In short: Agents now act faster than committees, policies and periodic reviews can approve. Governance is the capability that decides who may act; its core, control capacity, is how much agent action an organisation can authorise, constrain, trace and reverse within its risk appetite, without slowing the change that is safe. It is built as a control plane in the run path: identify, permit, trace, stop.

Who approved what your agents can do?

In many organisations, the honest answer may be nobody, at least not in the form the agents now use. Deloitte's 2026 State of AI in the Enterprise, a survey of 3,235 leaders in 24 countries, found that 23% of companies already use agentic AI at least moderately, a share expected to reach 74% within two years. Only 21% reported a mature model for governing autonomous agents.

The gap shows up in permissions first. In a survey of 1,000 security and engineering staff at large US companies in May and June 2026, 1Password found that 47% of developers had seen an agent take an unintended action after following instructions embedded in a web page, document, email or tool output. A third of developers using agents said their organisation had already had a security incident or breach linked to overprivileged machine identities, a category that now includes agents. A separate 1Password pulse survey found 40% of technical staff leave agents with persistent access after the task has ended. 1Password sells access management, so these figures are best read as directional.

Together they describe a familiar pattern from the Absorption Gap. What leaders believe they approved and what their agents can actually reach have drifted apart, and the difference only becomes visible when something goes wrong.

Why does governance built for people fail at agent speed?

The case for today's governance deserves a fair hearing. Change advisory boards, access reviews, policies and risk committees exist for good reasons: accountability, separation of duties and the expectations of regulators and auditors. In financial services, the EU's Digital Operational Resilience Act has required since January 2025 that changes to ICT systems be recorded, tested, assessed, approved, implemented and verified in a controlled manner. Those aims still stand.

These mechanisms share one assumption, which is that decisions arrive at human pace. A quarterly access review assumes permissions change slowly. A change board assumes a manageable number of changes a week, each made by someone who can explain it.

Agents break that assumption in three ways. They act continuously, so approval at the meeting cadence either becomes a queue or gets bypassed. They often act with borrowed identity, a developer's token or a shared service account, through identity tooling designed for people. And they choose their steps at run time, so approving the task is no longer the same as approving each action taken to complete it.

This is where Constraint Migration reaches governance, the stop that sits across every stage of the AI Engineering Production System rather than at one of them. Governance is the general capability: deciding who and what may act, on which systems, under which authority. Its core is control capacity: how much agent action an organisation can authorise, constrain, trace and reverse within its risk appetite, without slowing the change that is safe.

Control capacity joins context capacity, verification capacity, integration capacity and recovery capacity. Each names the point where agent supply meets a limit designed around people. This one sets how far autonomy can safely extend at all the others.

What did the deleted databases teach?

In April 2026, PocketOS, a software provider for car rental businesses, lost its production database. According to its founder, Jer Crane, a Cursor coding agent running Anthropic's Claude Opus 4.6 was working on a task in staging when it hit a credential mismatch. It found an API token in a file unrelated to the task and used it to delete a storage volume at Railway, the company's infrastructure provider. The volume held the production database and its volume level backups. The call took nine seconds and asked for no confirmation.

The token had been created to manage custom domains through Railway's command line tool, yet it carried full rights over Railway's API, including deletion. Railway's founder described a fully permissioned token calling a legacy endpoint that lacked the delayed delete protection used elsewhere on the platform, and Railway later recovered data from its own backups. Crane said significant gaps remained, and argued that the story was about neither one bad agent nor one bad API.

The pattern was already visible. In July 2025, an agent on Replit deleted a production database during a declared code freeze. In the Amazon incidents discussed in the operating capacity piece, the company said an engineer had broader permissions than expected.

Each case can be read as misconfiguration or user error, and both Amazon and Railway pointed to permissions. That reading is fair, and it is also the lesson. In every case the system permitted the action. The agent at PocketOS had an instruction not to guess, and it guessed. An instruction in a prompt is advice to the agent. A token scoped to one environment and one operation, a delete that waits for a person, and backups the agent cannot reach are controls, because they hold whatever the agent decides.

What does a control plane contain?

A control plane is the shared layer that decides who may run which agents, with which permissions, under which policies, using which models and tools. Deloitte's cyber practice uses the term in much this sense, and identity vendors now build towards it. Microsoft made Entra Agent ID generally available this year, Okta released Okta for AI Agents in April, and Palo Alto Networks completed its $25 billion acquisition of CyberArk in February to secure human, machine and agent identities on one platform.

Products cover parts of it. The architecture is the CTO's to design, and it has four functions.

Identify. Every agent is registered as an accountable actor, with an owner, a purpose, a scope and a version that covers its model, prompt and tools. No agent acts on a person's credentials or a shared account. The registry is one of the inventories behind a governed context supply, and the first question in any incident is whether the agent involved appears in it.

Permit. Agents get the least agency the task needs, a principle OWASP places at the front of its Top 10 for Agentic Applications, published in December 2025, where identity and privilege abuse ranks third. Credentials are issued per task, scoped to one environment and the operations required, and revoked when the task ends. Policy is checked at the moment of action against the change's risk tier, using the same tiers as the Verification System. Irreversible actions need a person's approval through a channel the agent cannot complete for itself.

Trace. Every action carries a record of the intent behind it, the context the agent saw, what it did, the permission it used and who approved it. This extends the change provenance that operating capacity requires for production changes to every action an agent takes. It is the record that turns an incident from a debate about blame into a recovery.

