Agent Governance Is the New "Do You Have MFA?"
The question your auditor, your insurer, and your board will ask within 12 months.
By John Martines · April 28, 2026 · 4 min
Agent governance is becoming basic hygiene — within 12 months every audit, insurance renewal, and enterprise vendor review will ask what agents you run, who approved them, and what data they touch. Here is how to get ahead of the regulatory wave that NIST is already drafting.
The question your auditor, your insurer, and your board will ask within 12 months.
---
Five years ago, "do you have MFA?" went from a security-nerd question to a baseline expectation. Insurers asked it. Auditors asked it. Boards asked it. Companies that had quietly turned it on years earlier had a tailwind. The ones who hadn't paid higher premiums and failed renewals.
The same shift is happening with AI agents — faster.
Within 12 months, every serious conversation about your business will include some version of:
> "What agents are running in your environment? Who approved them? What data do they touch?"
It will come from your cyber insurance underwriter at renewal. From your SOC 2 or HIPAA auditor. From the enterprise customer doing vendor due diligence before they sign. And, increasingly, from regulators.
If you can't answer it today, you have a problem. The companies that fix it in the next two quarters will be the ones quietly closing deals while their competitors are stuck in security questionnaires.
You've already lost some control of automation. Marketing built Zapier flows. Finance built Power Automate flows. Most are still running, owned by people who left, touching data nobody mapped.
Agents are that sprawl with an LLM bolted on — except now the automation can *reason*, *decide*, and *take novel actions* the original builder never anticipated. A misconfigured Zap sends the wrong row to the wrong sheet. A misconfigured agent negotiates a refund, files a ticket against the wrong vendor, or emails a contract draft to a competitor because the prompt said "be helpful."
This is exactly what Microsoft's Workspace Studio approval workflow is designed to solve: every agent a business user creates lands in a central registry where security, finance, and compliance review it before it goes live. That's not a feature — it's an admission that ungoverned agents are a category risk. Google and AWS Bedrock are converging on the same pattern: registry, approval workflow, auditable trail.
A free account opens the rest of this article and the whole library.