Lead Software Development Engineer specializing in hyperscale cloud infrastructure, data center observability, and distributed systems. Experienced in building secure, high-performance platforms that support large-scale telemetry processing, infrastructure monitoring, and global capacity management
Here is a pattern that should trouble anyone responsible for enterprise AI: the organizations with the most visible AI governance are frequently the most sprawled. Walk into a large company with an AI review board, an approved-framework mandate and a standing architecture committee, and you will still find three, four, sometimes seven teams quietly running agents that do almost the same thing. Customer service has one that triages tickets; so does ops, built independently six months later on a different framework with different guardrails. Finance summarizes vendor contracts; legal built something similar, unaware the other existed.
The usual reading is that governance simply hasn’t caught up — add more of it and sprawl recedes. Gartner’s projection that over 40% of agentic AI projects will be canceled by the end of 2027, on grounds of escalating costs, unclear business value, and inadequate risk controls, is routinely cited as the case for tightening the approval process further.
This article argues the opposite reading. Sprawl survives governance because enterprises are building the wrong kind. Nearly everything organizations have erected around AI agents — review boards, use-case approvals, framework mandates — governs intent: what an agent is supposed to do, whether it should exist, whether its purpose is acceptable. Almost nothing governs capability: what an agent, once running, can actually reach, touch, and trigger. A committee can spend three weeks deliberating whether the marketing team’s agent is appropriate. It cannot revoke a forgotten agent’s live credentials, compare two teams’ triage agents on a common test, or notice that five departments separately maintain the same CRM integration — five copies, five security surfaces, five patching schedules. Intent is governed in the conference room. Capability is governed in infrastructure, and the infrastructure isn’t there.
Why enterprises keep choosing the conference room
The data on the capability side is stark. A recent VentureBeat survey of 800 IT leaders across the US and UK found that non-human identity governance — the discipline controlling what autonomous software may access — is the least mature security control it measured, in place at just 21% of organizations, even though non-human identities already outnumber human users at 83% of the companies surveyed. At four out of five enterprises, the fastest-growing population inside core systems is the one least likely to have dedicated access controls or lifecycle management. Okta’s enterprise sign-on data tells the same story from below: agent workflows are still routinely authorized with static API keys, shared service accounts, and in some cases employees’ own logins. “When an AI agent inherits a human’s login, you completely lose your audit trail,” as Okta’s Fei Liu put it. Read those findings next to the proliferation of AI councils and review boards, and the mismatch is hard to unsee: enterprises are convening committees to deliberate agent intentions while four in five lack mature control over agent capabilities.
The mismatch isn’t stupidity. It’s legibility. A review board produces artifacts — charters, minutes, approval records — that a board of directors and an auditor can see. Identity infrastructure for agents produces something invisible: the absence of incidents. When leadership demands evidence of AI governance, a committee generates evidence by existing; plumbing generates evidence only by failing. Organizations under pressure to demonstrate governance therefore rationally over-invest in the demonstrable kind and under-invest in the effective kind. This is not a new pathology — it is the same force that produces security theater and compliance checklists no attacker has ever found inconvenient. Agents are simply its newest and most consequential venue, because agents act. An ungoverned SaaS tool leaks a spreadsheet; an ungoverned agent sends the email, modifies the record, approves the refund.
The standard objection is that capability governance is exactly the bureaucracy that slows AI programs down. The same survey found the opposite: organizations that had built non-human identity governance were five times more likely to report no barriers to expanding their agent deployments. The drag enterprises fear from governance is, in practice, coming from its absence — every expansion of an ungoverned agent estate raises the cost of the eventual reckoning, and leaders feel that cost as hesitation. Gartner has begun circling the same conclusion from another angle, warning that uniform, one-size-fits-all controls fail in both directions: over-restricting simple agents, which drives shadow development, and under-restricting autonomous ones, which concentrates risk. That is a calibration critique — governance tuned to the wrong tier. The deeper problem is governance aimed at the wrong layer. You can calibrate an approval committee perfectly, and it will still have no idea what your agents can reach.
The engine underneath: reuse is a bad trade
Even perfect capability governance would leave one force untouched, and it is the force that actually manufactures sprawl: inside most enterprises, reusing another team’s agent is a bad trade for the person deciding.
Consider the team lead’s actual choice. Build a new agent and it works: a visible win, a demo, a line in the promotion packet. Build it and it fails: a noble experiment — the organization is praising AI risk-taking this year. Now the other branch. Adopt a peer team’s agent and it works: the credit accrues to them. Adopt it and it fails: you own a failure you didn’t build and can’t fix, dependent on a team that owes you nothing. Building is upside-heavy; reuse is downside-heavy. Seven duplicate agents are not seven acts of ignorance. They are seven locally rational decisions, and no registry changes the math. The agent registries and management planes that platform vendors have shipped over the past year fix discoverability, and discoverability matters — you cannot triage what you cannot see. But a registry is a supply-side answer to a demand-side problem. Teams don’t fail to reuse because they can’t find each other’s agents. They fail to reuse because finding them changes nothing about what they’re rewarded for.
