Your AI agent is a brilliant five-year-old: taming agent sprawl, from CDAIO NZ

Think back to being a first-time parent, Paul Sadler asked the room. Remember how unpredictable it was, how fast it changed, and that there was no handbook. You did what seemed best and stayed in protective mode. Now picture an energetic, full-of-beans four or five year old, always learning. That, he said, is an AI agent.

Sadler, Client Director at FIRN, gave the afternoon session “From Proliferation to Control: Managing ‘Agent Sprawl’ in the Enterprise AI Era” at CDAIO New Zealand on 19 October. His message was reassuring and uncomfortable in equal measure. We have been here before, twice. And this time the child does not get tired.

The technology, he said, is only four or five years old. It is incredibly intelligent. And most of all, it is superhumanly persistent: it does not stop when the sugar runs out. It keeps going on the mission it has been set.

TL;DR

• Agent sprawl is the third run of a familiar cycle: public cloud accounts around 2010, APIs around 2017 and 2018, and now AI agents. Each time, adoption raced ahead and governance, security and best practice had to catch up.
• We already know how to manage powerful actors: identity, least privilege, audit logs of activity and contained boundaries. The task is to apply them to agents.
• Sadler described four stages of AI governance maturity: Unaware (2023 to 2024), Visible (2024 to 2025), Controlled (2026) and Optimised. In his observation, most New Zealand enterprises are in stage two, with leading organisations moving into stage three.
• Organisations running agents in production are asking four questions: who owns the work, how does it stay in control, how is it coordinated, and how trustworthy is the underlying data?
• The emerging answer is four layers: organisation, operations and control, orchestration, and a shared context foundation of structured, trusted data.
• Operating models are moving from teams doing their own thing, through centres of excellence and federated models built on reusable services, to end-to-end value-stream ownership, the hardest and slowest to build.

We have seen this before

Sadler opened with history, because the pattern repeats. A disruptive technology arrives. It is adopted quickly. Use spreads, uncontrolled. Then something surfaces in production, there are business impacts, and someone gets a bill shock. Governance, security and best practice are left to catch up.

In 2010, when public cloud arrived, enterprises saw a huge proliferation of accounts being spun up. Around 2017 and 2018 it was APIs, driven by microservices and containerisation. Now it is AI and agents, and because the technology is changing so fast, governance has never had a harder curve to follow.

The good news, he said, is that the lessons are already learned. Organisations know how to manage powerful actors inside and across the enterprise, with established practices refined over decades: identity, least privilege, logs and audit of activity, and work contained within a boundary. And the market is moving faster this time. Best practice for cloud landing zones arrived around June 2018, years after public cloud took off. For agents, structure is arriving within a couple of years.

Four stages of maturity

From what he sees across the market, Sadler described four stages.

• Unaware, 2023 to 2024. Generative AI arrived and people used it, but there was no systematic understanding of what AI was running. Organisations started to mobilise.
• Visible, 2024 to 2025. Discovery has happened. There is an inventory, and controls are in place, but they are thin beyond the approved stack. The gap is real.
• Controlled, 2026. Policy is operational across the full inventory, enforcement is real time and audit trails exist.
• Optimised. AI governance becomes a competitive advantage, and control and innovation are no longer in tension.

His slide was clear that this is a presenter’s observation rather than a measured benchmark: most New Zealand enterprises are in stage two, with leading organisations moving into stage three, and maturity is uneven. Typically one or two business processes are controlled while many others are not yet.

What is pushing organisations towards control, he said, is that over the last 15 months or so agents have moved into production, delivering whole business processes. There have been some really good stories, including several heard earlier in the day, of processes that once took days now running far faster. That takes a lot of control and a lot of governance, and the risks have raised harder questions.

Four questions, four layers

Organisations running agents in production are now asking four tough questions. Who owns the work? How does it stay in control? How is it coordinated? And how trustworthy is the underlying data?

The answer emerging across the market, he said, is four layers, each answering one question.

• Organisation. Who owns outcomes and decisions? It starts with the business owner, the ultimate owner of the work.
• Operations and control. How do agents enter service, stay safe and retire? Agents are registered, evaluated, monitored and retired as a managed life cycle.
• Orchestration. How does work pass between people, agents and systems? This layer has grown in importance as more agents work together in a process, with handoffs, validation and exceptions reviewed by people.
• Context foundation. What information and meaning can the work rely on? Shared meaning, provenance, freshness and access, built on structured, trusted, contextualised data.

If trusted data foundations are not in place, and constantly maintained, everything above it is compromised, and that tireless five-year-old will keep running and producing rubbish.

From teams to value streams

Sadler then walked through the operating models organisations have used for AI, in roughly the order they appeared.

The first was generative AI inside a team or department, with no visibility across the organisation. When the stakes were low that was acceptable. It is the oldest model, and it is dying.

The second was the centre of excellence, which worked well when organisations needed to drive adoption. The business brought a use case and described what it wanted to achieve, and the centre did the design, the testing and the rest.

The third, and the fastest growing, is federated. Business units define what they need and supply the context, the business logic and the data. A central team keeps control: the registries, the testing and the guardrails. The key to this model, he said, is that it spreads accountability across all teams while driving reusable services. The more a central data services team can document, prove and offer trusted, reusable services, the faster teams reach production, because they stop reinventing the wheel.

The fourth is emerging: end-to-end value-stream ownership. It is the hardest to implement and the slowest to make live, because it needs cross-functional teams working together on a process that runs through many steps and hands off between business units. It means going deep on what information an agent needs to complete its part of the job and hand over. One owner is accountable for the whole value chain that delivers a product or service to the customer, the teams beneath work with each other, and trusted data sits underneath it all.

Three non-negotiables

Organisations have stood up new roles to run all of this, from AI operations and centres of excellence to AI security. Whatever the role, Sadler said, three requirements apply.

• Authority. Approve the authority an agent carries, and make sure its permissions are appropriate for the task it is doing.
• Consequences. Understand, in explicit detail, what happens if things go wrong, and what you should expect to see even when they go right.
• Visibility. Make sure every agent is monitored, managed and reportable through its life.

What comes next

Sadler closed with predictions, from what he is seeing across New Zealand.

AI agent security will become standard. Organisations are starting to look at AI gateways and at managing and securing MCP servers, to see and control what flows in and out of the organisation, and to have one central place where they can stop things.

Governance, governance, governance. AI is the first technology in a long time that is pulling business and technology to work closely together. Governance decisions, accountability and responsibility will no longer sit only with executives. They will reach every team that uses or relies on agents.

Mechanised business processes. Organisations will take a risk-based approach to processes and mechanise them: discover, rebuild, test and automate. Change the variables, test again, and run it. That reduces risk and cost, including token usage.

A deeper, explicit context layer. The four or five year old needs specific instructions.

"What to do, what not to do. No room for interpretation."

Redefined trust architectures. He pointed to recent commentary arguing that too much trust has been placed in models themselves. Permissions must be enforced outside the model, with audited activity records the agent cannot alter, verification that is independent, and humans able to stop whatever is running. Observe behaviour, test limits, contain actions.

What it means

Agent sprawl is not a new problem, and that is the good news in Sadler’s talk. The tools for managing powerful actors exist. What is new is that the actor never tires, and that every team, not only the executive, now has to govern it. Know which agents are running and who owns them, give them a foundation of trusted context, and decide who owns the whole value stream before the five-year-old decides for you.