Agentic AI is helping businesses realise tremendous efficiency gains. AI agents can now approve requests, interpret information, and trigger workflows inside enterprise systems, behaving less like tools and more like digital workers.
More than half of enterprises surveyed in Kyndryl’s “2026 People Readiness Report” say AI is now embedded in core business processes or broadly deployed. However, many leaders are discovering a significant barrier as they accelerate adoption: Their governance is not ready to support agentic AI at scale.
As enterprises deploy autonomous AI agents, they are introducing thousands of new machine identities into their operations that create challenges around oversight, trust, and accountability. Just as every employee requires defined responsibilities, appropriate access to tools and data, and the right guardrails to support responsible use, so too does each AI agent.
This is why enterprises can no longer treat agents like traditional software. Organisations must mature their governance to keep pace with growing autonomy — a challenge that is becoming more urgent as 81% of organisations expect autonomous AI agents to make decisions with material business impact within the next year.
AI agents expose hidden risks
Most enterprise technology environments were not designed for the speed and agility of AI agents. As organisations build a stronger foundation to scale AI, addressing decades of technical debt, inconsistent data quality, and fragmented workflows, their efforts will fall short without closing the governance gap.
In mission-critical environments, there is little tolerance for poorly governed technology that can lead to compliance failures, security lapses, or operational disruption. Organisations run the risk of losing visibility into which actions agents are taking and why as more AI agents are deployed.
Even well-designed AI agents can end up taking actions that amplify risk. For example, AI agents can gradually drift from intended policies and rules, or misconstrue human-given prompts. Organisations may also struggle to continuously update access controls, raising the risk of agents operating across sensitive systems long after a specific use case ends.
Agents, like people, need the right guardrails
If agentic systems are to be deployed responsibly across an enterprise, then enterprises must double down on governance.
Importantly, this includes formalising policies, decision rights, and accountability, and operationalising policy within enterprise-wide workflows. Only 33% of organisations surveyed in our “People Readiness Report” say they have clear policies on which decisions AI can and cannot make autonomously.
This isn’t just a technical problem but a business governance one. Just as employees rely on policies and management oversight to work responsibly, AI agents similarly need guardrails to reduce risk and create value.
Rather than relying on manual processes, organisations can translate policies and compliance requirements into machine-readable code. This approach, called policy as code, helps agents operate within clear guardrails and makes their actions more predictable, traceable, explainable, and aligned with business and regulatory requirements.
Policy as code turns business, security, and compliance rules into enforceable controls that govern how AI agents interact with enterprise systems. It provides a scalable way to apply business rules consistently across environments.
With policy as code, agent actions are checked against and enforced by pre-defined business policies. Guardrails block unpredictable or unauthorised actions, reducing the impact of agentic hallucinations. At the same time, policy as code provides transparency, as agent actions and decisions are logged and explainable, supporting compliance and oversight. Policy as code also enables people to supervise AI operations in real time so they can continuously monitor operations and intervene when needed.
Make governance the foundation for AI success
As AI agents become part of the modern enterprise, organisations should treat agentic governance as seriously as they treat workforce management. Bringing together expertise, strategy, and technology can help organisations establish trust and transparency. By putting governance first, businesses can retain control and pursue high-value business outcomes as they scale AI.
