Building an AI agent is now the easy part. A business user can generate one in an afternoon with no code. The hard part arrives six months later, when nobody can say how many agents are running, what they can touch, or who is accountable when one of them does something it should not.
That gap is about to become the defining enterprise risk of the year. Gartner forecasts the average Fortune 500 company will run more than 150,000 AI agents by 2028, up from fewer than 15 in 2025, while only 13% of organizations report having the right governance in place. Capability is racing ahead of the operating model around it. That is what most failed agentic AI projects have in common: they are not technology failures. They are governance failures wearing a technology disguise.
Agent sprawl is not simply a large number of approved AI deployments. It is the accumulation of autonomous or semi-autonomous systems without consistent ownership, visibility, access controls, lifecycle management, or evidence of business value.
It generally appears in several forms.
Individually, each deployment may appear manageable. Collectively, they create a fragmented population of non-human actors that can retrieve information, generate recommendations, communicate with customers, change records, trigger workflows, or initiate downstream actions.
Easy deployment without coordination produces shadow AI — agents acting on behalf of the enterprise that nobody can audit. An HR agent here, a finance agent there, a customer-service agent spun up by a team that never told anyone. Without a central registry, organizations accumulate forgotten autonomous processes that keep pinging APIs and burning budget while delivering nothing. The industry now has a name for the pattern: agent sprawl, the 2026 successor to the SaaS sprawl of the last decade.
The audit problem becomes acute the moment a regulator asks for a record of decisions made by automated systems. An enterprise that cannot produce that record for agents it deployed is in a materially worse position than one that deployed no agents at all. Autonomy without observability is not innovation; it is unmanaged liability.
Agent governance is often framed as a model-risk or cybersecurity concern. For executives, the exposure is broader.
Every agent introduces an identity, a set of permissions, one or more data sources, and connections to tools or systems.
Poorly scoped permissions can allow an agent to retrieve more information than its task requires. A compromised prompt, connector, tool, credential, or agent identity can turn a legitimate automation path into a route for data exposure or unauthorized action.
OWASP’s 2026 framework for agentic applications identifies critical risks associated with systems that plan, act, and make decisions across connected workflows, illustrating why traditional application security alone is not sufficient for autonomous systems.
Agent sprawl creates both visible and hidden costs:
When an agent contributes to a customer decision, modifies a regulated record, initiates communication, recommends an action, or triggers a transaction, the organization may need to explain:
An enterprise that cannot reconstruct that chain has more than a documentation problem. It has an accountability gap.
Agents operate across systems that change.
A deployment that was safe when approved can become risky after changes to its model, prompt, knowledge base, APIs, connectors, permissions, source data, workflow logic, or downstream applications. Governance therefore cannot end at launch.
NIST’s AI Risk Management Framework treats governance as a cross-cutting function and states that risk management should be continuous, timely, and performed throughout the AI system lifecycle. Its core functions—Govern, Map, Measure, and Manage—are intended to be iterative rather than one-time approval steps.
The instinct, once leaders recognize the risk, is to lock everything down with a single policy. Gartner is blunt that this is the wrong move: applying uniform governance across all AI agents will itself lead to failure. Treating governance as binary — either locked down or fully trusted — is the root cause, because agents operate at different autonomy levels and across different trust boundaries.
The consequences are already being predicted. Gartner expects that by 2027, 40% of enterprises will demote or decommission autonomous agents due to governance gaps discovered only after production incidents. Separately, the broader forecast that 40% of agentic AI projects will be scrapped by 2027 traces back to the same cause: poor governance, undefined business value, and insufficient operational discipline.
A practical governance model begins by separating autonomy from access.
The agent has read-only access to defined information and returns results to the requesting user.Examples include document retrieval, knowledge search, call summarization, and code explanation. Controls may include scoped data access, user authentication, usage logging, security testing, and output-quality monitoring.
The agent produces recommendations, drafts, classifications, or proposed actions, but a human performs the final action. Examples include drafting customer responses, recommending next-best actions, identifying possible fraud, or proposing case resolutions. Governance must address not only access and accuracy but also automation bias. A human approval step is not meaningful when employees routinely accept recommendations without adequate review.
The agent can write data, send communications, modify records, or trigger workflows, but each material action requires explicit approval. Controls should include clear approval interfaces, separation of duties, detailed audit trails, defined rollback procedures, incident-response playbooks, and monitoring for approval fatigue.
