Enterprises are embracing agentic AI at speed, embedding autonomous AI agents into business processes and experimenting with agents in front-office activities such as marketing and customer service, as well as in operational areas such as shipment tracking, demand forecasting, and supply chain optimization.
Agentic AI builds on the economic potential of generative AI, which McKinsey has estimated could add US$2.6 to $4.4 trillion annually to the world economy. This represents the next stage of enterprise AI adoption: a shift from content generation to autonomous execution, and from isolated pilots to operational deployments.
Agent sprawl
That shift creates a new governance challenge. Agent sprawl occurs when AI agents are created, deployed, or connected across systems faster than the enterprise can inventory them, assign ownership, control permissions, monitor behavior, and optimize or retire them when they are no longer fit for purpose.
Underscoring this shift, a recently published agentic AI survey conducted by SAP LeanIX found that 98% of companies have already deployed AI agents or plan to do so. But as adoption accelerates, governance is struggling to keep pace. According to the same report, less than half of the organizations surveyed have visibility into an inventory of AI agents.
SAP LeanIX Agentic AI Survey 2026 reveals high adoption of AI agents but gaps in effective management
The mechanics of agent sprawl are familiar to any technology leader who has navigated a wave of SaaS adoption. Individual teams, motivated by genuine productivity goals, deploy agents independently. Each one is designed for a specific task—a marketing automation agent, a supply chain monitoring agent, an HR onboarding bot—and each works in isolation. Without a centralized platform or governance framework, the organization accumulates a fragmented landscape of agents that do not interoperate, cannot be audited consistently, and accumulate technical debt faster than they generate value.
Gartner estimates that by 2028, the average global Fortune 500 enterprise will have more than 150,000 AI agents in use, yet only 13% of organizations believe they have the right governance in place to manage those agents. Max Goss, senior director analyst at Gartner, told his audience at a London conference in April: “As CIOs and IT leaders see an explosion of AI agents across their organizations, many are contending with an ungoverned sprawl of agents that expose their organizations to a range of risks, including misinformation, oversharing, and data loss.”
He added: “Many organizations resort to blocking or restricting the use of AI agents, but this is not a long-term solution. If employees are unable to work in the sanctioned tools, they will likely go around the organization’s controls and start using shadow AI, which presents far greater risks. Organizations need to find a balance where they can govern agents and manage sprawl, but also safely empower employees to innovate with these tools.”
Agents typically need broad, cross-environment permissions to function, but those permissions are rarely governed with the same rigor applied to human users. The risk posed by unmanaged or rogue AI agents in the enterprise is therefore real and growing.
AI agent security concerns
Publicly reported enterprise-security examples also point to agents leaking sensitive information or acting outside their intended scope, including cases where malicious instructions caused agents to bypass guardrails, delete production records, or trigger irreversible financial transactions.
The security concern is what registers most sharply with enterprise technology leaders. With chatbots and early generative AI, a security failure typically meant bad output: an inaccurate or inappropriate response that could usually be corrected after the fact. In the agentic era however, the consequences of an agent failure or security breach can be far more damaging because agents can take action, call tools, access systems, and initiate business processes.
That is why agent governance is no longer only an IT operations issue. It increasingly touches board-level concerns: risk ownership, regulatory exposure, data protection, auditability, operational resilience, and accountability for autonomous decisions.
The emerging AI governance platform
Leading organizations are beginning to treat agent governance not as a compliance overhead but as a strategic capability that determines whether AI investments compound as advantages or liabilities. As a result, effective AI agent governance has quickly become a boardroom topic and is contributing to the emergence of a new platform category: the AI governance platform.
The category is still forming, but its purpose is becoming clear. Enterprises need a way to discover agents, understand what they do, control what they can access, verify whether they are compliant, and monitor how they behave in production.
SAP is one of the agentic AI pioneers in this emerging category. Through its 2023 acquisition of LeanIX, SAP gained a foundation in enterprise architecture management. This has quickly become a recognized differentiator for SAP AI Agent Hub—positioning AI artifacts like agents, models, and MCP servers within the full architecture and business context of the organization.
SAP AI Agent Hub builds on this foundation as a command center for managing and governing AI agents and related AI assets across an enterprise, even when they come from different vendors and run on different systems.
As SAP CTO Philipp Herzig explained on stage at this year’s SAP Sapphire event, SAP AI Agent Hub is intended to provide a governance layer of record for the enterprise agent ecosystem. “Agents are everywhere,” he said. “Some are great, some are not, and almost no one has a consistent picture—no central governance, no clear view of what each agent does, whether it adds value or whether it adheres to your policies.”
He added: “SAP AI Agent Hub changes that. One entry point and command center to discover, manage, and govern all AI agents, LLMs, and MCP servers in your landscape—vendor-agnostic. [SAP] AI Agent Hub allows you to discover all your agents in context: your landscape, your business processes. Once you have identified the right agents, you can control their risk and define architectural decisions or compliance rules.”
A closing window
Given the pace of AI agent deployment, the window for implementing effective enterprise governance before a serious incident occurs is narrowing. For CIOs, CEOs, and company boards, the question is no longer whether to govern AI agents. It is whether governance gets designed into the architecture from the start or retrofitted after the first serious failure.
Organizations that treat agent governance as a strategic priority in 2026 will be better positioned to scale AI as a durable competitive advantage. Those that defer could spend 2027 cleaning up: in enterprise technology, the cost of speed without structure eventually gets paid. But with AI agents, the bill arrives faster—and at greater scale—than anything that has come before.
Sign up for the SAP News Center newsletter to receive weekly news, highlights, and updates
