Strategy
Governance at Scale: Managing Hundreds of Agents Without Losing Control
9 min read
Governance that works for ten AI agents collapses at a hundred, because it relies on people remembering what they built and reviewing what it does. This guide sets out the five structural controls that replace it: a registry agents cannot bypass, identities with named sponsors, risk tiers, policy enforced outside the agent and fleet-level monitoring.
✦Key Takeaways
- Governance for ten agents relies on people remembering what they built. Past a hundred, inventory, ownership and review capacity all fail at roughly the same time.
- Human review cannot keep pace with agent count: 200 agents taking 50 actions a day would need more than 83 hours of reading every day. At scale, governance means deciding where human attention goes.
- Machine identities, including AI agents, now outnumber human identities 109 to 1, up from 82 to 1 a year earlier, according to CyberArk's 2026 Identity Security Landscape.
- Make registration a precondition of running. A registry that agents can bypass is a spreadsheet, not a control.
- Every agent needs its own credentials and a named human sponsor. Unclaimed agents should be suspended automatically, not left running on a former employee's permissions.
- Risk tiers let an agent's category decide its controls, so you design oversight three times rather than three hundred.
- A rule in a system prompt is a suggestion. A rule enforced at a gateway outside the agent applies to every agent at once, including the ones not yet built.
- The ICO has said AI agency does not remove organisational responsibility for data processing, so a large fleet is no excuse when something goes wrong.
Nobody sets out to run 300 AI agents. They accumulate. Sales builds a lead-scoring agent, finance wires up an invoice-matching bot, support deploys three triage agents, and a hackathon leaves behind a dozen prototypes that still hold live API keys. Eighteen months later something goes wrong, and a simple question takes a week to answer: which agent did that, who owns it, and what else can it touch?
AI agent governance at scale is the set of structural controls that keep a large fleet of autonomous agents inventoried, owned, bounded and observable without a human reviewing every action. It is less about watching agents more closely and more about building the system every agent has to run through.
We have already covered how to monitor, audit and control an individual agent: traces, versioned prompts, budgets and kill switches. This post is about what changes when the number stops being five and becomes five hundred.
Why AI Agent Governance Breaks Between Ten Agents and a Hundred
At ten agents, governance is a handful of people who remember what they built. Past a hundred, three things break at roughly the same time.
- Inventory. Nobody has a complete list. Agents live in SaaS tools, automation platforms, cloud accounts and developers' laptops, and each was approved, or not, by a different person.
- Ownership. The person who built an agent moves team or leaves, and the agent keeps running on their permissions.
- Review capacity. Human review does not scale with agent count. 200 agents averaging 50 actions a day produce 10,000 actions. At 30 seconds each, reading them all would take more than 83 hours of reviewer time, every day.
The numbers are moving the wrong way. The 2026 Identity Security Landscape from CyberArk, now part of Palo Alto Networks, counts 109 machine identities, including AI agents, for every human identity, up from 82 a year earlier. Microsoft, launching its Agent 365 control plane, cited an IDC forecast of 1.3 billion agents by 2028.
UK regulators have noticed the gap. The ICO's January 2026 Tech Futures report on agentic AI says "it's not clear whether, in practice, organisations will be able to effectively monitor an increasing number of agents." It is equally clear about who carries the risk: AI agency "does not mean the removal of human, and therefore organisational, responsibility for data processing."
Govern the System, Not Each Agent
The useful model is air traffic control. Controllers do not fly the planes. They handle hundreds of flights safely because the system does most of the work: every aircraft is registered, every flight files a plan before take-off, airspace is divided into classes with different rules, and radar watches the whole sky so people step in only when something deviates.
Agent fleets need the same shift. Stop asking "have we reviewed this agent?" and start asking "can any agent run without passing through our controls?" When the answer is no, you can add the 301st agent without adding a reviewer.