Stop. One action revokes all of an agent's access across systems. Changes can be rolled back, destructive operations wait before they execute, and backups sit where no agent can reach them. Where recovery capacity is thin, rate limits and controlled friction slow change down. The stop is tested on a schedule, the way disaster recovery is, because a kill switch nobody has tried tends to fail the first time it matters.

One discipline runs through all four. A change to an agent's model, prompt or tools is a change to the agent, and it passes evaluation before it ships, like any other change.

Figure 1. The control plane sits in the run path. Every agent action crosses it; the PocketOS incident went around it.

Figure 1. The control plane sits in the run path. Every agent action crosses it; the PocketOS incident went around it.

Who decides, and who owns the control plane?

Agents do, people decide. The control plane makes that division enforceable by tying each tier of action to a decision right.

The tiers mirror those of the Verification System, so a change and the agent producing it are governed by the same classification. Service owners assign tiers to their systems, an agent cannot lower a tier, and automated rules can raise it.

The control plane needs one named owner with a budget, usually the platform function that already runs identity and delivery infrastructure. Security and risk set the policy with the business. Committees keep a role: they review policy, exceptions and the evidence from the probes below, rather than individual actions.

That division also guards against the opposite failure. Governance that sends every agent action to a person becomes the next queue, and approval hours count as human intervention in validated business value per unit of human intervention. Overcontrol lowers the ratio as surely as an incident does.

Where is regulation heading?

Timelines move, but the direction is consistent. In the EU, the AI Act's Digital Omnibus entered into force in July 2026 and deferred the obligations for standalone high risk systems to December 2027, and for AI embedded in regulated products to August 2028. The deadlines moved; the requirements for human oversight, logging and traceability did not.

Elsewhere, Singapore published the first governance framework dedicated to agentic AI in January 2026. It is not binding, and it stresses meaningful human control over agents. In the United States, NIST launched an AI Agent Standards Initiative in February, with agent identity and authorisation among its first topics. Adjacent rules point the same way: DORA's change management requirement was written for changes made by people, and nothing in its wording exempts changes made by agents.

Across these regimes the questions converge. Who acted, under which authority, could a person intervene, and can the organisation show it afterwards? A control plane answers them once, as architecture, for every regime the organisation falls under. This is a reading of direction, not legal advice, and sector obligations vary.

How should control capacity be measured?

Five probes give a first reading without new tooling.

Registry coverage is the share of agents in use that are registered with an owner and a scope. Standing privilege is the share of agent credentials that outlive the task they were issued for. Trace coverage is the share of agent actions in production that carry the full record. Time to stop is the interval between deciding to stop an agent and the moment all its access is revoked, measured in drills. Approval queue time is how long hard to reverse actions wait for a person.

The first four show whether control is real. The fifth shows whether it has become a bottleneck. Control capacity is high when coverage is near complete, standing privilege near zero, time to stop measured in minutes and approval queues short. That is also the condition under which a CTO can defend extending more autonomy to agents.

Where should a CTO start?

A workable sequence starts with an inventory of every agent in use and the credentials each one holds, which the three inventories approach already structures. Standing production credentials held by agents should go first, since they carry the largest blast radius. Tiers then come from service owners, the trace is wired into change provenance, and a stop drill shows whether the kill switch works. The results go to the governance committee as evidence, which gives it something better to review than a policy document.

The question for your control plane

Agents will keep taking on more of the work, and the organisations that extend their autonomy safely are likely to be those that treat control capacity as something to design, build and measure. Governance stays a human responsibility; what changes is where it is enforced.

If one of your agents tried to delete production data tonight, what would stop it: a sentence in its instructions, or your architecture?

Read further

FAQ

What is control capacity?

Control capacity is how much agent action an organisation can authorise, constrain, trace and reverse within its risk appetite, without slowing the change that is safe. It is the core of governance as a capability, and the governance stop in the AI Engineering Production System. When control capacity is low, every extension of agent autonomy adds unmanaged risk, so it sets how far agents can be trusted elsewhere.

How is a control plane different from an AI governance policy?

A policy states what should happen and relies on people to apply it. A control plane enforces it in the systems agents act through: it registers each agent, issues task scoped credentials, checks policy at the moment of action, records what happened and can revoke access at once. Committees still set and review the policy, but they no longer approve individual actions.

Should AI agents have their own identities?

Yes, in most cases. An agent acting on a developer's token or a shared service account cannot be traced, scoped or stopped on its own. Registering each agent as a distinct identity with an owner, a purpose and task scoped credentials makes least privilege and audit possible. Identity vendors including Microsoft and Okta released agent identity products for this purpose in 2026.

What do the database deletion incidents show?

In the PocketOS, Replit and Amazon cases, an agent took a destructive action that its credentials allowed. Each can be read as misconfiguration, which is the point: the agent's instructions did not prevent the action, while scoped credentials, confirmation on destructive operations and backups out of reach would have. Control has to sit in the architecture, whatever the agent decides.

Does the EU AI Act delay mean governance can wait?

The AI Act's Digital Omnibus deferred high risk obligations to December 2027 and August 2028, but the requirements for human oversight, logging and traceability are unchanged, and rules such as DORA already apply. More practically, the incidents above happened without any regulator involved. A control plane is worth building for operational reasons first, and it also prepares the evidence regulators will ask for.

Sources