How to Manage AI Agents in the Enterprise (Before They Manage You)

You manage AI agents in the enterprise the same way you manage any workforce with system access: give every agent a registry entry, a unique identity, an owner, and a permission scope tied to that identity, then monitor its behavior continuously. Skip any one of those and you don't have an AI strategy. You have an audit finding waiting to happen.

The shadow workforce nobody hired

Five years ago, shadow IT meant a marketing manager expensing a project management tool IT never approved. The fix was annoying but bounded: find the subscription, decide whether to sanction or kill it.

Agents don't work that way. A finance analyst chains a spreadsheet-reading agent to a Slack-posting agent to a CRM-updating agent, and now there's a multi-step workflow running unattended, making decisions, and touching customer data, built with a no-code tool nobody in IT has heard of. More than 80% of Fortune 500 companies now have active agents built this way, and building them is no longer a technical-role activity. Sales, finance, security, and product teams are doing it themselves.¹

This is the natural next step after shadow AI tools employees use to build their own apps. An app sits still until someone opens it. An agent acts on its own.

How big is the agent swarm, really?

The numbers are not subtle.

• Gartner projects the average Fortune 500 enterprise will run more than 150,000 agents by 2028, up from fewer than 15 in 2025.²
• Only 13% of organizations believe they have the right agent governance in place today.²
• 29% of employees have already turned to unsanctioned agents for work tasks.¹
• Just 6% of enterprises have what qualifies as an advanced AI security strategy, leaving 94% running agents on basic or nonexistent controls.¹³
• An estimated 3 million-plus agents are deployed across enterprises today, and only 47.1% are actively monitored or secured, leaving roughly 1.5 million running with no oversight at all.³⁴

That last stat is the one to sit with. It's not a future risk. It's a current inventory gap.

Why agents are a different governance problem than shadow SaaS

A rogue spreadsheet tool is a liability. A rogue agent is a liability that acts, decides, and reproduces.

Agents pull data from systems, take actions based on that data, and in a growing number of cases spawn their own sub-agents to finish the job. Roughly a quarter of deployed agents can create and task other agents, which means the chain of command behind a given action is often unauditable by the time anyone goes looking.³

The identity layer underneath all of this is thin. Only 21.9% of organizations treat agents as independent, identity-bearing entities the way they'd treat an employee login.³ Instead, 45.6% of teams still authenticate agent-to-agent activity with shared API keys, the equivalent of every employee in a department logging in with one shared password.³ Non-human identities, service accounts, tokens, and agent credentials, already outnumber human users by 45 to 1 across the average enterprise, climbing to 144 to 1 in cloud-native environments, and agentic AI is widening that gap, not closing it.⁵

Without a durable identity per agent, you can't answer basic questions: who owns this workflow, what data can it touch, and who's accountable when it's wrong.

What happens when nobody's watching

The cost of skipping this isn't abstract. 88% of organizations with agent deployments have already had a confirmed or suspected security incident in the past year, rising to 92.7% in healthcare.³ Meanwhile 82% of executives believe their existing policies already protect them from unauthorized agent actions, a confidence gap that's about to get expensive.³

IBM's 2025 Cost of a Data Breach Report put a number on it: shadow AI-related breaches average $4.63 million, $670,000 more than a standard breach, and 65% of them involve compromised customer PII.⁶ Lenovo's April 2026 research found 70% of enterprise AI now runs outside IT oversight, which means that cost profile isn't the exception. It's closer to the norm.⁶

Regulation is catching up too. Under the EU AI Act, enforcement starting August 2026, an incomplete AI system inventory is itself a violation. You're liable for classifying and governing an agent from the moment an employee starts using it, not from the moment IT happens to find it.⁶ This is the same enforcement logic covered in the security threat of agentic code: the risk isn't hypothetical, it's already live in production.

A practical governance model: registry, identity, and lifecycle

Gartner's six-step framework for agent sprawl gives IT a concrete starting point rather than a vague mandate to "be careful."²

1. Establish agent governance and policy. Define who is allowed to build agents, with what tools, and under what approval process before agents multiply past the point of control.
2. Build a centralized agent inventory. If you can't list every agent running in your environment, you can't govern any of them.
3. Define identity, permissions, and lifecycle for each agent. Every agent gets a unique identity, a scoped permission set, an owner, and a retirement date, not indefinite runtime.
4. Develop AI information governance. Decide what data agents can read, write, and share before they're deployed, not after an incident.
5. Monitor and remediate agent behavior. Treat monitoring as ongoing, not a one-time approval gate.
6. Foster a culture of responsible AI usage. Policy without buy-in gets routed around.

Microsoft's framing overlaps and adds detail on the technical build: a centralized registry, identity-based access control, real-time visualization and telemetry, interoperability across the ecosystem of tools agents run on, and built-in security protections.¹ Governance and security show up as related but separate functions in that model.¹ Governance answers who's allowed to build what. Security answers what happens when something goes wrong. Enterprises that conflate the two usually end up with neither.

Treat agents like employees, not scripts

The throughline across every credible framework here is identity. An agent should have the same basic accountability structure as a new hire:

• A unique, non-shared credential. Not a shared API key that a dozen workflows use interchangeably.³
• Least-privilege access. Scoped to exactly what the task requires, nothing broader.
• A named human owner. Someone accountable for what the agent does, the same way a manager is accountable for a direct report.
• Continuous monitoring, not a one-time sign-off. Agent behavior drifts. Approval at launch doesn't cover what the agent does six months later.
• A defined lifecycle. Agents that outlive their purpose get retired, not left running indefinitely on old permissions.

This is the practical answer to the non-human identity gap. You don't need a philosophical debate about whether an agent "deserves" identity. You need an audit trail that survives a breach investigation, and that only exists if every agent has one.

Why banning agents backfires

The instinct to lock this down with a blanket ban is understandable and wrong. Gartner's Max Goss put it plainly: "If employees are unable to work in the sanctioned tools, they will likely go around the organization's controls and start using shadow AI which presents far greater risks."² Ban the sanctioned path and the unsanctioned one gets busier, not emptier.

The durable fix is building a sanctioned platform good enough that employees choose it voluntarily, one with a registry, identity model, and permission scope built in from day one rather than bolted on after the first incident. That's the same logic behind owning your infrastructure instead of renting it piecemeal, whether that's replacing SaaS with self-hosted tools or standing up an AI-native development workflow you actually own. Platforms like Remy are built on that same premise for agent orchestration specifically: give builders a governed environment with identity and permissions baked in, and they stop needing to freelance one together with disconnected no-code tools.

The swarm is coming whether IT signs off or not. The only real choice left is whether it arrives with a name tag on every agent, or without one.