Who Owns the Agent? Governance Across the Enterprise

An agent approved to gather supplier documents may later be connected to finance records and asked to update a business system. That change introduces new data, permissions, and decision owners, even if the agent keeps the same name.

AI agent governance is how an organization decides whether that expanded role is acceptable, what controls it requires, and who remains accountable for the result. Those decisions become harder to maintain as more teams introduce agents and reuse existing ones.

The IDC research sponsored by Leah points to this challenge. Organizations with agents in production across multiple areas reported greater demand for better governance tools than those still piloting them. Each extension needs a way to check whether the original approval still covers the work.

TL;DR

• In the IDC study, 79% of surveyed organizations reported that tools for discovering unsanctioned AI agents were absent or not working well.
• Centralized governance tools were a top-needed improvement for 42% of respondents piloting agents and 51% using them in production across multiple areas. The comparison describes different respondent groups.
• Governance needs a current agent inventory, named owners, enforceable permissions, clear approval rules, and evidence of what happened.
• Review an agent when its purpose, access, or operating conditions change. Test how to restrict or stop its work before extending its authority.

What the IDC findings say about governance at scale

The September 2026 IDC InfoBrief, The Three Pillars of the Agentic Enterprise, is based on a survey of 410 enterprise decision-makers actively deploying or evaluating AI agents. Its figures identify the source as Leah's Agentic AI Adoption Study, April 2026.

Three findings on pages 4 and 5 are useful for planning:

• 42% of respondents piloting AI agents cited centralized governance tools as a top-needed improvement, compared with 51% of those with agents in production across multiple areas.
• 79% of surveyed organizations said tools to discover unsanctioned AI agents were absent or not working well.
• 36% cited governance, guardrails, and risk management capabilities among their most important supplier-selection criteria.

The 42% and 51% figures compare deployment groups within the study. They do not track the same companies moving from pilot to production or prove that deployment caused the difference.

The discovery finding also has a specific meaning: it describes reported shortcomings in discovery tools. It does not mean that 79% of agents are unauthorized.

Taken together, the findings support a practical question for a growing agent portfolio: can the organization identify the agents doing its work and keep their authority aligned with their approved purpose?

What is AI agent governance?

AI agent governance is the combination of policies, accountable owners, technical controls, and review processes that governs how agents are introduced, used, changed, and retired. It defines what an agent may do, which information it may use, when a person must decide, and how the organization checks the outcome.

The distinction from AI agent orchestration is useful. Orchestration coordinates execution across agents and systems. Governance establishes the authority and accountability under which that execution takes place.

NIST's AI Risk Management Framework 1.0 provides a useful foundation. Its Govern function addresses inventories, responsibilities, ongoing review, and safe retirement of AI systems. An agent program can apply those principles to the specific tools, permissions, and business processes involved.

Start with an inventory that reflects actual use

A central register helps teams record an agent's purpose, owner, environment, connected systems, and approved access. Keeping that register current requires a way to find work that was introduced elsewhere.

Reconcile approved-agent records with the evidence available from enterprise identity systems, application integrations, vendor platforms, and business teams. Include agents embedded in purchased software and agents assembled by employees. Give teams a straightforward route to register a new use and obtain a decision.

When an unfamiliar agent or connection appears, establish what it can access and whether its work is authorized. Assign an owner to resolve the uncertainty and apply restrictions appropriate to the exposure.

Be precise about discovery coverage. A platform may provide strong visibility into agents running inside it while other activity remains outside its view. Record which systems are covered, which are not, and when the inventory was last reconciled. A complete list of registered agents is not proof that every agent has been found.

Assign ownership across the whole process

Consider the illustrative supplier-document agent from the opening. Procurement approved its original purpose. Finance now wants it to read invoice records and update a supplier status. The extension needs an accountable owner for the new outcome, agreement on the additional data access, and an operational team able to maintain the connection.

Make those responsibilities explicit before enabling the expanded role:

One person may hold several responsibilities in a small deployment. What matters is that people understand the decisions they own and that the record stays accurate when a team changes.

For work spanning functions, name an accountable owner for the overall process as well. Each department can approve its own component while a gap remains in responsibility for the combined result.

Turn policy into enforceable action limits

An approved purpose should translate into specific access and action permissions. For the supplier-document agent, reading an invoice, suggesting a status, and changing a supplier record are separate capabilities. Decide which are needed and under what conditions they may be used.

Use identifiable agent access that can be reviewed and revoked. Limit it to the relevant systems, records, and operations. Define how long the authorization lasts and which changes require another review.

OWASP's agent security guidance recommends limiting an agent's autonomy, tools, and access to its task, with separately attributable and revocable identities. Its examples concern engineering agents; the same permission questions are useful when evaluating commercial workflows.

Check how the connected system enforces the boundary. In a test environment, ask the agent to attempt an operation outside its approved scope and inspect the result. A policy statement in the agent's instructions needs supporting controls at the point where access or action is granted.

