AI agent adoption is accelerating across the enterprise.
Some agents are developed by central technology teams. Others are created by business users using low-code platforms, productivity suites and embedded AI features. Additional capabilities arrive through software vendors that add AI to products already operating inside the organisation.
This distributed innovation can create value, but it also introduces a new enterprise governance problem: AI agent sprawl.
Agents can multiply before the organisation has established clear ownership, approved data access, lifecycle controls or production-monitoring standards. Different teams may create agents for similar purposes, while security, architecture and data-governance functions struggle to determine what is running, which information it can access and who remains accountable for its outputs.
US enterprise data and technology leaders described AI implementation as operating in a “Wild West” environment in which agent development was progressing faster than governance. They raised concerns about uncontrolled proliferation, inadequate metadata, missing production reviews and the need for subject-matter experts and data owners to validate AI systems.
For data governance solution providers, this creates a significant commercial opportunity.
Enterprise IT buyers need more than another catalogue, policy repository or compliance dashboard. They need a practical governance layer that enables the organisation to discover AI agents, control their data access, understand their dependencies and manage them throughout their operational lifecycle.
The vendors that solve this challenge can position themselves at the centre of enterprise AI adoption.
What is AI agent sprawl?
AI agent sprawl occurs when an organisation accumulates a growing number of AI agents without adequate central visibility, ownership or control.
The problem is not simply that many agents exist. The risk emerges when the enterprise cannot reliably answer questions such as:
- Which agents are currently active?
- Who developed and owns each agent?
- Which agents have moved beyond experimentation?
- What systems and datasets can they access?
- Which business decisions or workflows can they influence?
- How are their outputs validated?
- Are multiple teams building the same capability?
- What happens when a model, dataset or policy changes?
- Who is responsible for monitoring and support?
- When should an agent be modified, suspended or retired?
Business users can now create prototypes and proofs of concept more easily than before. However, participants in the enterprise discussions noted that these agents often remain isolated in sandbox environments, lack formal sharing channels or duplicate work taking place elsewhere. They also emphasised that traditional engineering and architecture teams remain essential when agents need to move into production and scale across the enterprise.
This means agent sprawl is not only a security concern.
It affects cost, technical debt, data quality, user trust, operational resilience and the organisation’s ability to demonstrate value from AI investment.
Why enterprise IT buyers are concerned about uncontrolled AI agents
Unclear ownership creates operational risk
An agent may be easy to create but difficult to support.
When an employee leaves, a project ends or a vendor platform changes, the organisation may be left with an agent that still influences business activity without a clearly accountable owner.
Enterprise buyers need to know who is responsible for:
- The business use case
- The supporting data
- The technical architecture
- Output validation
- Security and compliance
- Performance monitoring
- User support
- Ongoing funding
Data governance solution providers can help by connecting agent records to named business owners, technical custodians, data owners and governance stakeholders.
Agents can access information beyond their intended purpose
The value of an AI agent often depends on its ability to connect to enterprise information.
The same access can create serious risk when permissions are inherited incorrectly, sensitive information is mixed with public data or the agent responds to users who should not see the underlying content.
Enterprise discussions highlighted the need for governance, legal and compliance teams to establish guardrails and access controls before AI use cases progress. Participants also described automated guardrail agents intended to detect and respond when user requests exceeded approved access levels.
For vendors, access control must therefore be more granular than a simple approved or blocked status.
Buyers need controls based on the user, role, dataset, jurisdiction, purpose and level of operational risk.
Different agents may use different definitions of the same metric
AI agents can produce inconsistent answers when the organisation lacks shared definitions.
Separate business units may calculate revenue, customer status, workforce capacity or market segments differently. If those definitions are not governed, agents can provide conflicting responses while each appears technically plausible.
Enterprise leaders described difficulties maintaining consistent definitions and metrics across different business units, especially when information was prepared for C-suite reporting. They also noted that data literacy and organisational adoption often mattered more than the sophistication of the governance technology itself.
