Enterprise AI Governance: How to Control Agent and Tool Sprawl

Enterprise AI governance is the set of policies, controls and records that decide who in a company can use which AI tools and agents, on what data, at what cost, and how you prove it. In 2026 the problem it has to solve is sprawl: agents built twice by two teams, a different AI assistant in every department, and nobody who can say what any of it costs per task.

Most governance guides start with ethics boards and model risk. Those still matter if you train models. But most enterprises buy AI rather than build it, and their problems look different: the sales team has ChatGPT Enterprise, engineering pays for Claude, the support org built six agents in a tool IT has never reviewed, and finance wants to know why the AI line doubled. This guide covers the frameworks, then the four questions buyers actually ask about agent sprawl, seat consolidation, tool sprawl and cost per task.

What is enterprise AI governance?

Enterprise AI governance is the operating model for AI across a company: the policies, the people who own them, and the technical controls that enforce them. It answers five questions for every AI tool and agent in use:

1. Who is allowed to use it, build with it or publish from it?
2. What data can it read, and does it respect the permissions on that data?
3. What can it change in other systems, and who approves those changes?
4. What does it cost, per seat and per completed task?
5. What record exists of what it did?

The gap between policy and practice is wide. IBM's 2025 Cost of a Data Breach Report found that 63% of the 600 organizations studied had no AI governance policies in place, and that a high level of shadow AI added USD 670,000 to the average breach cost (IBM, July 2025). Employees are not waiting for those policies. In Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users said they bring their own AI tools to work (Microsoft, May 2024).

Security is one part of governance, and the narrower one. If your immediate job is a vendor security review, start with enterprise AI security: what a review must check. Governance is the wider question of what the company runs, who owns it and whether it is worth the money.

Why is AI agent sprawl now the main governance problem?

Because agents multiply faster than any review process. Gartner predicts that by 2028 the average global Fortune 500 enterprise will have over 150,000 agents in use, up from fewer than 15 in 2025, and the same release reports that only 13% of organizations think they have the right AI agent governance in place (Gartner, April 2026).

Sprawl shows up in three ways:

• Duplicate agents. Two teams build a "summarize this account" agent with different prompts, different data and different answers to the same question.
• Orphaned agents. The builder changes roles and the agent keeps running on their access, posting into a shared channel.
• Unreviewed reach. An agent gets a connector to the CRM or the code repository because it was one click away, and nobody decided it should.

Blocking agents outright tends to backfire. Gartner's Max Goss put it plainly in that release: if employees cannot work in sanctioned tools, they go around the controls and use shadow AI, which carries more risk. Gartner separately predicts that over 40% of agentic AI projects will be canceled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls (Gartner, June 2025). Governance is what keeps your projects out of that 40%.

Which frameworks should an enterprise AI governance program follow?

Most programs borrow from three sources, and they do different jobs. NIST tells you how to think about risk, ISO 42001 tells you how to run it as a management system an auditor can certify, and the EU AI Act tells you what is legally required if you operate in or sell into the EU.

Sources: NIST AI RMF, NIST AI Agent Standards Initiative, ISO/IEC 42001, the European Commission's AI Act implementation timeline, which reflects the Digital Omnibus amendments that moved the high-risk dates, and Gartner.

For most companies buying AI for knowledge work, the EU AI Act duties that apply today are AI literacy for staff and transparency, not the high-risk regime. If you use AI in hiring, credit or other Annex III areas, the December 2027 date matters and your legal team should own that track.

How do you control who can create and publish AI agents?

Gartner's first two steps are the right starting point: set rules for who can build and share agents and which connectors they may use, then keep one inventory of every agent, sanctioned or not. In practice that means four controls.

1. Builder rights. Decide who may build agents at all. Many companies let anyone build for themselves and gate sharing.
2. A publishing gate. Before an agent reaches a team or the whole company, someone other than the builder reviews its data access, tools and write actions.
3. An inventory with owners. Every agent has a named owner, a purpose, the connectors it uses and a review date. Agents with no owner get retired.
4. Least-privilege connectors. An agent that summarizes meetings does not need write access to the CRM.

Microsoft is the strongest example of a central publishing gate today. Microsoft 365 admins can approve, publish, deploy, remove and block agents, and custom engine agents must be approved before they are available to the organization (Microsoft Learn). If your company runs on Microsoft 365, that admin center is the obvious control plane. See our Microsoft Copilot alternative page for where it fits and where it does not.

The catch is scope. A publishing gate in one vendor governs that vendor's agents. Agents built in your CRM, your support desk, a workflow tool and three AI assistants each live in their own console, which is how inventories end up in a spreadsheet. If you are evaluating orchestration across tools, our guide to AI agent orchestration platforms covers the options.

How do you reduce AI tool sprawl across Claude, ChatGPT, Copilot and Notion AI?

Pick a small number of sanctioned tools, give them shared company context, and retire the rest on a schedule. Tool sprawl happens because each assistant is good at something and each team bought the one that fit its work. The cost is not only licenses. Each tool holds its own copy of context, its own connectors and its own permission model, so the same question gets different answers depending on which tool a person opens.