The most instructive counterexample comes from an organization that pulled the incentive lever directly. Stagwell, the marketing holding company, faced a version of the problem most enterprises would recognize, multiplied: more than seventy agencies under one roof, each with real technology autonomy, all building agents simultaneously. Rather than an approval board, Global CTO Merrill Raman’s team built an internal Agent Cloud — a curated, usage-ranked catalog on the company intranet — with one decisive addition: licensing and revenue share. When one agency’s agent is adopted by another, the building team benefits financially; agents that graduate into client-facing solutions carry external revenue share. Agents are treated as internal products, not internal tools, and that distinction changes how teams invest in building them. Raman is careful not to declare victory — “I wouldn’t say we’ve fully solved it; we’re working towards it” — but the design reverses the payoff structure that manufactures sprawl everywhere else: at Stagwell, “my agent became the company standard” now beats “my team built its own.” Most enterprises don’t need a literal marketplace. Every enterprise needs its equivalent — some legible way adoption outranks construction.
Govern agents the way you already govern people
If committees are the wrong centralization, what does the right one look like? Enterprises already run a version of it, and have for decades — for humans.
No company lets each department invent its own badge system, its own payroll, its own background-check standard. Identity, access, and audit for employees are ruthlessly centralized, because a bad hire with the wrong permissions is an organization-wide risk. But no sane company lets a central committee set every department’s performance standards, review every deliverable, or dictate how finance should exercise judgment differently from marketing. Management is local, because judgment is domain-specific and the blast radius of a bad local call is local.
Agents deserve precisely this split. Centralize what a bad decision makes everyone pay for: agent identity and permissions, applied with equal rigor whatever team built the agent; shared evaluation, so “how good is this agent” has one comparable answer across the portfolio instead of each team’s private standard; the connectors into systems of record, built once; audit logging consistent enough that a regulator never has to care which internal team’s system made the call. Leave local what a bad decision makes only one team pay for: the domain reasoning, the error tolerance — a finance agent’s threshold should never be set by the standard applied to a marketing generator — the human-review design, and business ownership, because the strongest predictor of an agent surviving to production remains a named leader whose outcomes depend on it.
The same split should run through the agents themselves, not just the rules around them. Companies already centralize the tools employees use — the laptop, the email system, the ERP — while leaving how each department thinks about its work local. The agent equivalent is to stop treating every agent as a monolith one team builds end to end, and instead decompose it: connectors, guardrail policies, memory infrastructure, and the evaluation harness become shared, platform-maintained components; teams own only the judgment layer on top — the reasoning, the domain policy, the escalation design. This changes the economics of sprawl itself. Seven triage agents sharing one chassis are not seven security surfaces and seven duplicated engineering efforts; they are seven thin judgment layers on common plumbing — close to harmless variation, and, because they share an evaluation harness, directly comparable and trivially mergeable. One caution, learned over a decade of platform engineering: this works as a paved road, never as a mandate. If the shared components are worse than building your own, teams route around them and you get sprawl plus concealment. Stagwell runs an 80/20 version of this instinct — roughly 80% of the technology estate standardized, 20% deliberately left open for teams to pick what serves their clients. The chassis has to win on convenience, with exactly one hard gate: production credentials are issued only to agents built on governed components. Experiment however you like; to touch real systems, you ride the chassis.
Central identity, local management. It worked for a workforce of humans. It is the only model that scales to a workforce that includes software.
Sprawl without selection is waste. Sprawl with selection is R&D.
One last reframe, because the consolidation instinct can overshoot. The existence of seven overlapping agents is not itself the pathology. Agents are cheap to build, and two teams independently prototyping the same capability with narrow permissions is inexpensive parallel experimentation — arguably the healthiest use of cheap AI development there is. Evolution needs variation. What it also needs, and what enterprises are missing, is selection.
The pathology is that no tournament ever runs. Nobody puts the seven agents on a common evaluation set, picks a winner per capability, migrates the losing teams onto it, and — with the same rigor deployment got — retires the losers: credentials revoked, consumers redirected, audit trail archived. An abandoned agent with live permissions is not a sunk cost; it is an open door.
Selection shouldn’t depend entirely on a quarterly meeting remembering to run, either. Today’s agents are provisioned default-alive: stood up once, running until someone notices. Flip the default. Every agent credential carries an expiry; renewal requires evidence of usage and a named owner re-attesting its value. Variation stays free — residency does not. Prototypes nobody vouches for die on their own, and the tournament only adjudicates agents that earned the right to still be running. Run that selection quarterly, at the level of capability rather than agent, and duplication converts from waste into a discovery mechanism. Skip it, and every prototype becomes a permanent resident.
The enterprises that compound value from AI agents over the next few years will be recognizable by a strange tell: their central AI function will look boring. Identity, evaluation, connectors, a registry, a component library teams actually want to use, credentials that expire by default, a quarterly tournament, one incentive that makes adoption pay — and domain teams moving fast on top. The enterprises that kept choosing the conference room will be recognizable too. They’ll spend 2027 retiring their fourth overlapping ticket-triage bot, with immaculate committee minutes documenting the approval of every one of them.
