Exponential growth of AI agents poses new corporate governance challenges

A forecast by consulting firm Gartner suggests that by 2028, an average Fortune 500 company could be operating more than 150,000 artificial intelligence agents—a huge jump from fewer than 15 agents in use in 2025. This data illustrates the scale that adoption of this technology could reach, although it doesn’t mean that all companies will reach this number.

What are AI agents?

Unlike assistants that only answer questions or generate text, AI agents are systems capable of executing sequences of tasks, interacting with digital tools, and making decisions aligned with predefined goals.

In practice, an agent can extract data from internal systems, organize spreadsheets, and produce reports. With appropriate permissions, it can also update records or forward messages to other users.

These systems are used in areas such as customer service, sales, human resources, technology, and finance. An organization can also combine several agents, each responsible for one stage of a larger process.

The spread of this model creates a new dilemma for companies: knowing exactly which agents are active, what information they have access to, and what actions they can perform.

Why does the proliferation of agents concern companies?

The growth predicted by Gartner—from fewer than 15 to more than 150,000 agents in three years—highlights a phenomenon known as agent sprawl, the uncontrolled proliferation of AI agents.

The risks include duplication of activities, unauthorized access to confidential data, and execution of actions outside corporate policies. For example, an agent created to organize documents could become a threat if given permission to access confidential files or share information with unauthorized individuals.

In addition, agents are often developed and deployed by separate departments, often without centralized oversight from the technology area, which makes it difficult to control their scope and behavior.

The research also revealed that only 13% of organizations consider themselves to have an adequate governance structure for these systems.

Who should control AI agents?

Responsibility for governance does not lie exclusively with the technical team. It involves information security professionals, business leaders, data stewards, and the employees themselves who create or use the systems.

Gartner recommends maintaining a centralized inventory that records the purpose of each agent, its responsible parties, permissions, and connected tools. The consultancy also advocates continuous monitoring of behaviors, periodic review of access, and deactivation of redundant agents.

In practice, this means establishing rules for the creation of new agents, defining which systems each one can access, and determining when an action requires human approval.

The level of autonomy should be proportional to the risk of the task: the greater the potential impact, the greater the rigor in permissions, records, and approvals.

The U.S. National Institute of Standards and Technology (NIST) maintains an initiative dedicated to developing standards and protocols to improve the security and interoperability of these systems.

Implications for managers and professionals

The expansion of agents changes the responsibilities of those who coordinate teams and processes. In addition to mastering the available tools, professionals will need to understand the limits of the systems, evaluate their results, and identify when human intervention is indispensable.

For managers, this includes assigning responsibility for each application, monitoring performance metrics, and verifying that automation is generating results without increasing operational risks.

Employees who use these resources must be aware of internal usage policies, avoid sharing restricted information, and validate results before basing important decisions on them.

Continuous governance is essential

The discussion about controlling agents is integrated into standardization efforts and should be part of the artificial intelligence implementation cycle, not just responses to incidents.

Identifying agents, limiting access, recording activities, and reviewing permissions are measures that help companies keep track of technology evolution and maintain visibility over actions performed on their behalf.

With the possible multiplication of these systems, the corporate challenge will be to expand automation without losing control over the activities it performs.