This is why data governance is becoming inseparable from agentic AI governance.
An organisation cannot govern the agent effectively without governing the information and business meaning on which the agent relies.
Embedded AI can bypass conventional governance processes
Some AI capabilities are introduced through software updates rather than deliberate AI projects.
Business teams may activate embedded assistants, recommendations or automation features without recognising that a new AI risk has been introduced.
Enterprise participants described programmes to identify applications containing embedded AI and educate business units that lacked a clear understanding of the AI capabilities inside their existing software. They also discussed extending vendor-onboarding processes to include AI risk assessments.
Data governance vendors should therefore support discovery across both internally developed and third-party AI.
A complete AI inventory needs to show not only standalone agents but also AI embedded within enterprise applications, platforms and workflows.
Data governance is the foundation of safe agentic AI
Enterprise AI governance is sometimes treated as a separate discipline from data governance.
In practice, the two are tightly connected.
Every enterprise agent relies on data, metadata, business definitions, access permissions and contextual information. Weaknesses in any of those areas can affect the quality and reliability of the agent’s output.
Enterprise buyers are consequently returning to core data-governance requirements:
- Data ownership
- Data quality
- Data lineage
- Metadata
- Retention policies
- Classification
- Access control
- Approved usage
- Semantic definitions
- Regulatory handling
- Lifecycle management
Roundtable participants argued that data governance needs to be prioritised before AI deployment. They recommended starting with defined retention policies, lineage and ownership, then expanding governance as the organisation proves value through smaller initiatives.
For solution providers, the proposition is clear.
Do not position data governance as an administrative obligation that slows AI adoption. Position it as the infrastructure that allows AI adoption to move beyond isolated pilots.
What enterprise IT buyers expect from data governance solution providers
1. A complete inventory of AI agents and embedded capabilities
The first governance requirement is visibility.
Enterprise IT buyers need to identify agents created through:
- Internal engineering teams
- Low-code and no-code platforms
- Productivity applications
- Cloud AI services
- Business-unit experimentation
- Third-party enterprise software
- External development partners
- Embedded vendor features
The inventory should show each agent’s owner, purpose, deployment status, model, data sources, integrations, users and risk classification.
A static spreadsheet will become outdated quickly. Buyers increasingly need automated discovery and continuous inventory maintenance.
2. Clear ownership and accountability
Each agent should have an accountable business owner and a technical owner.
The business owner should be responsible for the use case and intended outcome. The technical owner should oversee architecture, integration, deployment and support.
Additional accountability may be required from:
- Data owners
- Security teams
- Legal and compliance
- Model-risk functions
- Enterprise architecture
- Privacy teams
- Subject-matter experts
A governance platform should make these relationships visible and trigger action when ownership is missing or outdated.
3. Risk classification based on what the agent can do
Not every agent needs the same level of governance.
An assistant that summarises approved internal content presents a different risk profile from an autonomous agent that can modify customer records, approve payments or influence regulatory reporting.
Vendors should help buyers classify agents based on factors such as:
| Risk factor | Governance consideration |
|---|---|
| Data sensitivity | Does the agent access personal, confidential or regulated information? |
| User reach | Is the agent used by one team or the entire enterprise? |
| Decision impact | Does it provide guidance or make operational decisions? |
| Autonomy | Can it initiate actions without human approval? |
| System access | Can it read from or write to enterprise systems? |
| External exposure | Can customers, partners or suppliers interact with it? |
| Regulatory relevance | Could its output affect legal, financial or compliance obligations? |
| Model behaviour | Is the output deterministic, probabilistic or generative? |
The resulting risk classification should determine approval, testing, monitoring and human-oversight requirements.
4. Data lineage that extends into AI workflows
Traditional data lineage shows how information moves through databases, pipelines and reporting systems.
Agentic AI requires broader lineage.
