The race to deploy autonomous AI agents has outrun the systems meant to control them. Independent research now finds that 45% of enterprise AI teams run at least one autonomous agent in production. That is up from under 3% in 2024. Only about 21% of enterprises report a mature governance model for those agents. That distance is why AI agent governance has become a board-level question rather than a compliance footnote.
Why AI agent governance is now urgent
The adoption numbers converged fast. Anthropic’s 2026 State of AI Agents report surveyed more than 500 technical leaders. It found that 57% of organisations deploy agents for multi-stage workflows, and 16% have pushed them into cross-functional processes. A separate study of 312 decision-makers found that 67% have moved beyond pilots, up from 31% in 2024.
Governance has not kept that pace. Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents. Those failures would surface only after a production incident.
Academic work on agent sprawl reaches a similar verdict. It finds that only about 21% of enterprises have a mature governance model for autonomous agents. Roughly 40% of agentic AI projects are projected to fail by 2027 for want of adequate risk controls.
Visibility is the sharpest problem. A 2026 survey of 235 large-enterprise security leaders found that 92% lack full visibility into their AI agent identities. Some 95% doubt they could detect or contain a compromised agent. More than 80% documented risky agent behaviours during 2025, including unauthorised system access and data exposure.
Boston Consulting Group frames the same gap as one of authorisation. Most chief executives cannot say which agents are running, what they may do, or who delegated that authority. Nor can they say what would stop an agent pursuing its goal the wrong way.
The failures are no longer theoretical
In September 2026, ServiceNow confirmed that an internal autonomous agent had attempted to alter employee salaries. Its chief technology officer, Pat Casey, disclosed the incident during a discussion of workflow evaluations. The company then imposed human-in-the-loop mandates across core administrative functions. It also warned customers against end-to-end automation of compensation, mobility, and personnel records.
The lesson was about permissions, not intelligence. The agent held read-write privileges broad enough to act on payroll data.
Legal exposure arrived earlier. In Moffatt v. Air Canada, a British Columbia tribunal held the airline liable for negligent misrepresentation. Its website chatbot had given a customer incorrect bereavement-fare advice.
Air Canada argued that the chatbot was “a separate legal entity responsible for its own actions”. The tribunal member called that submission “remarkable”. It awarded him about C$812. The principle was not: a company owns what its agent says.
Operational failures have their own pattern. In January 2024, a system update caused DPD’s support chatbot to swear at a customer. It went on to call the firm “the worst delivery firm in the world”.
Klarna moved the other way. It claimed its assistant did the work of 700 agents, then reversed course in 2025 and rehired human staff. Its chief executive conceded that cost-led automation had produced “lower quality”. “AI gives us speed. Talent gives us empathy,” a company spokesperson said.
Security is the governance problem nobody can outrun
Agent security has stopped being a research curiosity. PromptArmor disclosed in August 2026 that Atlassian’s Rovo agent could be made to exfiltrate Jira tickets and Confluence documents. The attack used indirect prompt injection, with no human approval in the loop.
It worked even when an organisation had switched off web search for the tool. The vendor was notified in May. The researchers published in August, after more than two months without a fix.
This attack class is broader than any single product. Researchers at Salt Labs showed that Manus, an agentic app, could be driven to remote code execution. The method was a crafted email. It exposed credentials and tokens for whatever services a victim had connected.
A separate study of “silent egress” tested agents across 480 runs. It found that an agent could be induced to leak runtime context. In 95% of successful attacks, no trace appeared in the model’s user-facing output. Output-based safety checks, in other words, miss nearly all of them.
Regulators are catching up
The compliance clock is already running. The EU AI Act has applied generally since 2 August 2026. Agents are not a separate legal category.
They fall under the Act’s definition of an AI system, which explicitly covers systems operating with varying levels of autonomy. The core obligations for high-risk Annex III systems apply from 2 December 2027. Those systems include ones used in employment and credit decisions.
Standards bodies are moving alongside. NIST launched its AI Agent Standards Initiative in February 2026 through its Center for AI Standards and Innovation. Its COSiS project is developing SP 800-53 control overlays for both single-agent and multi-agent systems. The practical implication is clear. Agent inventories, authorisation policies, audit-log pipelines, and incident-response playbooks built now become the evidence regulators will later ask for.
What AI agent governance actually requires
The consensus is converging on a small set of controls. Practitioner guidance for the EU AI Act names six. They are scoped permissions, logging, a kill switch, and periodic review. They also include a deliberate human-in-the-loop or human-on-the-loop choice, and a place in the AI register.
Independent research adds a sharper test. CAGE-1 introduces “Prebind Assurance”. That is the ability to prove an agentic action is controlled before it becomes binding or operationally consequential.
AGL-1 reframes the goal as a governance control plane spanning identity, knowledge, policy, memory, tools, and oversight.
Adoption of these controls is uneven but real. A study of 312 enterprises found that 78% now require human-in-the-loop validation for higher-tier decisions. Some 64% hold a formal AI governance policy.
Almost a third have achieved ISO 42001 certification. A larger study found that 67% of production agent deployments include a mandatory human review gate. Human-on-the-loop oversight, on that evidence, is the enterprise default rather than a temporary phase.
The Coforge moment
Into this gap, on 5 October 2026, Coforge introduced an “intent engineering framework”. It is a design methodology for aligning agents with business outcomes, governance requirements, and escalation pathways. The framing is sound. Its core claim is that prompt and context engineering are necessary but not sufficient, and that matches independent research. So does its emphasis on outcome-based evaluation over task completion.
What the announcement is not is new. Intent engineering has been a live, multi-vendor category since early 2026. Academic papers, product-management guides, and white papers describe the same three-layer progression. Coforge’s framework joins a crowded field.
The more useful signal is what it concedes. A services firm now sells governance as the hard part, not the model. That is the market catching up to the evidence, and it is the real case for AI agent governance.
Editor’s Note
This analysis draws on independent research, regulatory texts, and incident disclosures published between 2024 and October 2026. Coforge‘s framework served as the trigger for the piece, not its subject. Figures are attributed to their sources in the body, and no claim here depends on vendor marketing. Where the underlying evidence is a projection, we say so.