Ask any organization running AI in production a simple question: “Who approved this, and what did it actually do?” For a single prompt to a chatbot, most can eventually answer that, even if the answer is embarrassing. For an AI agent making autonomous decisions across a workflow, most can’t answer it at all, and the number of agents asking that question of them is about to explode.
Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, up from under 5% in 2025. By 2028, the average large enterprise is projected to run more than 150,000 AI agents. That’s not a governance challenge scaling up gradually. That’s a governance challenge that didn’t exist eighteen months ago, and will be the default mode of enterprise software in three years.
Why agents break the question, not just scale it
I’ve argued for a while that prompt governance is the control layer every organization needs the mechanism that lets you answer “who approved of this, and what did it actually do” for anything AI touches. With single-prompt AI use, that question is hard but answerable. Someone typed a prompt. Something came back. You can, in principle, trace the exchange.
Agents don’t work that way. An agent doesn’t produce one output for one input; it takes a goal, makes a series of decisions, calls tools, takes actions, and often hands off to other agents, all without a human in the loop at each step. “Who approved this” stops meaning “who approved this specific output” and starts meaning “who approved the entire chain of decisions the agent made to get here,” a much harder thing to answer, and a much easier thing to have no answer for at all.
That’s the actual risk in the 150,000 number. It’s not that agents will make mistakes every system does. It’s that most organizations currently have no mechanism to reconstruct what an agent did, why it did it, or who signed off on giving it the authority to do it in the first place. Every agent operating without that mechanism is an unlogged action risk: a decision was made, on record inside your business, with no record of it anywhere you can audit.
The control layer must move with the risk
This is exactly why prompt governance can’t stay a policy about prompts. The same principle is that every AI action needs an owner, a log, and a reviewable trail that has to extend to every tool call, every handoff, and every autonomous decision an agent makes. The mechanism doesn’t change. What changes is that it must now operate at the speed and volume of 150,000 agents instead of a person typing into a chat window.
Organizations that already treat AI oversight as infrastructure logged, owned, and auditable by design will absorb the agent shift the way they’ve absorbed every other scaling event. Organizations that treat it as a policy document will find the document says nothing about an agent that took forty autonomous actions before anyone noticed.
The question was always “who approved of this, and what did it actually do?” Agents didn’t create that question. They just made it impossible to answer.