Make human approval a usable control

Define which actions an agent may complete within an approved policy and which decisions require a person. The distinction should reflect the process and its possible consequences.

A reviewer needs the proposed action, the relevant source information, the reason for escalation, and the effect of approving it. Give that person a way to reject the request, seek clarification, or refer it to someone with the right authority.

In the supplier example, finance might permit the agent to assemble an evidence package while retaining approval of a status change. The system should check that the approval covers the action being requested and that the reviewer is authorized to make that decision.

Review the approval process itself. A growing queue can signal unclear policy, unnecessary escalation, or too little review capacity. Measure those causes before widening the agent's authority simply to reduce waiting time.

Keep evidence reviewers can use

For a sampled action, a reviewer should be able to establish which agent acted, what access it used, which policy applied, whether approval was required, and what changed in the destination system.

Tie the record to the relevant task and input version. Preserve the distinction between a recommendation, an approval, an attempted action, and a confirmed result. If the action's outcome is uncertain, keep that uncertainty visible until it is resolved.

The Agent Control Standard described by the OWASP GenAI Security Project emphasizes visibility and controls enforced while agents run. For a business evaluation, ask to see a permitted action and a blocked action, followed by the evidence available for each.

Apply access and retention rules to the evidence as well. Audit records may contain sensitive business information. Reviewers need enough detail to assess the action without making every source document available to everyone who can view a log.

Review changes and plan for retirement

An approval should remain tied to the conditions under which it was given. A new connector, different data category, wider user group, or expanded business purpose can change the exposure. Model, tool, and policy updates may also change how the agent behaves.

Set review requirements according to the effect of the change. Record the proposed scope, the approving owner, the tests performed, and the version authorized for use. A small maintenance change and a new ability to update financial records may need different levels of review.

Test how to restrict or stop the agent, including scheduled tasks and work already waiting to run. Confirm who can revoke access and who will handle unfinished cases. Revocation can prevent further actions; completed actions may require separate investigation or correction.

When an agent is retired, remove its access, disable its triggers, transfer outstanding responsibilities, and retain the required decision history. Update the inventory so the retired agent cannot be mistaken for an approved active service.

Measure whether governance is keeping up

Choose measures that expose gaps in the operating process:

• Ownership coverage: the share of known active agents with a confirmed owner and a current scope record. State which systems contribute to that inventory.
• Discovery response: how long it takes to assess unfamiliar agent activity, assign an owner, and decide whether it may continue.
• Control effectiveness: whether tests block out-of-scope actions and preserve required approvals, including after relevant updates.
• Operational review: approval wait times, repeated escalation causes, and the staff effort needed to investigate incidents or correct results.
• Restriction and retirement: whether access revocation and shutdown tests stop new work and route unfinished cases to an owner.

A rise in discovered agents or blocked actions needs interpretation. Better discovery can reveal activity that was previously invisible. More blocked requests can reflect effective controls or a poorly scoped deployment. Review a sample to establish whether the requests were unauthorized or whether legitimate work needs a different permission or approval route.

Use the review to make a decision: continue the approved scope, improve a control, extend authority, or restrict the deployment. Assign each follow-up to an owner.

Where Leah fits

Leah's AI governance approach describes configurable policies for agent actions, data access, thresholds, and escalation, together with records of decisions and outcomes. Within Leah Agentic OS, that governance is positioned around commercial work spanning legal, contracting, procurement, and finance.

Evaluate those capabilities against your own process. Ask to see who can change a policy, how an unauthorized action is stopped, and what evidence remains after the decision. Establish which agents and connected systems the controls cover. Leah's security architecture guide provides supporting context for the security team's review.

Read the full IDC study for the governance findings alongside orchestration and cross-functional collaboration. Then choose an agent whose role has expanded since approval and check whether its owner, permissions, and review record still describe the work it actually performs.

Frequently asked questions

What should AI agent governance cover?

It should cover the agent's approved purpose, ownership, data access, action permissions, required approvals, monitoring, change review, and retirement. The organization also needs evidence that the controls work in the systems where the agent operates.

How is AI agent governance different from orchestration?

Orchestration coordinates tasks, dependencies, and execution across agents and systems. Governance determines the authority, policies, and accountable people that constrain that work. A process needs its orchestration to respect the governance decisions that apply to it.

What are shadow AI agents?

Shadow AI agents are agents used for organizational work outside the organization's approval or oversight process. They may be embedded in software, connected through employee accounts, or assembled by business teams. Discovery should establish their purpose, access, and ownership before a decision on continued use.

Who should own AI agent governance?

Assign an accountable business owner for each approved use, supported by the relevant technical, data, security, and decision owners. A central governance team can set common rules and review requirements, while process owners remain responsible for the work performed in their functions.

Does every AI agent action need human approval?

No. Organizations can authorize defined actions within tested limits and reserve specified exceptions or decisions for people. The permissions, approval conditions, and escalation route should be explicit, enforced, and reviewed when the agent's scope changes.