Every AI Agent Needs Two Owners

Gartner expects the average global Fortune 500 enterprise to be running more than 150,000 AI agents by 2028, up from fewer than fifteen in 2025. The number that should hold a CIO's attention sits in the same April 2026 release: only 13 per cent of organisations believe they have the right governance in place for them.

The industry has decided this is an identity problem. IBM announced agent identity, short-lived credentials and real-time revocation at the end of October 2026. Gartner puts identity, permissions and lifecycle at step three of its six steps on agent sprawl. The Cloud Security Alliance calls non-human identity the defining governance gap of the agentic era. All of that is correct and none of it is sufficient. An agent identity tells you which credential acted, with what permission, at what time. It does not tell you who answers for what the agent did to a customer, a loan file or a shelf.

My view is that every agent in production needs two owners: a technical owner for the credential, and a business owner for the consequence. Appoint only the first and you get a complete audit trail of a decision nobody owns. This piece is for CIOs, CISOs, heads of AI and enterprise architects approving an agent programme.

The short version

Agent sprawl is being governed as an identity problem, and identity alone cannot carry accountability. A credential owner keeps the agent inside its permissions; a business owner answers for the outcome it produces. Assign both before an agent touches a customer-affecting process, and tier the control to what the agent can actually do.

• Give every production agent a named business owner, not only a technical one.
• Register the agent before it gets a credential, not after.
• Tier control by blast radius, not by the model it uses.
• Set a review date and a retirement date at creation.
• Test revocation quarterly; an untested kill switch is a belief.
• Count orphaned agents monthly and report the number upward.
• Accountability for personal data stays with you, whatever acted.

This article sits inside the technology governance cluster, where the wider argument is set out in full.

What changed in the last twelve months

Three things moved at once, and they moved in the wrong order.

Capability arrived first. Agents stopped suggesting and started acting: raising a purchase order, updating a customer record, triggering a payout. An error is no longer a bad paragraph a human ignores. It is a transaction someone has to reverse.

Volume arrived second. SAP's LeanIX Agentic AI Survey 2026, reported in August 2026, found that 98 per cent of companies have deployed AI agents or plan to, while fewer than half have visibility into an inventory of them. It is a vendor survey, so read the direction rather than the decimal.

Control arrived third, and only recently. IBM's October 2026 announcement is typical of the current wave: verified identities, scoped short-lived credentials, isolated runtimes, and revocation of a session mid-task. That is progress, and it arrives after most enterprises have put agents into production, which makes the first job discovery rather than deployment. IDC's spending survey already puts 16.7 per cent of planned AI spending on AI and agent security and governance. That is a large share of a new budget line spent on something that produces no new revenue, and the board will ask what it bought.

Should your organisation do this now?

• Yes, if agents in your estate can write to a system of record.
• Not yet, if every agent is read-only and drafts text a human sends.
• Instead, first: run a discovery scan and count what exists.
• Measure it by: agents found versus agents the team expected.

Why identity does not settle ownership

An identity answers three questions well: who is this, what may it touch, and what did it do. Those are the security questions, not the accountability ones.

Accountability needs a fourth answer: whose number moves when this works, and whose moves when it fails. The technical owner of an agent credential is usually a platform engineer or an IAM administrator. That person can rotate a secret and revoke a session. That person cannot decide whether a collections agent may contact a borrower twice in a week, and will not be the one explaining a complaint to a regulator or a board committee.

This is the gap that shows up after an incident. The log is complete, the permission was correctly scoped, the agent did exactly what it was authorised to do, and the outcome was still wrong, because nobody with business authority had specified what right looked like. The Cloud Security Alliance's May 2026 paper finds the same vacuum from the identity side, citing a World Economic Forum analysis in which 51 per cent of organisations report no clear ownership of AI identities.

There is a deeper reason it matters. In most enterprise processes, humans were never in the loop; they were the loop, absorbing undocumented variance no specification ever described. A copilot preserves that buffer, because a person still presses send. An autonomous agent removes it, and the undocumented part of the process does not disappear. It arrives as an exception, a complaint or a loss, and someone has to own it. That is why Autonomy Readiness treats this as multiplicative rather than additive.

[Autonomy Readiness](/frameworks/autonomy-readiness) = Specification × Exception Coverage × Observability × Reversibility

A zero on any factor makes autonomy unsafe rather than imperfect. Identity tooling raises Observability and Reversibility, which is real and valuable. It does nothing for Specification, and Specification is a business owner's job.

The two owners, and what each signs for

Keep the model simple enough to survive contact with a busy organisation. Two named people per agent, in one register, both reviewed on a fixed date.