Buyers need to understand:
- Which source documents or datasets informed an output
- Which model processed the information
- Which prompt, workflow or tool was used
- Which business rules influenced the result
- Which systems received the agent’s action
- Whether the underlying data changed
- Whether the answer can be reproduced or explained
Enterprise leaders reported that full visibility and lineage remained difficult when data moved across multiple platforms. They also stressed the need for metadata documentation and production reviews before AI-generated code or workflows could be approved.
Data governance vendors that can extend lineage into AI workflows will solve a growing enterprise requirement.
5. A governed semantic and context layer
Agents need more than raw data.
They need the definitions, relationships and business context required to interpret that data correctly.
Enterprise participants discussed the importance of:
- Metadata glossaries
- Ontologies
- Taxonomies
- Knowledge bases
- Semantic models
- Data catalogues
- Context layers
- Validated definitions
They also described the difficulty of converting natural-language questions into meaningful enterprise queries when legacy systems lacked clear semantic structures.
This creates an important differentiation opportunity for vendors.
A data governance proposition becomes more valuable when it helps the buyer deliver governed context directly to AI agents rather than merely documenting data for human users.
6. Continuous monitoring for drift and control failures
Approval at deployment is not sufficient.
Agents may become less reliable when:
- Source data changes
- Columns are added or removed
- Business policies are updated
- Model versions change
- External information shifts
- User behaviour changes
- Prompt workflows are modified
Enterprise buyers discussed the need to change control environments so they could address model drift and validate agent accuracy over time. They also described using validating agents and report scanning to detect unreliable outputs.
Data governance solution providers should therefore integrate with AI observability and monitoring capabilities.
Relevant controls may include:
- Data-quality alerts
- Permission-change alerts
- Model-version tracking
- Output sampling
- Confidence thresholds
- Policy checks
- Drift detection
- Human review queues
- Incident escalation
- Automatic suspension of high-risk agents
7. Governance that does not overwhelm the organisation
Governance can fail when processes become too slow or complex.
Enterprise leaders repeatedly described the tension between governance requirements and the speed expected by business teams. They warned that sophisticated tools alone do not create successful governance and that excessive bureaucracy can drive users towards shadow IT.
The vendor proposition must therefore include usability.
Governance processes should be proportionate, automated where possible and integrated into the platforms that teams already use.
The goal is not to send every low-risk experiment through a lengthy approval process. It is to create a controlled route through which experimentation can become production-ready.
A practical framework for controlling AI agent sprawl
Data governance vendors can help enterprise buyers implement a seven-stage agent-governance lifecycle.
Stage 1: Discover
Identify internally developed agents, embedded AI capabilities, low-code applications and third-party AI services.
Discovery should include agents in experimentation, testing and production environments.
Stage 2: Register
Create a central record for each agent.
The record should include:
- Purpose
- Owner
- Users
- Model
- Data sources
- Integrations
- Deployment environment
- Risk level
- Approval status
- Expected value
Stage 3: Classify
Assess the agent according to its data access, autonomy, business impact, regulatory exposure and external reach.
Classification should determine the required controls.
Stage 4: Govern the data
Confirm that the agent uses approved datasets, definitions, permissions and retention rules.
Data owners should validate whether the intended use is appropriate.
Stage 5: Test and approve
Evaluate the agent for:
- Accuracy
- Security
- Bias
- Hallucination
- Integration risk
- Access control
- Performance
- Cost
- Regulatory compliance
The testing process should reflect the agent’s level of risk.
Stage 6: Monitor
Track usage, data changes, model changes, performance, incidents, drift and business outcomes.
Monitoring should continue for as long as the agent remains operational.
Stage 7: Review or retire
Agents should be reviewed periodically.
The organisation should retire agents that:
- Are no longer used
- Duplicate other capabilities
- Lack an accountable owner
- Depend on unsupported technology
- Fail performance requirements
- No longer meet security standards
- Do not produce sufficient business value
This lifecycle turns agent governance into an operational discipline rather than a one-time approval exercise.