The Five Controls of AI Agent Governance at Scale
1. A Registry: No List, No Launch
Every agent gets an entry before it gets credentials: its purpose, business sponsor, risk tier, the tools and data it can reach, the model and prompt version it runs, and the date of its last review. Microsoft frames Agent 365 around exactly this idea: "The best way to prevent agent sprawl is to start with a registry that acts as a single source of truth."
A registry only matters if it is enforced. Make registration a precondition of deployment, so the gateway rejects any agent credential that is not on the list. Then run discovery for the agents that already exist outside it by scanning OAuth grants, API keys and automation platforms. Treat anything you find as unregistered, not as approved.
2. Identity: Every Agent Gets Its Own Credentials and a Named Human
Shared service accounts, and agents borrowing an employee's login, are the fastest way to lose control, because every log entry then points at the wrong actor. Give each agent its own identity, scoped to the minimum it needs, so you can revoke one agent without breaking ten others.
Pair that identity with a person who is accountable for it. Microsoft Entra Agent ID makes this mandatory: "At least one sponsor is required for each agent identity," and sponsorship should be maintained "when an employee who's a sponsor moves or leaves." We recommend one blunt rule on top: an agent without a sponsor is suspended after 14 days unless someone claims it.
3. Risk Tiers: Let the Tier Decide the Controls
You cannot design bespoke oversight for 300 agents, but you can design it three times and let each agent's tier apply the controls automatically.
| Tier | What the agent can do | Controls applied automatically |
|---|---|---|
| Tier 1: Low | Reads internal data; drafts content a person sends | Registry entry, own identity, sampled audit |
| Tier 2: Medium | Writes to internal systems such as the CRM or ticketing | Policy gateway, spend and step budgets, weekly sample review |
| Tier 3: High | Touches customers, money or personal data, or takes irreversible actions | Human approval for irreversible steps, evaluation before any model or prompt change, full logging, quarterly recertification |
This mirrors Singapore's Model AI Governance Framework for Agentic AI, published by IMDA in January 2026, which starts with assessing and bounding risk up front by limiting an agent's tool access, permissions, operating environment and scope of action. Most of a healthy fleet should sit in Tier 1. If Tier 3 is the fastest-growing tier, you have a design problem, not a governance one.
4. Policy as Code, Enforced Outside the Agent
A system prompt that says "never refund more than £250" is a suggestion. A rule enforced at the gateway between the agent and the refund tool is a control. At scale the difference is everything: you write the rule once, and it applies to every agent that calls that tool, including the ones built next quarter.
Policy in Amazon Bedrock AgentCore, generally available since March 2026, "operates outside your agent code": a gateway intercepts agent-tool traffic and evaluates each request before allowing or denying it. Open policy engines such as Cedar and Open Policy Agent do the same job if you build your own. Either way, your security team can change a rule without redeploying a single agent.
5. Fleet Monitoring: Watch the Sky, Sample the Flights
Monitor the fleet as a population rather than as 300 separate dashboards. The useful signals are relative: an agent suddenly running five times its usual volume, a spike in policy denials, rising cost per completed task, or an agent requesting a tool it has never used. A climbing denial rate is often the first sign that an agent has drifted.
Then spend human attention where it counts. The ICO report anticipates organisations needing "a separate, standalone monitoring system (or agent) to monitor logs, interpret them and intervene as necessary." In practice, a supervisor layer flags anomalies and people review three things: approvals for irreversible Tier 3 actions, anomaly flags, and a small random sample of routine runs. In our 10,000-action example, that is about 120 items a day: roughly four hours for one person, instead of 83 hours for a team.
Lifecycle: Agents Are Easy to Create and Nobody Retires Them
Agents rarely die on their own, so build retirement into the system:
- Quarterly recertification. Each sponsor confirms the agent is still needed and its access is still right.
- Automatic suspension for any agent with no runs in 60 days.
- Re-evaluation whenever a Tier 3 agent's model, prompt or tools change, because a model upgrade is a behaviour change.
- A decommissioning step that revokes credentials, removes tool grants and archives logs for your retention period.
