The governance gap

Governance is the most cited and the most underfunded barrier to scaling agentic AI. The numbers speak: incidents are near-universal, approval is rare, kill switches are a minority feature, and the agent surface is about to grow 8x.

The anatomy of the gap: why the existing infrastructure cannot hold agents, where the genuinely hopeful signal comes from, and why the trajectory still points the wrong way.

The numbers

In literature and elsewhere, governance is the most cited and the most underfunded barrier to scaling agentic AI. 88% of organizations report confirmed or suspected AI agent security incidents, yet only 14.4% obtain full security and IT approval before deploying agents. Organizations are deploying first and governing later, or not governing at all.

The numbers paint a stark picture. Only about 1 in 3 organizations are governance-ready for the autonomous agents they are already deploying. Meanwhile, 63% of organizations cannot enforce purpose limitations on what their agents are authorized to do, and kill switch capability, the ability to rapidly shut down a misbehaving agent, sits at just 40%. 35% of employees admit they could not immediately pull the plug on a rogue agent.

Why it exists

The gap exists because the governance infrastructure that exists was built for traditional software and traditional AI. Deterministic systems where inputs and outputs are known. None of those assumptions hold for agents. On top of that, organizations face the problem of visibility, since they do not know which agents exist, which data they have access to or what permissions they hold. The accountability gap compounds the problem. Organizations lack clear, named accountability for responsible AI. Governance without an owner is not governance. It is documentation.

The signal, and the scale

The positive signal is that first-line governance is growing, and engineering teams themselves are demanding more and more guardrails before deploying agents to production. The push seems to be coming from practitioners and not just compliance. When the people building agents are asking for governance, the maturity shift has begun. However, the scale of the challenge ahead is significant, since task-specific agents are expected in 40% of enterprise apps by the end of 2026, up from under 5% in 2025. This 8x increase in agent surface area against incrementally growing governance infrastructure demonstrates that the gap is not closing. It is widening.