Unstructured data is becoming a critical AI governance issue
Much of an enterprise’s valuable information is stored outside structured databases.
Contracts, presentations, emails, policies, reports, meeting notes, images and knowledge articles may sit across document libraries and collaboration platforms.
These repositories often contain:
- Duplicate files
- Outdated versions
- Missing ownership
- Inconsistent labels
- Sensitive information
- Weak access controls
- Poor retention management
- Limited metadata
AI increases the importance of these longstanding problems because agents can search and summarise information at scale.
Enterprise leaders described cases in which AI tools referenced outdated content from document repositories. They also highlighted the need for better classification, document lifecycle management and access control before unstructured information could safely support AI systems.
Data governance vendors should treat unstructured information as a first-class part of AI readiness.
Relevant capabilities include:
- Automated discovery
- Sensitive-data classification
- Duplicate detection
- Version analysis
- Ownership assignment
- Retention enforcement
- Permission reviews
- Metadata enrichment
- Human validation
- Centralised libraries
- AI-access policies
Participants agreed that scattered storage made effective access management difficult and that consolidating information into governed libraries was often a prerequisite for stronger AI control.
Centralised governance does not require centralised delivery
Enterprise organisations are unlikely to stop business teams from experimenting with AI.
Nor should they.
The challenge is to allow decentralised innovation while maintaining central standards for data, risk and architecture.
This can be achieved through a federated model.
Central teams can define:
- Governance policies
- Approved platforms
- Data-access standards
- Risk classifications
- Monitoring requirements
- Enterprise architecture
- Regulatory controls
Business domains can manage:
- Use-case development
- Domain definitions
- Subject-matter validation
- Local adoption
- Outcome measurement
- Operational ownership
Enterprise participants described the need to balance autonomy and conformance, allowing business teams to access rapid insights while central IT teams handled consolidation, security and complex data engineering.
This is another area where data governance vendors can create value.
A strong platform should support federated ownership without sacrificing enterprise visibility.
How solution providers can avoid making governance feel like bureaucracy
Automate evidence collection
Do not require users to manually document information that can be captured through integrations.
Agent models, data connections, permissions and deployment environments should be discovered automatically where possible.
Use risk-based workflows
Low-risk experimentation should move through a lighter process than high-impact production use cases.
This allows governance capacity to focus on the agents that present the greatest business exposure.
Embed controls into development workflows
Governance should connect to the tools used by developers, data teams and business users.
Controls applied inside existing workflows are more likely to be followed than separate processes requiring duplicate work.
Give business users clear guidance
Policies should be translated into practical instructions.
Users need to understand:
- Which platforms are approved
- What data may be used
- When formal review is required
- Who can answer governance questions
- How an experiment becomes a supported production service
Make governance value visible
Governance teams should be able to demonstrate:
- Faster approvals
- Fewer duplicate agents
- Reduced security exposure
- Better data quality
- Improved reuse
- Lower support costs
- Greater production adoption
- More reliable AI outputs
This helps buyers position governance as an enabler of scale rather than an unavoidable cost.
Common mistakes data governance vendors should avoid
| Vendor mistake | Why it weakens the proposition | Better approach |
|---|---|---|
| Selling a data catalogue as a complete AI-governance solution | A catalogue may not cover agent behaviour, models or workflows | Extend governance across agents, models, data and actions |
| Treating all AI use cases equally | It creates unnecessary process and buyer resistance | Apply proportionate controls based on risk |
| Focusing only on structured data | AI agents frequently rely on documents and collaboration platforms | Include unstructured-data discovery and governance |
| Relying on manual registration | Agent inventories become incomplete and outdated | Use automated discovery and integrations |
| Ignoring embedded vendor AI | Significant AI functionality may enter through existing applications | Include third-party AI in the inventory and risk model |
| Governing deployment but not operation | Agents can drift or become unsafe after launch | Provide ongoing monitoring and lifecycle controls |
| Positioning governance as compliance only | Buyers struggle to connect it to commercial value | Link governance to adoption, speed, trust and scale |
| Selling technology without an operating model | The buyer still lacks clear ownership and processes | Provide implementation, accountability and workflow guidance |
How data governance vendors can improve their enterprise sales positioning
Lead with the agent-sprawl problem
Many buyers already understand the need for data governance.
