A new governance model for agentic AI at scale

By: Ratna Rao and Anthony Ward

As enterprises accelerate AI adoption, many are moving rapidly from experimentation to production-scale agents. Most organizations start with simple, low‑risk use cases: FAQ chatbots, internal knowledge helpers or productivity copilots. These early wins build confidence and lead to bigger ambitions, like applying AI agents across everyday work.

Yet, across customer engagements, one pattern is becoming clear: governing agents responsibly as they scale remains a persistent challenge. According to the 2026 Kyndryl People Readiness Report, only 25% of organizations say their governance and compliance capabilities are ready to successfully leverage AI.

That gap raises some immediate, practical questions. Who owns the actions an agent takes? How should organizations manage multiple agents working across shared workflows? How do they prevent duplication, conflicts or unintended cross-system actions? And how do accountability, governance and security evolve as agents shift from assisting users to acting more independently across multiple platforms?

Computer, teamwork and review with business women in office for accounting discussion, audit feedback or talk. Tech, portfolio manager and collaboration with mentor, tablet and finance agency report.

Scaling AI agents requires governance that keeps accountability and security in step with autonomy.

Different agents, common guardrails

Many organizations already have strong governance foundations, regardless of which AI platform they use. Across leading AI automation platforms, the core building blocks are more or less the same: identity and access management, data protection, environment segmentation, auditing, compliance monitoring, lifecycle management and operational controls.

Microsoft Copilot Studio and Power Platform, for example, provide environment management, data loss prevention policies, role-based access controls, audit trails and integration with Microsoft 365 security and compliance capabilities. Google Vertex AI, ServiceNow, AWS and Claude Enterprise meanwhile offer comparable governance capabilities across access, monitoring, policy, logging and administration.

But having governance features is not the same as being ready to govern AI at scale. The harder work is in translating platform capabilities into a consistent operating model that works across day-to-day operations and multiple ecosystems. That distinction matters because most enterprises will not standardize on a single agent framework. Governance, therefore, has to follow the agent wherever it runs. It cannot depend on controls tied to one product.

Governance is evolving

Consider how governance worked in low-code environments such as Power Platform.

Historically, Power Platform governance focused on applications: who could build, which connectors could be used and where data was allowed to live. That model worked because applications generally followed predictable paths and executed predefined logic.

AI agents change that assumption. They interpret context, make judgments and act on behalf of users and the business. Their behavior is less predictable, data access becomes more dynamic and outcomes are no longer fully scripted.

Governance must therefore extend beyond application controls to agent identities, tool and data permissions, runtime predictions and ongoing monitoring.

This shift introduces a new risk profile. Common challenges include agent sprawl, where unmanaged agents proliferate with overlapping functionality and unclear ownership; accountability gaps; data exposure; cascading automation failures; and value dilution, where organizations build large numbers of agents without clear objectives.

A simple question captures why governance is so critical here: If an agent makes a mistake, who is responsible?

You can’t govern what you can’t see

One of the first roadblocks enterprises encounter is not creation, it’s observability.

Teams can build agents quickly, while leaders may still struggle to answer basic questions: What agents exist? Who owns them? What data can they access? Where are they running? How are they being used? What has changed since last month?

Without that visibility, governance is largely theoretical. Effective observability requires more than scattered breadcrumbs. Organizations need a consistent way to discover agents, including shadow or unmanaged agents; classify them by purpose and risk; assign ownership; track lifecycle state; and capture activity and telemetry in views that are useful to IT, security, compliance and business teams.

This is why an agent registry or inventory is becoming a foundational governance capability. It creates the visibility needed to move from fragmented experimentation to managed scale.

Enabling governed innovation without creating roadblocks

Organizations that scale successfully tend to embrace a straightforward principle: use governance to enable innovation, not obstruct it.

For agentic AI, guardrails need to operate across the full lifecycle—from creation and testing through promotion to production and runtime and retire.

In practical terms, this requires:

An environment strategy aligned to delivery lifecycles
Risk-based data loss prevention and connector policies
Agent identities governed by least privilege access and conditional access
Review and certification gates before deployment
Continuous policy monitoring and enforcement so agents remain aligned with governance standards.

