It’s 2027 planning season, and almost every CIO has a line for AI agents in next year’s budget. Fewer have a line for keeping track of them.
That gap is already showing up. Agents are arriving through every door at once: built by engineering teams, switched on inside SaaS tools the business already pays for, and spun up by individual employees with a browser and a credit card. Each one gets credentials. Each one calls systems. Many of them act without a human approving each step.
IT leaders have seen this before. The difference this time is that the things multiplying don’t just store data or expose it. They make decisions and take actions with it.
Round three of a familiar fight
The first round was SaaS. Departments bought tools faster than IT could review them, and many organizations only got visibility once renewals, security incidents or audit findings forced an inventory.
The second round was APIs. As teams broke applications into services and connected to partners, the number of interfaces grew past what anyone could list from memory. The organizations that got control did it the same way: a central point of entry, a catalog of what exists, clear ownership and policies enforced in one place rather than negotiated team by team.
Both rounds taught the same three lessons:
- You can’t govern what you can’t see. Inventory comes first, and it has to be continuous, not a one-time audit.
- Controls belong in the path, not in a policy document. Rules that live in a PDF get skipped. Rules enforced at the point of access get followed.
- Every asset needs an owner. Orphaned tools and abandoned endpoints are where risk collects.
Agents inherit all of this and add a harder problem. A SaaS app or an API does what it’s told. An agent decides what to do next. That means governance has to answer not only “what is this connected to” but “what is it allowed to do, and can we prove what it did.”
Five questions every agent should answer before production
A useful test: if an agent can’t answer these five questions, it isn’t ready to touch production systems.
- Who is it? Every agent needs its own identity, separate from the person or service account that launched it. Shared credentials make it impossible to tell which agent did what.
- What can it reach? Define the systems, data and environments an agent is allowed into, and enforce that boundary at the point of access. Least privilege applies to agents just as it does to people.
- What can it use? Agents act through tools: APIs, connectors and increasingly other agents. Each tool should be approved, rate-limited and revocable, the same way IT already manages API access.
- What is it for? An agent with a narrow, written purpose is far easier to govern than a general-purpose one. Its role should name an accountable human owner and define when it must stop and escalate.
- What did it do? Every action should leave a record that a security team, auditor or regulator could follow. If you can’t reconstruct a decision after the fact, you can’t defend it.
None of these questions are new. CIOs ask versions of them about employees, contractors and applications every day. What’s new is asking them about software that acts on its own, at a volume no review board can keep up with manually.
Putting it in the 2027 plan
The good news is that the work fits into the budget conversations already happening. Four moves worth making now:
- Fund the inventory before the rollout. Set aside budget to discover agents already running, including the ones embedded in vendor platforms. Most organizations will find more than they expect.
- Make the five questions a launch gate. Add them to the same review process that approves new applications and integrations. An agent that can’t answer them doesn’t go live.
- Route agent traffic through infrastructure you already govern. Agents call APIs. Extending existing gateways and access policies to cover agent traffic is faster and cheaper than building a parallel control layer.
- Name an owner for every agent. Tie each one to a business sponsor and a technical owner, and review the list as often as you review privileged access.
These steps also make the business case easier to defend. When the board or the audit committee asks how agents are being controlled, “we can show you” is a far stronger answer than “we have a policy.”
Get ahead of round three
SaaS and API sprawl were mostly governed after the fact, once the cost of not knowing became obvious. Agents offer a rare chance to do it in the right order. The CIOs who set the rules in their 2027 plans will spend next year scaling agents with confidence. The ones who don’t will spend it running an inventory.
Rory Blundell is CEO of Gravitee, which helps enterprises manage, secure and govern AI agents.
