Governing AI Agents: The New Control Layer for Companies

On May 1, 2026, Microsoft made Agent 365 generally available, a control plane to discover, govern, and secure AI agents, priced at 15 USD per user per month. On June 9, 2026, KPMG announced it would extend both Agent 365 and Microsoft 365 Copilot to more than 276,000 professionals across 138 countries. The signal is clear: once companies run many agents at once, the hard and valuable part stops being building a single agent and becomes governing the whole fleet. Agent identity, access, an audit trail, and oversight matched to the impact of each agent's actions are becoming the new control layer inside companies.

What happened

Microsoft made Agent 365 generally available on May 1, 2026 and described it as a control plane to discover, govern, and secure agents and their actions. The product costs 15 USD per user per month or is included in the Microsoft 365 E7 suite. Its scope covers agent inventory across local, cloud, and SaaS environments, granting agents delegated access or their own credentials, extending Microsoft Entra network controls to agents, and enforcing policy through Microsoft Defender and Intune. Beyond Microsoft platforms, it connects to AWS Bedrock and Google Cloud.

Some of the oversight capabilities were scheduled for June 2026. They include context mapping for each agent, meaning the devices it runs on, the configured MCP servers, the associated identities, and the cloud resources the agent can reach, along with runtime blocking of coding agents that show malicious behavior patterns.

On June 9, 2026, KPMG and Microsoft announced an expanded collaboration. KPMG will extend Microsoft 365 Copilot and Agent 365 to more than 276,000 professionals across 138 countries. The firm framed this within its KPMG Trusted AI framework and committed to centralized management and oversight of agents operating across systems, data, and processes, as well as using this layer in services for clients. A rollout at that scale shows that for a large enterprise the challenge is no longer building an agent, but keeping their number under control.

Why it matters for business

The center of gravity is shifting from building agents to governing them. According to Deloitte's The State of AI in the Enterprise 2026, 66% of organizations report productivity gains from AI, about 23% use agents at least moderately, and within two years that share is expected to reach about 74%. McKinsey's The State of AI reports that 23% of organizations are scaling an agentic system anywhere in operations, while 39% have begun experimenting with agents. The number of agents inside companies is rising, and with it the number of autonomous actors that reach into data and carry out operations.

This creates a new class of risk. An agent acts on its own, often on a person's account and permissions, and can chain several systems into one sequence of actions. Without an agent registry, an assigned identity, limited permissions, and a record of actions, a company loses visibility into what happens inside its own processes. Microsoft's decision to sell a separate control layer, and the size of the KPMG rollout, confirm that the market now treats governing a fleet of agents as a distinct, paid problem. For any company planning to work with agents, the practical takeaway is to plan the control layer alongside the first agent, not to bolt it on afterward.

Business use cases

Agent registry and the end of agentic shadow AI

Business problem: employees launch agents inside tools they already use, and the company does not know how many run, who created them, or what data they reach.

Possible AI solution: a layer that discovers and inventories agents across local, cloud, and SaaS environments, then keeps a central registry of them.

Data and processes to implement: a scan of environments where agents may run, a single registry with an assigned owner and purpose for each agent, and a process for registering new ones.

Potential effect: a fuller picture of what actually runs in the company, and fewer uncontrolled agents launched without IT's knowledge.

Risk and limitation: a registry alone is not enough if no one maintains it. It needs a process owner and a review cadence, otherwise the list quickly goes stale.

Agent identity and least-privilege access

Business problem: an agent runs on a person's account with broad permissions, so it reaches data and systems its task does not require.

Possible AI solution: giving the agent its own identity and credentials, with access limited to a specific task instead of inheriting the user's full permissions.

Data and processes to implement: a map of the data and systems the agent genuinely needs, access rules at the agent level, and network controls that limit the reach of its actions.

Potential effect: a smaller risk surface, because an error in or compromise of one agent does not open access to the entire environment.

Risk and limitation: permissions that are too narrow block the agent's work, and ones that are too broad create a gap. Getting it right requires reviewing the process, not accepting a default.

Audit trail and accountability for agent decisions

Business problem: an agent carried out an operation, and the company cannot reconstruct what it did, on what data, and on whose instruction.

Possible AI solution: a record of each agent's actions, tied to its identity, the devices it ran on, and the resources it reached, available for review and control.

Data and processes to implement: logging of agent actions, mapping of their connections to systems, and a process for a designated person to review events.

Potential effect: the ability to hold decisions accountable, detect errors faster, and demonstrate compliance during an inspection or audit.

Risk and limitation: the record alone protects nothing if no one analyzes it. Without review, logs become an archive opened only after an incident.

Oversight matched to an agent's level of autonomy

Business problem: a company applies the same rules to an agent that only suggests and an agent that independently executes operations with large financial or legal consequences.

Possible AI solution: differentiating oversight by the impact of an agent's actions, with human approval and blocking where risk is high, and freedom where the agent only proposes.

Data and processes to implement: classifying agents by the impact of their actions, approval rules for high-impact operations, and a mechanism to block suspicious behavior at runtime.

Potential effect: control where the stakes are high, without slowing down low-risk agents.

Risk and limitation: on May 26, 2026 Gartner warned that uniform oversight rules for all agents, regardless of autonomy, lead to deployment failure. Misclassifying an agent carries that risk back into the company.

What companies can do now

Start with an inventory, before the number of agents gets out of hand. List which agents actually run, who launched them, on what permissions, and what data they reach. It is the same exercise done for employee accounts, applied to software that acts on its own.

Assign an owner and least-privilege access to every agent. Decide who is accountable for the results of its work, and limit access to what the specific task requires rather than inheriting the user's full permissions.

Turn on an activity record and name the person who reviews it. A log without review is only an archive. Set a review cadence and a threshold for events that require a response.

Match oversight to impact, not to one rule for all. Supervise a high-impact agent more tightly, with human approval, and give a suggesting agent more freedom. Plan the control layer together with the first agent, not after it goes live.

Risks

Data security: an agent with excess permissions reaches data its task does not require. Without limited access and network control, a single error opens the way into the whole environment.

Agentic shadow AI: employees launch agents inside tools they already use, without IT's knowledge. That is a gap in security and quality that cannot be closed without an agent registry.

Costs: a control layer is a separate expense, for example 15 USD per user per month for Agent 365, on top of the time to inventory agents, configure permissions, and maintain the registry. Without counting those items, disappointment is easy.

Failed deployment and no owner: an agent with no assigned owner or purpose stalls or runs detached from the process. No one is accountable for its output, so no one improves it.

No quality control of outputs: an agent can carry out a wrong operation in a convincing form. It needs a review of its actions and a boundary of matters it does not handle on its own.

Uniform oversight of all agents: according to Gartner, applying the same rules to a suggesting agent and an agent executing high-impact operations leads to deployment failure. Oversight has to be differentiated by the impact an agent can cause.

Key takeaways

Companies are moving from building single agents to governing a fleet, and with that comes a new control layer: agent identity, access, an audit trail, and oversight matched to the impact of actions. Microsoft made a separate tool available for this at 15 USD per user per month, and KPMG extended it to more than 276,000 staff, which shows the market now treats governing agents as a distinct problem. For a company, the order is simple: first an agent registry, owners, and least-privilege access, then an activity record and oversight differentiated by risk. Start by listing what actually runs, not by launching another agent without control.