AI agent sprawl is the unmanaged growth of software agents across departments, platforms and business processes. The governance challenge is not simply how many agents exist: it is whether the organization can identify each one, assign accountability, constrain its access and actions, monitor what it does, and retire it when it is no longer needed. IT teams need shared guardrails that make approved use practical—not a blanket ban that pushes activity out of view.
What is AI agent sprawl, and why is it different from ordinary software sprawl?
AI agent sprawl occurs when teams create, adopt or connect agents faster than the organization can track and govern them. An agent might be built by a business unit, supplied through a platform, or connected to tools and services as part of a larger workflow. The result can be a mix of sanctioned and unsanctioned agents distributed across different environments.
As an Amazon Associate I earn from qualifying purchases.
The distinction from a simple software inventory problem is that agents can interact with data and take actions. Depending on their design and permissions, they may call tools, access services, or work with other agents. Microsoft’s security guidance identifies risks including indirect prompt injection, unintended actions and data exfiltration across these interactions. A gap in ownership or access control can therefore become an operational or security issue, not just an incomplete asset record.
Gartner’s April 2026 announcement forecast that an average global Fortune 500 enterprise could have more than 150,000 agents in use by 2028, up from fewer than 15 in 2025. This is a forecast, not a census of current deployments. Gartner also reported that 13% of organizations think they have the right agent governance in place; that figure should be read as Gartner’s reported finding, not as a measure of any particular organization’s readiness.
#1 Best Overall
- Used Book in Good Condition
Why do IT teams struggle to see and control agents?
Agents can be introduced through separate teams and platforms, while the information needed to govern them—who owns them, what they can reach, and whether they are still needed—may be scattered or missing. A central team may not know an agent exists until it causes a problem, or may know the agent but lack a reliable way to attribute its activity.
A Cloud Security Alliance survey of 285 IT and security professionals, conducted online in September and October 2025 and reported in 2026, found that 21% of organizations maintained a real-time agent registry and 28% could reliably trace agent actions across all environments. Strata Identity commissioned and financed the survey, a context worth bearing in mind when interpreting its findings.
IBM’s Institute for Business Value reported in June 2026 on a survey of 2,000 senior technology executives across 33 geographies and 19 industries, conducted from January through April 2026. In that survey, 70% said business teams deploy technology faster than IT can track, and 77% said AI adoption is outpacing current governance capabilities. Respondents anticipated a 38% increase in deployed AI agents by 2027; that is an expectation reported by survey participants, not a measured future outcome. IBM also reported an average of 54 agent incidents in the prior year among surveyed organizations. These are IBM survey results, not universal rates, and should not be combined with the CSA figures as if both studies measured the same population or definitions.
The organizational tension is real: slow or unclear approval paths can encourage teams to deploy outside formal controls, while unrestricted autonomy can leave the enterprise unable to understand what agents can do. Gartner analyst Max Goss described the goal as finding “a balance where they can govern agents and manage sprawl, but also safely empower employees to innovate with these tools.”
What can go wrong when agents are unmanaged?
- Unknown deployments: Agents created or adopted outside an approved process may not appear in IT’s inventory, leaving security and operations teams without a complete picture.
- Unclear accountability: If no person or team owns an agent, there may be no one responsible for reviewing its access, investigating its actions or retiring it.
- Excessive or inherited access: An agent with broader permissions than its task requires can expose more data or tools than intended. Shared or poorly attributed identities can also make it difficult to determine which agent performed an action.
- Conflicting activity and stale data: AWS describes how business units can build similar agents independently, or how one agent can change shared data while another acts on an older version. This can create inconsistent outcomes across a workflow.
- Exposure through connected tools and data: Each model, plugin, service, tool or data source an agent can reach adds something that needs to be understood and governed. Microsoft highlights indirect prompt injection, unintended actions and data exfiltration as relevant security risks.
- Hidden aggregate costs: Spending that appears modest in individual team budgets can add up across departments or projects, particularly when deployments are not centrally visible.
- Fragmented compliance: Agents operating across business units may cross data or regulatory boundaries. Separate local practices can make it harder to apply consistent controls or demonstrate oversight.
Counting agents alone does not reveal which of these risks applies. A useful governance view connects each agent to an owner, purpose, identity, access scope, connected resources, lifecycle status and activity history.
How should IT teams govern agents across departments?
Establish a repeatable control sequence that follows an agent from proposal through retirement. Gartner’s 2026 recommendations cover policies for agent creation and sharing, a centralized inventory, identity and permissions, data governance, behavior monitoring and responsible-use practices. Microsoft likewise recommends clear ownership, lifecycle governance, least privilege and unique auditable identities. These controls reduce blind spots; they do not guarantee that an agent will behave safely.
- Set the baseline and define what counts as an agent. Establish enterprise rules for creating, buying, sharing and connecting agents. Apply them across first-party, custom and third-party agents, and specify which uses require review before deployment. Keep the rules understandable to the teams expected to follow them.
- Register each agent and assign an accountable owner. Require registration before production use, with a named person or team responsible for its purpose, operation and review. Record the agent’s platform, business purpose, access scope, identity, tools, models, plugins and data sources, along with its lifecycle status. A registry that only records a name and platform is unlikely to support decisions about access or response.
