitor real-world behavior and expand capabilities only when evidence and organizational readiness support doing so.
As healthcare AI moves from answering toward acting, governance has to move with it.
Professional education notice
This article is intended for professional education and knowledge exchange. It does not constitute individualized legal, regulatory, clinical, medical-device, cybersecurity, personal-data or conformity-assessment advice.
Terms such as agentic AI, AI agent, action authority, progressive delegation, bounded automated execution and the Agentic AI Governance Gate are used here as practical governance concepts. They are not statutory AI risk categories or autonomy levels established by Viet Nam's Law on Artificial Intelligence, Decree No. 142/2026/NĐ-CP or Decision No. 33/2026/QĐ-TTg.
An AI system should not be classified as legally high-risk merely because it is agentic, has tool access or can execute multi-step workflows. Statutory classification must be determined under applicable Vietnamese law for the specific AI system and deployment. Similarly, use of agentic technology in healthcare does not automatically make a product a medical device; medical-device status depends on the applicable definition, intended purpose and regulatory requirements.
References to WHO, FDA and international research are included as international evidence and governance considerations. In particular, the FDA publication cited below is a discussion paper seeking stakeholder feedback. It is not draft or final FDA guidance and does not establish regulatory requirements applicable in Viet Nam.
References
[1] National Assembly of Viet Nam. Law No. 134/2025/QH15 on Artificial Intelligence. Adopted 10 December 2025; effective 1 March 2026.
[2] Government of Viet Nam. Decree No. 142/2026/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Artificial Intelligence. Issued 30 April 2026; effective 1 May 2026.
[3] Prime Minister of Viet Nam. Decision No. 33/2026/QĐ-TTg Promulgating the List of High-Risk Artificial Intelligence Systems. Issued 30 June 2026; effective 15 August 2026.
[4] WHO Regional Office for South-East Asia. Agentic Workflows and Human Oversight. Responsible AI in Healthcare Webinar Series, 3 June 2026.
[5] U.S. Food and Drug Administration. Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback. Issued 18 August 2026.
[6] National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Adopted 26 June 2025; effective 1 January 2026.
[7] Government of Viet Nam. Decree No. 356/2025/NĐ-CP Detailing a Number of Articles and Measures for Implementation of the Law on Personal Data Protection. Issued 31 December 2025; effective 1 January 2026.
[8] National Assembly of Viet Nam. Law No. 116/2025/QH15 on Cybersecurity. Adopted 10 December 2025; effective 1 July 2026.
[9] Ministry of Health of Viet Nam. Consolidated Document No. 08/VBHN-BYT on Medical Device Management. 6 March 2026.
[10] Ministry of Health of Viet Nam. Circular No. 24/2026/TT-BYT on Determining Risk Levels and Management Measures for Products and Goods That Are Medical Devices and Amending Certain Provisions of Circular No. 05/2022/TT-BYT. Issued 30 June 2026; effective 1 July 2026.
[11] Collaco BG, Haider SA, Prabha S, et al. The role of agentic artificial intelligence in healthcare: a scoping review. npj Digital Medicine. 2026;9:345.
[12] Xu J, Ko JM, Kvedar JC. AI agents in clinical practice: an evidence map. npj Digital Medicine. Published 13 July 2026.
[13] Xu G, Li X, Chen Y, et al. A comprehensive survey of AI agents in healthcare. Journal of Biomedical Informatics. 2026;179:105045.