The agent takes action independently within predefined boundaries, while humans review exceptions, alerts, logs, and aggregate outcomes.
This level requires the strongest controls:
The governance tier should then increase further based on the sensitivity of the connected environment.
A Level 3 agent that updates low-risk internal project records is not equivalent to a Level 3 agent that changes payment instructions, modifies protected health information, or communicates regulated financial advice.
Autonomy determines how independently the agent can act. Access determines how much damage an incorrect or compromised action could cause. Both dimensions must shape the control model.
An organization cannot govern what it cannot identify. Every production agent should appear in a centralized inventory that records, at minimum:
This inventory should include agents developed internally, configured through SaaS platforms, embedded in enterprise applications, obtained through vendors, and deployed outside formal IT processes.
Gartner’s recommended response to agent sprawl begins with governance policies and a centralized agent inventory, followed by identity and permission management, information governance, behavior monitoring, remediation, and workforce education.
The inventory is not merely a directory. It is the control point from which the organization can identify duplicated agents, excessive permissions, missing owners, expired use cases, inconsistent policies, and unexplained costs.
A production agent should not inherit unrestricted access from the employee who created it. It requires its own identity, permissions, lifecycle, and evidence trail. That means applying familiar identity principles to a less familiar type of actor:
This also requires a clear distinction between what the agent is technically capable of doing and what organizational policy authorizes it to do.
A model may be capable of generating a refund recommendation. A connector may make it technically possible to issue that refund. Neither means the agent should have autonomous authority to complete the transaction.
Traditional AI monitoring often focuses on response accuracy, hallucinations, latency, and token consumption. Agent monitoring must go further because agents take actions. Executives need visibility into:
The most important question is not simply, “Did the model return an acceptable answer?” It is, “Did the overall workflow behave within the boundaries the enterprise approved?”
Observability should feed directly into operational controls. A high-risk anomaly should be able to restrict access, pause an agent, block a transaction, route an exception to a human, or initiate rollback. A dashboard without an intervention path provides awareness, not control.
Most governance programs concentrate on approving new systems. Agent sprawl is created just as easily by failing to retire old ones. Every agent should have an explicit review or expiration date. At that point, the owner should have to demonstrate:
Agents that cannot meet those conditions should be restricted, redesigned, consolidated, or retired. Decommissioning must also remove credentials, revoke tokens, disconnect APIs, archive required evidence, close vendor access, and update dependent workflows. Turning off a user interface is not the same as eliminating the agent’s access.
Agent governance cannot sit solely with data science, cybersecurity, or the business unit that created the use case. A workable operating model typically includes:
The agent registry may be centralized. Accountability should not be ambiguous. Every agent needs one named business owner who can answer two questions:
Create an initial inventory using platform records, procurement data, identity logs, API activity, cloud environments, business-unit interviews, and approved AI tools.
Prioritize finding agents with write access, external communications, regulated data, financial authority, customer-facing responsibilities, or access to production systems.
Assign each agent an autonomy level, data-sensitivity rating, owner, business purpose, permission scope, and required human control.
Identify agents that are unowned, duplicated, overprivileged, insufficiently logged, or unable to demonstrate measurable business value.
Introduce approval gates, least-privilege access, centralized logs, cost and activity thresholds, rollback procedures, review dates, and shutdown mechanisms.
Do not wait for a perfect enterprise platform before controlling the highest-risk agents. Start with the systems that can move money, modify customer data, expose regulated information, or trigger consequential downstream workflows.
Executives should monitor more than the number of AI agents deployed. Useful measures include:
A growing agent count is not evidence of AI maturity. The ability to prove which agents are valuable, controlled, observable, and accountable is.
Agent sprawl will not be solved by banning experimentation. It will be solved by making responsible deployment easier than shadow deployment and by applying stronger controls as autonomy, access, and consequence increase.
That requires more than an AI policy. It requires an operating layer connecting strategy, identity, permissions, data governance, workflow orchestration, monitoring, incident response, cost management, and lifecycle ownership.
Talk to Condado about designing the integration, monitoring, and governance foundation your autonomous agents need before they scale.
Explore our AI for CX and Contact Center services →
Voice can no longer carry the burden of proof. Learn how regulated contact centers can rebuild authentication against deepfake fraud.
Condado has become part of One Primero — a consolidated operating brand bringing Condado's contact center expertise and Tricension's technology delivery capability together under one name. Same team, same relationships. New name.
