Key takeaways
- The agents acting in your business today were mostly approved by silence: nobody decided they should not exist, and nobody owns what they do.
- Ungoverned agents cost in four currencies: rework hours, spend outside budget gates, audit exposure, and stalled programs. The first three show up in systems you already have; the fourth is usually the largest and the least measured.
- None of this is a model problem. The same team that ships agents can run the cost inventory in this post in a day — the hard part is deciding to look.
- The fix is four controls enforced outside the agents: identity, policy at the gateway, approval gates, and one record per action.
The one-sentence summary
If you cannot name, within an hour, what each of your production agents did last week and who approved it, you are not running an AI program — you are running an ungoverned one, and the costs below are where that shows up.
Most agents were approved by silence
Here is the pattern we see in nearly every enterprise discovery session: nobody in the room decided to put the agents that are running into production. They arrived the way shadow IT arrived fifteen years ago — a team had a problem, a proof of concept worked, and the thing quietly became load-bearing. The decision that authorised them was never made; the absence of a decision was the decision.
What makes this different from shadow IT is that agents act. A shadow spreadsheet stores data wrongly; a shadow agent pays invoices, exports data, writes to systems of record, and emails counterparties. The failure surface is actions, and the accountability question an examiner, an auditor, or a customer will eventually ask — who approved this and what evidence exists — has no answer for an agent nobody owns.
The four costs of running without controls
1. Rework from wrong and unauthorised actions
The most visible cost. An agent takes an action it should not have — pays the wrong invoice, sends the wrong version, enrolls the wrong account — and someone spends hours finding, correcting, and explaining it. Most of this never reaches an incident log; it lands as “manual correction” in support tickets and team backlogs. It is worth an hour to total the last quarter of it, because that number is the budget argument for governance that requires no catastrophe to justify.
2. Spend outside the budget gate
Model and cloud invoices for agent workloads routinely exceed what was approved for the pilot, because usage scales with autonomy and nobody wired agent spend into a gate. Two consequences: finance finds spend it did not approve, and untracked spend signals agents nobody owns. This is also the cost finance looks for first — it is the easiest of the four to surface, and the fastest way to make governance a finance conversation rather than an engineering one.
3. Audit and examination exposure
Regulators in banking, insurance, and the EU now examine AI agents directly: what they are, who approved them, what evidence exists that the controls ran. An organisation without attributable records does not just risk findings — it pays for every examination in staff months of reconstruction, and it answers exam questions from memory rather than from records. SR 26-2 in US banking, DORA in the EU, and the NAIC model in insurance all converge on the same expectation: agents must be identifiable, their actions attributable, and their controls evidenced. What examiners ask is no longer hypothetical.
4. Stalled programs — the unmeasured one
The largest cost is the one that never gets a line item. Pilots that work technically and die at the governance review — because the review asks who approved the agent’s actions and what record exists, and the answer is nothing. Gartner projects more than 40% of agentic AI projects canceled by 2027, and the cancellations cluster exactly here: no accountable owner, no measurable outcome, no governance path to production. Every program in that category represents months of build effort amortised to zero, plus the business value the workflow would have delivered. Price one delayed program at its monthly value and you usually have the largest number in the whole governance case.
The one-day inventory
You can quantify your own exposure in a day with three queries:
- Identity: list the non-human identities in your IAM that belong to agents. Check how many use shared or long-lived credentials. Every shared credential is an unattributable action waiting to happen.
- Spend: pull the last quarter’s model and cloud invoices and match them to approved budgets. The difference is ungoverned spend, and it names the workloads nobody owns.
- Ownership: ask each workflow owner to name the agent that touches their system of record, who approved it, and what record exists of its actions. The gap between what owners can answer and what invoices and logs show is your ungoverned surface.
The business case one-pager turns those three queries into the four numbers a CFO needs, and the readiness checklist scores the controls themselves, 36 checks in one review meeting.
What actually fixes it
Not more policy documents. Four controls, enforced outside the agents:
- Identity per agent — its own credential, scoped, short-lived, recorded on every call. Attribution ends here; without it nothing else is provable.
- Policy at the gateway — the same action judged by the same rules regardless of which agent asks. Versioned, so history stays answerable.
- Approval gates on irreversible actions — a named human approves before execution, and the record shows what they saw.
- One record per action — prompt, decision, approval, tool call, outcome: one correlated, tamper-evident trail. One query returns the whole chain.
This is the layer an AI control plane provides, and how Moring implements it is on one page. If you want the argument structured for your board before you bring it to one, start with the business case.
The four controls above are the single-agent version. When agents start delegating to each other, the same controls have to hold across the chain — multi-agent governance covers what changes at fleet scale. And the controls themselves are the convergence point of every major framework: the seven-framework comparison maps NIST, ISO 42001, EU AI Act, SR 26-2, DORA, CPS 230, and NAIC onto these same four.
Frequently asked questions
What are the risks of ungoverned AI agents?
Ungoverned AI agents carry four cost categories: rework from wrong or unauthorised actions, spend that sits outside budget gates, audit and examination exposure because no attributable evidence trail exists, and stalled programs — pilots that never survive the governance review because nobody can answer who approved what. The first three are visible today; the fourth is the largest and usually unmeasured.
How do AI agents take unauthorized actions?
Usually not through a hack — through scope and drift. An agent is granted broad credentials for one workflow, keeps them after the workflow changes, and acts outside its original intent. Because actions are not attributed to a named agent with scoped permissions, the unauthorised action is indistinguishable from a normal one until someone investigates. Shared service accounts and prompt-only rules are the two most common causes.
How do you control AI agents in production?
Four controls, enforced outside the agents: workload identity per agent so every action is attributable; policy enforcement at the gateway so the same action is judged the same way every time; human approval gates on irreversible actions; and one correlated, tamper-evident record per action. None of these live inside the agent's prompt — rules in prompts are suggestions, not controls.
What is the cost of an AI agent incident?
Three layers: the immediate correction (investigation hours, remediation, possible customer impact), the audit consequence (findings that stay open for quarters and raise the intensity of the next examination), and the program cost (agent launches paused until the findings close — often the largest number, priced at the monthly value of the delayed program). Governance spend is small against any one of the three.
How do I find ungoverned AI agents in my organization?
Three queries, one day: list identities in your IAM that belong to agents and check which have shared or human credentials; pull cloud and model invoices and match spend to approved budgets; and ask each workflow owner to name the agent that touches their system of record and who approved its actions. The gap between what owners can name and what invoices show is your ungoverned surface.
Governing Autonomous AI Agents in Production
Moring provides the runtime control layer, identity verification, human-in-the-loop approvals, and audit records needed to deploy production-grade AI agents safely.
About the author
Balaji Nagaraj KumarChief AI Officer, Moring AI, Moring AISweden
Leads platform and delivery engineering at Moring AI, turning each engagement into a substrate the customer’s own team operates at handoff. His background spans developer-platform leadership at Volvo Cars and engineering at CERN. He writes about governance for agents that take actions in production systems.
LinkedIn profile
