Find every agent your business units already shipped, right-size its permissions, and put a control plane around the ones that stay.
Most large organizations in 2026 do not have an agent adoption problem. They have an agent inventory problem. Industry reporting through mid-2026 put roughly two-thirds of agents in the hands of GTM, customer success, and operations teams rather than engineering, with a large majority found to be over-permissioned — built by people who were never given a provisioning discipline because nobody expected them to be building anything. Enterprises now commonly run something close to one agent, live or draft, per employee. Traditional security tooling is blind to this, because the risk is not a vulnerable dependency; it is a correctly-functioning agent with far more access than its job requires, invoked by a prompt someone else controls. This workflow is the program that closes that gap without becoming the department that says no.
You cannot write policy for a population you have not counted. Enumerate agents across every surface they get built on: Copilot Studio, Agentforce, Power Automate, the low-code platforms, custom deployments, and browser extensions on endpoints. Agent security posture tools (Zenity is the reference product) do this continuously; a one-off manual census is a legitimate starting point but decays within a quarter. Expect the first count to be three to five times the number anyone predicted.
The instinct is to triage by who built it. The right axis is what it can reach. Tier 1: reads and writes customer-facing or regulated data, or can move money. Tier 2: reads internal sensitive data, writes to internal systems. Tier 3: reads public or low-sensitivity data, no writes. A marketing agent that can email your entire customer list is Tier 1 regardless of how casually it was built.
For a sample of 20 agents across tiers, compare granted permissions against the permissions the agent's actual task requires. This number is your business case — it converts an abstract risk into "31 of our agents can read HR records and 3 of them need to." Bring that to the steering committee rather than a framework diagram.
Write the minimum viable policy: every agent has a named owner, a stated purpose, a data classification, an access scope, and a review date. Tier 1 agents additionally require human-in-the-loop on any write or outbound action, logged prompts and tool calls, and a documented rollback. Publish it as a paved road with templates — a policy that makes compliance harder than non-compliance produces shadow agents, which is the problem you started with.
Design-time review catches the agent that was submitted. Runtime controls catch the one that was not, and the one whose behavior drifted after a prompt change. Enforce identity scoping so agents act with least-privilege delegated credentials rather than a shared service account, and monitor for the three real attack vectors: external prompt manipulation, internal over-permissioning, and agents discovering unintended access paths.
The governance program lives or dies here. Tier 3 agents self-register and go. Tier 2 gets a 48-hour review against a checklist. Tier 1 goes to the review board. If your Tier 3 path takes two weeks, your builders will route around you and your inventory will be wrong again within a quarter.
Track four: total agents discovered, percentage with a named owner, percentage over-permissioned against task requirement, and mean time from registration to approval. The last one is the metric that proves you are an enabler rather than a bottleneck, and it is the one that keeps the program funded.
Use these templates as-is or customize for your business.
AGENT NAME: OWNER (named individual, not a team): BUSINESS PURPOSE (one sentence): PLATFORM: (Copilot Studio / Agentforce / custom / other) TIER: (1 / 2 / 3 — by blast radius) DATA CLASSIFICATION ACCESSED: (public / internal / confidential / regulated) SYSTEMS READ: SYSTEMS WRITTEN: CAN IT INITIATE AN OUTBOUND ACTION? (email, message, payment, API call to a third party) IDENTITY USED: (delegated user identity / dedicated service principal / shared account — shared is an automatic finding) HUMAN-IN-THE-LOOP ON WRITES? (required for Tier 1) PROMPT AND TOOL-CALL LOGGING ENABLED? ROLLBACK PROCEDURE: REVIEW DATE: (max 6 months for Tier 1, 12 for Tier 2)
For each sampled agent: Agent | Tier | Permissions GRANTED | Permissions REQUIRED by task | Delta | Risk if exploited ------|------|---------------------|------------------------------|-------|------------------ ROLL UP TO THREE NUMBERS FOR LEADERSHIP: - X of Y sampled agents hold permissions beyond their task requirement (__%) - X agents can read [regulated data type]; only X require it - X agents can take an irreversible action (send, pay, delete) without human approval This table is the entire funding argument. A framework diagram is not.
TIER 3 — reads public/low-sensitivity data, no writes, no outbound actions
-> Self-register in the catalog. Live immediately. Audited quarterly by sample.
TIER 2 — reads internal sensitive data OR writes to internal systems
-> Submit registration record. 48-hour review against the standard checklist.
Named owner and logging required. No review board.
TIER 1 — touches customer-facing or regulated data, moves money, or takes
irreversible outbound actions
-> Review board. Human-in-the-loop required on every write or outbound
action. Full prompt and tool-call logging. Documented rollback.
Six-month re-review.
SERVICE COMMITMENT: Tier 2 decisions in 48 hours. If we miss it, the agent
proceeds under Tier 3 controls and we fix our process. We hold ourselves to
the SLA because a slow paved road is how shadow agents get built.Get a new AI workflow every week. Prompts, tool stacks, and ROI math included.
AI does the categorization or first-draft work, a human approves before action is taken. The pattern of choice for anything irreversible, externally visible, or financially sensitive.
Learn the agentic glossary →Where this workflow tends to break in production — and what to put in place before you ship it.
Inventory is accurate at launch and stale within a quarter
Mitigation: Continuous discovery tooling rather than a one-off census; self-registration as a condition of platform access.
Governance becomes a bottleneck and builders route around it
Mitigation: Published 48-hour Tier 2 SLA with an explicit fallback if missed; mean-time-to-approval tracked as a program metric.
Agents run on shared service accounts, making attribution impossible
Mitigation: Shared-account usage is an automatic finding at registration; enforce delegated least-privilege identity.
Design-time review passes but runtime behavior drifts after a prompt change
Mitigation: Runtime monitoring on agent intent and execution path; re-review triggered by prompt or tool-scope changes, not only by calendar.
Skip the tooling if you have fewer than a few dozen agents — a maintained spreadsheet and a named owner per agent genuinely covers you at that scale, and buying a posture platform early spends budget you will want later. Skip the full program if agent building is still confined to one engineering team under existing SDLC controls; extend that process rather than building a parallel one. And do not launch this as a restriction program: a governance function that only says no produces shadow agents faster than it discovers them, which leaves you worse off than when you started.
A phased approach to get this workflow running and delivering ROI.
Days 1–30
Foundation
Days 31–60
Optimization
Days 61–90
Scale
Most enterprises do not have an AI adoption problem. They have an AI inventory problem — and the first honest count is usually three to five times what anyone predicted.
The general-purpose voice agent and the trades-specific one cost about the same. One of them books more jobs. The difference is not model quality — it is everything around the model.
Four vendors, four incompatible pricing models, and one arithmetic trap that doubles your bill without anyone telling you.
One practical AI workflow per week. No fluff.
Get the full guide with step-by-step setup, workflow templates, and copy-paste assets.