Agent sprawl

Agent sprawl is the uncontrolled proliferation of AI agents across an organization without a central inventory, clear ownership, or common governance. SD Times has defined it in roughly those terms, and Beam has called it the defining governance challenge of 2026. The pattern is the agentic successor to shadow IT: capability accumulates faster than the controls around it.

Sprawl is not a synonym for having many agents. A large estate with a registry, named owners, and a shared policy layer is a fleet. The same estate without those things is sprawl, and the difference shows up the first time an agent takes an action nobody can explain.

What agent sprawl looks like in practice

The recognizable symptom is that nobody can produce the list. Material distributed by Gartner in late 2025 framed the problem as a CIO-level concern, describing agents deployed across departments, regions, and channels without shared visibility, logic, or control. The concrete forms are familiar. A support team builds an agent to draft replies. A finance team builds one to reconcile invoices. A vendor ships one embedded in a product the company already pays for, on by default. A developer wires a Model Context Protocol server to an internal API to save an afternoon, and it runs for a year.

None of these is a bad decision in isolation. Collectively they produce an estate where three agents answer the same question differently, two hold write access to the same billing system, and one has been failing silently since a schema change months ago.

Why sprawl happens

The build cost collapsed. An agent that would have been a quarter of engineering work in 2023 is now an afternoon of prompt writing and tool wiring, often by someone who is not an engineer. When the cost of creating something falls below the cost of getting approval, approval stops happening.

Ownership is distributed by design. The value of agents comes from proximity to a specific workflow, so the people best placed to build them sit in operating teams rather than a central platform group. Centralizing construction kills the value; not centralizing it means no single team sees the whole estate.

Vendors ship agents inside products. A growing share of the estate was never built internally. It arrived as a feature in a tool the company already licensed, sometimes on by default, often with its own credentials and data flows. These are the hardest agents to inventory because nobody procured them as agents.

Nothing forces retirement. Agents built for a campaign, a migration, or a one-off analysis keep running after the reason for them ends. Without an expiry convention, the estate only grows, and shadow AI accumulates in exactly the places least likely to be audited.

The risks sprawl creates

Credential exposure. Every agent holds some form of machine credential, and sprawl means those credentials are provisioned ad hoc, scoped broadly because narrow scoping takes longer, and almost never rotated. The population of non-human identities in a sprawling estate typically exceeds the human population several times over, and it is the least managed.

Duplicated and divergent logic. When three teams encode the refund policy in three agents, the policy changes once and the agents change at different times or not at all. Customers get different answers depending on which surface they used, and nobody internally is comparing.

Unowned failures. An agent whose builder has changed teams still runs, still acts, and still fails, but the alerts route to a person who no longer reads them. These failures are usually discovered by customers rather than by monitoring, because no observability pipeline was ever pointed at the agent.

Inconsistent policy enforcement. Some agents have guardrails, redaction, and logging. Some have none. Regulated obligations under frameworks such as the EU AI Act apply to the system regardless of which team built it, and an estate that cannot be enumerated cannot be attested to.

What an agent inventory should record

The inventory is the first control, and it is useful long before it is complete. The minimum record has five parts: what the agent does in one sentence, who owns it by name, what systems and tools it can reach, what data it touches, and what happens when it fails.

Beyond that minimum, the fields that earn their place support a decision. Which model and version it runs on, so a deprecation can be planned. Which credentials it holds and at what scope, so access review has something to review. Which prompt version is deployed, which is why agent versioning becomes a prerequisite rather than a nice-to-have. Whether it can write or only read, since that bit sets the review burden. And a review date, so agents expire by default.

Inventories built as a one-time census decay within a quarter. The ones that survive are populated automatically from the layer agents pass through to reach models and tools, which is the practical argument for routing agent traffic through an AI gateway.

How governance practice is converging

The emerging shape borrows more from identity and access management than from model governance. Agents get registered identities rather than borrowed human credentials. Permissions are scoped per agent and reviewed on a schedule. A central catalog records what exists, and a policy layer sits between agents and the systems they act on, so enforcement does not depend on each builder remembering it.

The second convergence is toward tiering. Not every agent needs the same scrutiny, and uniform treatment guarantees the controls are either too weak for the risky agents or too heavy for the trivial ones. Most frameworks sort by whether an agent can take irreversible actions, whether it touches regulated data, and whether it faces customers. Read-only internal agents get registration and little else. Customer-facing agents with write access get evaluation suites, change control, and human review of their action logs.

The third is that formal standards are catching up. ISO 42001 gives organizations a management-system framework that expects exactly the inventory, ownership, and review cadence that sprawl lacks, and adopting it tends to force the inventory work that had been deferred. None of this resolves the underlying tension, which is that the same low build cost producing sprawl is what makes agents worth deploying. The goal is not to slow creation down but to make everything created visible, owned, and revocable.