The technical owner. A named individual in platform, security or engineering. Signs for the agent's identity and credential scope, the systems and data it can reach, logging and retention, credential rotation, and the ability to revoke access within a stated time. Reviews permissions on a defined cycle and removes access on retirement.

The business owner. A named individual who already owns the process the agent runs inside: the collections head, the store operations lead, the procurement manager. Signs for what the agent may decide, the exceptions it must escalate rather than resolve, the customer-facing standard it must meet, the metric it should move, and the decision to retire it. This person presents the agent's results to the executive committee.

Two rules keep the model honest. The business owner cannot be a technologist by default, because then nothing has changed. And neither role may be a team name. "Owned by the data team" is how an agent becomes an orphan the moment someone resigns.

The register entry should be short enough that people maintain it: agent name, purpose, the process it sits in, the two owners, systems it can write to, data classes it touches, autonomy tier, review date, retirement date. Nine fields. A register that needs a project to maintain is abandoned by the second quarter.

Should your organisation do this now?

• Yes, if any agent can act without a person approving each action.
• Not yet, if you cannot yet list the agents you already run.
• Instead, first: name business owners for the ten highest-volume agents.
• Measure it by: share of production agents with both owners named.

Tiering agents by what they can do

One control standard for every agent fails in both directions: it smothers a meeting-notes assistant in paperwork and under-controls an agent that moves money. Tier by blast radius, which is a business judgment, not a model capability.

Tier 1: drafts for a human

• What it does: produces text, summaries or recommendations a person reviews and sends.
• Controls: registered, technical owner named, data classification respected.
• My view: register these, do not govern them heavily. The human buffer is intact.

Tier 2: acts inside a bounded system

• What it does: updates records, routes tickets, schedules work, with no external or financial effect.
• Controls: both owners named, scoped credential, full action log, documented exception paths, quarterly permission review.
• My view: most enterprises are here, and most registers here are already out of date.

Tier 3: affects a customer, money or a regulated record

• What it does: contacts customers, posts financial entries, changes a credit, pricing or entitlement decision.
• Controls: everything in Tier 2, plus a written specification of permitted decisions, tested revocation, a reversal procedure, named escalation paths, and executive visibility of the metric.
• My view: the business owner here is an accountable executive by name, and no agent enters this tier without that person's written specification of what it may decide and what it must escalate.

The India-specific point sits in Tier 3. Under the Digital Personal Data Protection Act, accountability for personal data rests with the data fiduciary. An agent is not a party you can point at. The Rules were notified in November 2025 on a phased timeline, with consent manager provisions commencing in November 2026 and the main substantive obligations from May 2027, so there is time to design this rather than retrofit it. Verify current dates against MeitY, and take legal advice on your own position.

Should your organisation do this now?

• Yes, if agents already touch customers, money or regulated records.
• Not yet, if your estate is entirely drafting assistants.
• Instead, first: classify existing agents into the three tiers.
• Measure it by: number of Tier 3 agents without a written specification.

Before you approve it

Run this before signing off an agent programme, not after the first incident.

• Your team: can you produce a list of every agent in production today, with both owners named?
• Your team: how long does it take to revoke an agent's access, and when did we last test it?
• Your team: which agents can write to a system of record, and what reverses the write?
• Your vendor or integrator: how do agents authenticate, and are credentials short-lived and scoped?
• Your vendor or integrator: can we discover agents built on platforms we did not buy, and what does the audit log retain?
• Your board: who owns the business outcome of each Tier 3 agent, and who reports its number?
• Your board: what is our exposure if an agent acts correctly within its permissions and the outcome is still wrong?

How to measure it

• Agents with both owners named. Tells you whether accountability exists on paper. Baseline: first register build. Owner: AI governance lead. Review: monthly. Leading.
• Orphaned agent count. Agents whose named owner has left the role or the company. Tells you whether the register is maintained. Baseline: first HR reconciliation. Owner: IAM lead. Review: monthly. Leading.
• Median time to revoke. Minutes from a revocation decision to the agent losing access, measured in a test. Tells you whether reversibility is real. Baseline: first test. Owner: platform security. Review: quarterly. Leading.
• Tier 3 specification coverage. Share of customer or money-affecting agents with a written specification from the business owner. Tells you whether Specification is above zero. Baseline: first tiering exercise. Owner: process owners. Review: quarterly. Leading.
• Agent exception rate. Exceptions per thousand agent actions. Tells you whether the process was as specified as you assumed. Baseline: first 90 days. Owner: business owner. Review: monthly. Leading.
• Reversals and complaints traced to agent action. Tells you the cost of getting the above wrong. Baseline: last 12 months. Owner: business owner. Review: quarterly. Lagging.