The more immediate commercial conversation may be the uncontrolled growth of AI agents across the organisation.
Position the solution around questions that buyers are actively trying to answer:
- How many agents do we have?
- Which data can they access?
- Who owns them?
- Which ones are production-ready?
- Are teams duplicating effort?
- Can we trust their outputs?
- What happens when the data changes?
- How do we scale without blocking innovation?
Show how the platform reduces buyer workload
Enterprise technology buyers must coordinate security, architecture, privacy, legal, data and business stakeholders.
A vendor creates value when its solution reduces the effort required to gather evidence, assign ownership and enforce controls.
Demonstrate integration with the enterprise stack
Buyers need governance that works across their existing environment.
The vendor should show how it connects to:
- Cloud data platforms
- Data catalogues
- Collaboration tools
- Low-code platforms
- Model providers
- Identity systems
- Security platforms
- Development pipelines
- Enterprise applications
- AI observability tools
Connect governance to faster production adoption
The strongest commercial argument is not that governance prevents every possible risk.
It is that governance gives the organisation a controlled path from experimentation to production.
A buyer is more likely to invest when the platform helps useful AI projects move forward rather than simply creating more approvals.
Prove value through a focused starting point
Enterprise participants recommended starting with smaller governance initiatives and using the resulting value to secure broader leadership support.
A vendor could begin with:
- One business domain
- One AI platform
- One high-priority dataset
- One group of production agents
- One unstructured-data repository
- One regulated workflow
The initial engagement should create measurable evidence that broader governance will improve speed, control or adoption.
Frequently asked questions
What is AI agent sprawl?
AI agent sprawl is the uncontrolled growth of AI agents across an organisation without adequate visibility, ownership, governance or lifecycle management.
Why does AI agent sprawl concern enterprise IT buyers?
It can create duplicated development, uncontrolled data access, unclear accountability, inconsistent outputs, security exposure, technical debt and rising support costs.
How can data governance solution providers control AI agents?
They can provide agent discovery, inventory management, risk classification, ownership, data lineage, access controls, semantic governance, monitoring and retirement workflows.
What role does data lineage play in agentic AI governance?
Data lineage helps the organisation understand which data informed an agent, how it was processed and which systems or decisions were affected by the output.
Why is unstructured data important for AI governance?
Agents frequently rely on documents, policies, emails and knowledge repositories. Poor classification, outdated content and weak permissions can cause inaccurate or unauthorised outputs.
Should enterprise AI governance be centralised?
Core policies and standards should be centrally visible, but business domains can retain ownership of use cases, definitions and outcomes through a federated governance model.
How can vendors prevent AI governance from slowing innovation?
They can automate evidence collection, use risk-based workflows, integrate governance into development tools and apply lighter controls to lower-risk experimentation.
Help enterprise IT buyers scale AI without losing control
Enterprise IT buyers are actively looking for ways to enable agentic AI while protecting sensitive data, maintaining accountability and preventing uncontrolled agent proliferation.
Data governance vendors that can provide discovery, ownership, lineage, access control, trusted context and continuous monitoring are well positioned to become strategic partners in that journey.
The Leadership Board connects technology solution providers with senior enterprise IT decision-makers around active priorities, developing projects and emerging investment criteria.
Engaging buyers before requirements are fixed gives vendors the opportunity to understand the organisation’s governance challenges, shape a more relevant proposition and demonstrate how their capabilities support safe AI adoption at scale.