The goal is not to stop teams from building. It is to make responsible building easier, safer and repeatable.

Senior businessman discussing over adhesive notes with colleague using smart phone in office

Effective AI governance enables innovation by making agent development safer, easier and repeatable at scale.

Preventing hallucination and agent drift

Hallucination is often treated as a model problem. In the enterprise, it is also a governance and operational risk, particularly when agents support decision making or execute actions.

Agent drift presents a related challenge. Over time, agents can deviate from original objectives or produce inconsistent outputs as data, systems, workflows and interactions change. Without appropriate controls, the result can be workflow failures, compliance issues and declining trust in AI systems.

The answer is not a one-time design review. It must be an ongoing operational discipline built around continuous monitoring of agent behavior, policy-based guardrails, lifecycle management and human oversight at the right intervention points.

These risks vary by industry.

Financial services

An internal policy assistant may produce confident but inconsistent interpretations of controls across regions, creating audit friction because the organization cannot trace what sources informed the output.

Healthcare

A patient communication agent may summarize guidance without grounding in the latest approved protocols, eroding clinician trust and forcing manual review back into the process.

Energy and utilities

An operations agent may trigger an automation chain based on partial context; without runtime telemetry, teams will struggle to diagnose the cause of cascading workflow failures.

Retail

A customer-facing agent may provide product or policy information that varies across channels because prompts and knowledge sources are inconsistent, creating reputational and customer experience risk.

Manufacturing

Multiple sites may build similar agents with different logic and permissions, creating sprawl and accountability gaps that prevent scaling beyond isolated success stories.

The common thread is trust. Innovation scales only when leaders can see what exists, constrain what is allowed, and continuously verify how agents behave.

Governance as a confidence enabler

Irrespective of the industry, organizations succeeding with AI agents rally around the same idea: governance should enable innovation. When approached intentionally, governance becomes a confidence enabler. It allows organizations to move faster while preserving trust, consistency and control.

Tactically, this can look like:

Embedded controls that are supportive and largely invisible when things go right
Preconfigured environments with approved connectors
Templates and accelerators with “baked-in” best practices
Automated monitoring, alerting and policy decisions instead of manual approvals for every step
Risk-based governance, with stricter controls as risk increases

Governance must be platform-agnostic

Enterprises rarely standardize on one agent platform. Governance practices therefore need to work across low-code platforms like Copilot Studio, pro-code platforms such as Azure AI Foundry and third-party platforms such as ChatGPT, Gemini and Claude.

The same governance principles apply regardless of where agents are built: data loss prevention, data governance, promotion reviews, governed identities and centralized observability that provides a cross-platform view of agent activity, usage and risk.

A practical maturity path starts with native platform control, extends toward unified telemetry ingestion and cross-platform audit reporting, and ultimately moves toward an enterprise-scale ‘single pane of glass’ for risk signals and governance enforcement.

Business, people and meeting on tablet at office of planning, financial documents and company growth. Men, collaboration and paperwork with profit graph, investment report and feedback of opportunity.

Enterprise AI governance must span platforms, unifying controls and risk management across the agent ecosystem.

Five moves to get started

For most organizations, the next step is not simply to build more agents. It is to understand, control and govern the ones that already exist.

A pragmatic path forward includes five moves:

Identify agents, copilots, automations and scripts; map where they run and what they access

Classify agents by impact and data sensitivity; identify control and ownership gaps.

Lifecycle, ownership and monitoring standards; align governance to security, compliance, and IT service management models.

Registry, identity, access controls and monitoring; embed guardrails into execution; apply policy-as-code where appropriate.

Detect drift and anomalies; realign agents with business goals; maintain ongoing governance ownership.

In the AI era, governance is the enabler of scale. The winners will treat agent governance as a strategic capability, one that builds trust and allows innovation to move faster safely.

A new governance model for agentic AI at scale

By: Ratna Rao and Anthony Ward

Different agents, common guardrails

Governance is evolving