- Give each agent a distinct, auditable identity. Use an identity that lets security and operations teams attribute activity to the specific agent. Do not rely on a shared human or service identity if that prevents reliable attribution. Define how identity is issued, reviewed and disabled as the agent changes or is retired.
- Constrain permissions and connected resources. Grant only the access required for the agent’s stated task, and make its permitted tools and data sources explicit. Review permissions when the task, workflow or connected resources change. Treat access to tools, services and other agents as part of the permission boundary, not just access to files or databases.
- Manage the full lifecycle. Define registration and approval requirements, periodic reviews, change controls and an expiration or retirement process. Remove access and disable identities when an agent is decommissioned. Gartner and Microsoft both place lifecycle governance alongside inventory and access controls rather than treating approval as a one-time event.
- Monitor activity and prepare to intervene. Track agent actions, access and policy compliance in a way that supports investigation and response. Set out how teams will handle suspicious behavior, unexpected actions or policy violations, including who can restrict or disable an agent. Monitoring should cover relevant connected tools and environments, not merely the agent’s initial registration.
- Track cost and build responsible-use habits. Attribute costs to departments or projects so leaders can see aggregate use, not only individual deployments. Provide training and a route for teams to ask questions or propose agents. IBM’s Matt Lyteson emphasized embedding control and visibility “from the start” as organizations scale their AI use.
Joint Australian government guidance recommends deploying agentic AI incrementally, limiting early use to low-risk tasks, applying strict privilege controls, maintaining strong identity management and continuous monitoring, and keeping human oversight. This is a cautious starting point for deployment; the specific risk classification and oversight needed will depend on the task and organizational context.
How can a multi-business-unit organization share responsibility?
A federated, or hub-and-spoke, model can combine consistent enterprise controls with local knowledge. AWS proposes a central governance council that maintains standards and a shared registry, with governance leads in business units responsible for local compliance. AWS’s guidance is vendor-authored, but the division of responsibilities is a useful organizational pattern to assess.
Central governance council
- Set enterprise-wide minimum requirements for registration, identity, permissions, data access, monitoring and retirement.
- Maintain the shared registry and define common data fields so agents can be compared across units.
- Decide which use cases or access levels require heightened review, and establish escalation and incident-response paths.
- Provide a supported route to approved platforms and reusable controls so teams are not forced to choose between waiting indefinitely and deploying without visibility.
Business-unit governance leads
- Ensure local agents are registered and have an accountable owner, a clear purpose and an appropriate access scope.
- Identify local data, workflow and compliance constraints that enterprise-wide standards may not fully describe.
- Review local deployments and changes, and raise higher-risk cases to the central council under agreed criteria.
- Coordinate with other units when agents share data, tools or workflows, reducing duplicated efforts and conflicting actions.
Decision rights should be explicit: which standards are mandatory everywhere, what local leads can approve, which changes trigger central review, and how quickly a team can deploy within guardrails. AWS warns that slow central approvals can encourage unsanctioned deployments; a workable governance path needs clear ownership and a usable pace.
What should organizations compare in an agent-governance approach?
Governance can be delivered through a mix of organizational policy, identity and security controls, platform features and monitoring services. Microsoft documents a service ecosystem for organization-wide agent governance; that is a vendor’s description of its own services, not an independent product comparison. The sources available here do not establish a neutral head-to-head ranking of vendors. Compare capabilities against your actual environments and operating model.
| Capability | Questions to ask |
|---|---|
| Discovery coverage | Can the approach find sanctioned and unsanctioned agents across the platforms and business units the organization uses? |
| Registry quality | Can it record and keep current each agent’s owner, purpose, platform, access scope, identity, tools, models, plugins, data sources and lifecycle status? |
| Identity and attribution | Does each agent have a distinct, auditable identity, and can investigators trace actions to that agent across environments? |
| Permission and policy enforcement | Can policies enforce least privilege and constrain access to connected tools, services and data? |
| Lifecycle support | Does the process cover registration, approval, change review, periodic reassessment, expiration and decommissioning? |
| Monitoring and intervention | Can teams review activity and policy compliance, investigate problems and restrict or disable an agent when needed? |
| Platform and resource integration | Does coverage extend across the relevant agent platforms and connected models, tools and data sources, rather than stopping at one environment? |
| Cost visibility | Can usage and costs be allocated to departments or projects, with alerts that help identify unexpected aggregate spending? |
| Operating effort | How much ongoing work is required to keep discovery, ownership records, policies and integrations accurate? |
| Federated decision rights | Can enterprise standards coexist with local approvals, clear escalation paths and deployment timelines that business units can use? |
Assess whether the controls work together in the organization’s real deployment path: an inventory without current ownership data, or an identity without reliable action logs, may leave key governance questions unanswered. Assign responsibility for keeping each control current before expanding agent use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should IT leaders do first?
Start with visibility and accountability, then close the highest-impact access and monitoring gaps. A practical first pass is to identify where agents can be discovered today, decide what must be registered, name owners for active deployments, and prioritize review of agents with access to sensitive data or consequential tools. Use that initial view to set a minimum enterprise baseline and a clear process for exceptions, changes and retirement. Expand only as the organization can sustain the identity, access, monitoring and ownership records the process depends on.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