At this scale, agents also start delegating to each other, which opens a separate risk: data leaking in the handoff. We cover that in securing the agent-to-agent conversation.
Where to Start If You Already Have Agent Sprawl
You do not need a platform purchase to begin. Most organisations can regain control in about a month:
- Week 1: discover. List every agent across SaaS tools, automation platforms, cloud accounts and code repositories. Pull OAuth grants and API keys to catch the ones nobody mentioned.
- Week 2: assign or switch off. Every agent gets a sponsor. Anything unclaimed by Friday is suspended, and you will be surprised how few people complain.
- Week 3: tier. Place each agent in a risk tier and move Tier 3 agents onto their own identities first.
- Week 4: gate and watch. Put Tier 2 and Tier 3 tool calls behind a policy gateway, build fleet dashboards, and hold a monthly 30-minute review of anomalies and denials.
Order matters. A registry without enforcement becomes a stale spreadsheet, and a gateway without a registry has nothing to check against.
Conclusion
Managing hundreds of agents is not a bigger version of managing five. The controls that work for a handful, personal knowledge and manual review, are exactly the ones that collapse at scale. What replaces them is structure: a registry that agents cannot bypass, identities with named human sponsors, tiers that assign controls automatically, policy enforced outside the agent, and monitoring that sends people only the exceptions.
Start with the discovery exercise this week; the count alone is usually enough to get the rest funded. If you would like help building the registry, gateway and tiering model for your own agent fleet, get in touch.
Frequently Asked Questions
- What is AI agent governance at scale?
- It is the set of structural controls that keep a large fleet of AI agents inventoried, owned, bounded and observable without a person reviewing every action. In practice that means a registry, a separate identity and named sponsor for each agent, risk tiers that set controls automatically, policy enforced at a gateway, and monitoring across the whole fleet. The aim is that no agent can run without passing through those controls.
- What is agent sprawl?
- Agent sprawl is the unplanned growth of AI agents across an organisation, built in different tools by different teams with no central list and no consistent ownership. It is the agent-era version of shadow IT. The main risk is agents running with live credentials that nobody monitors, including agents whose builders have left the business.
- How many AI agents can one person oversee?
- There is no fixed ratio, because it depends on how much oversight is automated. If every action needs a human check, one busy agent can fill a reviewer's day. When policy gateways, risk tiers and anomaly detection handle routine checks, one person can oversee hundreds of agents by reviewing only approvals for irreversible actions, flagged anomalies and a small random sample.
- What should an AI agent registry include?
- At minimum: the agent's purpose, a named business sponsor, its risk tier, the tools and data it can reach, the model and prompt version it runs, its credentials and the date of its last review. Record how to stop it too. The registry only becomes a control when deployment is blocked for any agent that is not on it.
- Should AI agents have their own identities?
- Yes. An agent using a shared service account or an employee's login makes every log entry point at the wrong actor, and you cannot revoke one agent without breaking others. Platforms such as Microsoft Entra Agent ID now treat agents as identities in their own right and require each one to have a business sponsor.
- What is a policy gateway for AI agents?
- A policy gateway sits between agents and the tools they call, such as a CRM, payment system or email service, and checks every request against written rules before allowing it. Because the rules live outside the agent's code and prompt, you change them once and they apply to every agent immediately. Amazon Bedrock AgentCore Policy, Cedar and Open Policy Agent are common ways to build one.
- Are there UK rules on governing AI agents?
- At the time of writing the UK has no legislation written specifically for AI agents, so existing law applies, UK GDPR above all. The ICO's January 2026 Tech Futures report on agentic AI makes clear that organisations stay responsible for the data processing their agents carry out. Singapore's voluntary Model AI Governance Framework for Agentic AI is a useful, detailed reference for UK firms designing their own controls.
- When should a smaller business start governing its agents?
- Earlier than it expects. SMEs often reach dozens of agents quickly, because building one in an automation platform takes an afternoon. Starting a simple registry and a sponsor rule at ten agents costs almost nothing, while retrofitting them at a hundred is a project.
