By 2027, 74% of enterprises expect to run AI agents at least moderately across their operations, according to Deloitte’s April 2026 survey of 3,235 IT and business leaders across 24 countries. Only 21% of those same organizations report having a mature governance framework in place. That gap is the story.
I lead the Salesforce and Vlocity CPQ and CLM transformation at T-Mobile in Bellevue through Mphasis. Before that, at Amazon, I was the technical product manager for an ML system that extracted rebate and penalty clauses across a $40 billion annual transportation contract portfolio with 95% accuracy. Both systems had a human check the output before it moved money or changed a contract.
That review step is what most “human in the loop” governance still assumes exists. In a multi-agent stack, it often doesn’t.
Why does one review step stop working
A single model that extracts a clause produces one output for one human to check. A multi-agent workflow plans a task, breaks it into steps, calls other agents or tools to execute those steps, and hands results to the next agent in the chain. Nobody reads most of what happens in the middle.
The human review most teams still rely on happens at the start of the workflow, when someone types a prompt, or at the end, when someone sees a final result. Everything the agents did to each other in between goes unreviewed by default.
This is not a hypothetical problem. A 2026 Cloud Security Alliance research note on 235 large-enterprise security leaders found that 92% lack full visibility into their own AI agent identities, and 95% doubt they could detect or contain a compromised agent if one existed in their environment. The same research found that 86% do not enforce access policies for AI identities at all, even though 71% of those organizations report AI systems with access to core business platforms: ERP, CRM, and financial systems. Only 16% of governors effectively govern that access
Gravitee’s State of AI Agent Security Report 2026, based on 750 senior technology leaders in the UK and US, adds a second data point: 48% of production AI agents currently operate unsecured, and 85% of organizations report having no formal accountability structure for agent behavior. More than half (54%) experienced or suspected a security incident tied to an agent.
Decision boundaries, not blanket approval
Decide in advance which actions an agent chain can take without human intervention and which it can’t, no matter how confident the agent looks.
At T-Mobile, our CPQ and CLM workflow treats certain actions as reversible and others as not. Generating a draft quote is reversible. Nobody sees it until a rep or an approver does.
Applying a discount above a rep’s approval threshold is not reversible in the same way, because once a quote goes to a customer at that price, walking it back costs trust and sometimes the deal. The system I helped build cut contract creation time by 50% by aggressively automating the reversible steps while maintaining a hard checkpoint on the irreversible ones.
Apply the same test to any agent chain. Ask which step, if wrong, can be caught and corrected downstream without external consequence, and which step, if wrong, has already shipped something to a customer, a regulator, or a ledger by the time anyone notices. Everything in the second category needs a deterministic checkpoint: a rule the agent cannot route around, not a monitoring alert that fires after the fact.
Guardrails that act during execution, not after
Audit logs answer what happened. They don’t stop it from happening. A transaction guardrail sits within the execution path and blocks or holds an action before it completes, much like a fraud rule blocks a card transaction before it clears rather than flagging it the next morning.
For agent chains that touch pricing, contract terms, or customer commitments, that means the guardrail checks the specific field, threshold, or clause type that the action would change, not just whether the agent “seems” to be behaving normally. A discount request above the policy gets held for approval. A clause substitution that deviates from an approved contract template gets flagged before it’s inserted, not after the document is countersigned.
This is slower than letting the agent run unchecked. It is also the difference between catching a $50,000 pricing error before a customer sees it and explaining it after they’ve already signed.
What accountable execution requires
Three things have to exist before a multi-agent workflow touches production, not after an incident forces the question:
An action inventory. Every action an agent in the chain can take, tagged reversible or not, with the irreversible ones mapped to a required checkpoint.
An identity for every agent. Not a shared service account. The CSA research above found 92% of organizations can’t see their own agent identities clearly; that starts with agents sharing credentials instead of each carrying its own auditable identity.
A chain-level audit trail, not just a per-agent log. When five agents hand off a task, the record needs to show the full sequence, in order, with what each agent changed, so a reviewer can reconstruct the decision path without guessing which agent did what.
None of this requires slowing deployment to a crawl. It requires deciding, before the agents run, what they’re allowed to do without asking.
The takeaway
Before adding another agent to a workflow, map its actions into reversible and irreversible. Put a real checkpoint, not a dashboard, on everything in the second group. That one exercise will tell you more about your actual governance gap than any framework document sitting in a compliance folder.
Sources cited:
- Deloitte: Agentic AI is scaling faster than guardrails
- Cloud Security Alliance: The AI Agent Governance Gap
- Gravitee: State of AI Agent Security Report 2026