If my argument is wrong, the exception rate on your autonomous agents will stay flat after you remove human review. In most processes I would expect it to rise, and the rise is undocumented variance arriving as work.

Mistakes that cost the most

Treating the register as a security artefact

It is built by the security team, for the security team, and the business never sees it.

• Why it happens: the funding came from a security budget line.
• Prevention: make the business owner column mandatory and review it with process owners.
• Early warning: nobody outside IT has opened the register in a month.

Naming a team instead of a person

Accountability dilutes to nobody the moment a reorganisation happens.

• Why it happens: naming an individual feels like assigning blame.
• Prevention: require a named person with a named deputy.
• Early warning: owner fields that read like department names.

Assuming the kill switch works

Revocation is designed, documented and never exercised.

• Why it happens: testing it interrupts something that is working.
• Prevention: a quarterly revocation drill on a non-critical agent.
• Early warning: nobody can state the time to revoke in minutes.

Letting agents create agents without inheriting controls

A sub-agent spawned at runtime picks up broader permissions than its parent was granted.

• Why it happens: orchestration frameworks make delegation easy and silent.
• Prevention: sub-agents inherit the parent's scope and appear in the register.
• Early warning: log entries from identities nobody can place.

Retiring the use case but not the credential

The project ends, the agent stops being watched, and its access stays live.

• Why it happens: retirement is a business decision with no technical trigger.
• Prevention: set a retirement date at creation, reconcile against access quarterly.
• Early warning: agents with no actions logged for ninety days and valid credentials.

Frequently asked questions

What is AI agent sprawl?

Agents being built, bought or embedded faster than an organisation can inventory them, assign owners, scope their permissions, monitor them or retire them. Gartner's April 2026 guidance sets out six steps to contain it.

Who should own an AI agent?

Two people. A technical owner accountable for its identity, permissions and logs, and a business owner accountable for what it may decide and for the outcome. The business owner should already own the process the agent runs inside.

How many AI agents will enterprises run?

Gartner predicts more than 150,000 per average global Fortune 500 enterprise by 2028, up from fewer than fifteen in 2025. Treat it as an order of magnitude for planning, not a forecast for your own estate.

Is agent identity management enough?

No. Identity establishes which credential acted and constrains what it can reach. It does not specify what a correct outcome looks like, or who answers when the outcome is wrong. It is necessary infrastructure for accountability, not a substitute for it.

What should an AI agent register contain?

Agent name, purpose, the process it sits in, technical owner, business owner, systems it can write to, data classes it touches, autonomy tier, review date and retirement date. Keep it short enough that it is maintained.

Does DPDP change who is accountable for an agent's actions?

The Digital Personal Data Protection Act places accountability for personal data on the data fiduciary. Deploying an agent does not move that accountability to a tool or a vendor. General information, not legal advice; confirm your position with counsel.

How do we find agents nobody told us about?

Start with network and SaaS discovery, identity provider logs for new service accounts and tokens, and your major AI platforms' own inventories. Expect the first count to exceed what the team predicts, as it usually does with model inventories.

Should we stop agent projects until governance is ready?

Rarely. Blocking pushes work out of sight, as it did with shadow AI. Register what exists, tier it, and apply full controls only where an agent can affect a customer, money or a regulated record.

What to do next

Pick your three highest-volume agents this week and try to fill in nine register fields for each. Where you cannot name the business owner, you have found the work. Then read the technology governance topic page, and the related piece on AI governance without a model inventory.

Sources

• Gartner, Gartner Identifies Six Steps to Manage AI Agent Sprawl, April 2026. gartner.com
• IBM, IBM Introduces Identity and Control for AI Agents, October 2026. newsroom.ibm.com
• Cloud Security Alliance, The Non-Human Identity Governance Vacuum, May 2026. cloudsecurityalliance.org
• IDC, Agent Governance Has Now Become a Core AI Investment, July 2026. idc.com
• SAP News Center, AI Agent Sprawl: Why AI Governance Is Now a Board-Level Issue, August 2026. news.sap.com
• OWASP GenAI Security Project, Top 10 for Agentic Applications, December 2025. genai.owasp.org
• Press Information Bureau, DPDP Rules 2025 notified, November 2025. pib.gov.in

Last reviewed: 29 October 2026.

Views are my own and do not represent my employer.

This article is general information, not legal advice.