A workable sequence:

1. Inventory every AI tool with spend, owner, seat count and active users. Expense reports and SSO logs find most of the shadow tools.
2. Separate the model from the context. Most teams do not need a different assistant; they need the same company context inside the tool they already use.
3. Choose a sanctioned set, usually one general assistant, one coding tool and the agents built into your systems of record.
4. Put company context in one governed layer that every sanctioned tool can read. That is the job of a context layer: one permission-aware source of company knowledge that any model or client can query, instead of a separate index per tool.
5. Set a retirement date for everything else and track adoption, not just licenses.

The Model Context Protocol makes step 4 practical, because one MCP server can serve the same governed context to Claude, ChatGPT, Cursor and internal agents. It also adds a new surface to govern, which MCP security covers in detail.

Should non-technical teams get individual ChatGPT or Claude seats or governed access?

Governed access, in most cases. Individual seats are fast to buy and hard to govern: each user connects their own data, admins see usage in several consoles, and the company context a sales rep or finance analyst needs (the CRM, the shared drive, last quarter's decisions) is either missing or pasted in by hand.

Governed access means employees get AI through one sanctioned workspace with:

• SSO and central user management, so leavers lose access on day one.
• Data access that inherits each person's permissions in the source tools.
• Pre-built and shared agents for common jobs, so a business user does not have to write prompts from scratch.
• A choice of models behind one interface, so you are not locked into one provider's roadmap.
• Usage and cost reporting by team.

Individual seats still make sense for a few power users who need a vendor's newest features the day they ship. The enterprise AI buyer's checklist has the questions to ask any vendor offering governed access, and our enterprise AI pricing comparison lays out how the major vendors charge.

How do you measure AI cost per task across tools?

Stop measuring cost per seat and start measuring cost per completed task. A seat price tells you what you pay for access. It says nothing about whether the account review, the ticket triage or the weekly report got done, or what it cost each time.

To get there across Glean, Copilot, ChatGPT Enterprise and the rest:

1. Define 10 to 20 recurring tasks that matter (an account brief, a support escalation summary, a pipeline review).
2. For each tool, record seat cost, usage-based charges and the token cost of agent runs, then divide by tasks completed in the period.
3. Track token use per task where you can. Agents that re-read the same documents every run burn tokens on retrieval, not on reasoning.
4. Route simple tasks to cheaper models. An LLM gateway makes model routing a policy rather than a per-team choice.

Context is the biggest lever on that number. In Coworker's own benchmark of 100 tasks comparing Claude with Coworker MCP against Claude with its native connectors, token cost per session was 89.1% lower on retrieval and context-heavy tasks with Coworker Learning enabled; across all task categories the saving was smaller (Coworker benchmarks, statistically significant benchmarks comparing Coworker MCP vs. Claude native tooling). The general point holds for any vendor: an agent that starts with organized company context spends less finding it. For the full playbook, see AI cost optimization.

What does an enterprise AI governance checklist include?

Use this as a working checklist. Each row should have an owner and a piece of evidence you could show an auditor or a board.

If you already run SOC 2, many of these controls slot into the same evidence process. Our guide to enterprise AI platforms with SOC 2 compliance covers that overlap, and enterprise AI data privacy compliance covers GDPR.

Where does a context layer fit in enterprise AI governance?

It is where the data half of governance gets enforced. Gartner's fourth step is AI information governance: control what information each agent can reach, keep it current, and stop oversharing. When every AI tool keeps its own index of company data, you have to get that right once per tool. When the tools share one context layer that carries source permissions, you get it right once.

That is the design behind Coworker. Coworker is an enterprise AI platform built on OM2, its organizational memory: a permission-aware knowledge graph built from 50+ connectors, including Salesforce, Slack, Jira, Google Drive, HubSpot and Confluence. Access policies inherited from the source tools travel with every fact, so people and agents only recall what they are already allowed to see in Salesforce, Slack, Google Drive and the other connected tools. That is a context graph used as a governance boundary as well as a retrieval system.

Three parts of it map to the sprawl problems above:

• One context, many clients. OM2 is reachable through Coworker MCP from Claude, ChatGPT, Cursor and other MCP clients, as well as Coworker's own apps. Teams keep the assistant they prefer while the company keeps one governed source of context, with no lock-in to a single model provider. MCP access is enabled per customer by an admin.
• Agents with owners and roles. Every Coworker agent has an owner and is shared person by person as a Member, who can use it, or a Manager, who can edit and share it. Only the owner or a Manager can share an agent further, and people outside the company can only ever be Members.
• Compliance basics. Coworker has SOC 2 Type II, GDPR and CASA Tier 2.

For more on how memory servers compare as a governed context source, see the best MCP memory servers.

When is Coworker the wrong choice?

If your governance program requires ISO/IEC 42001 certification from vendors today, Coworker does not have it. Glean lists ISO 42001 and ISO 27001 on its security page; see Coworker vs Glean for the rest of that comparison.

If your company runs almost entirely on Microsoft 365 and you want one admin queue that approves every agent before it reaches the organization, Microsoft's agent admin controls are built for exactly that. And if your teams only need a strong general assistant with no connected company data, a single enterprise plan from one model provider is simpler; see Coworker vs Claude and Coworker vs ChatGPT.

If you want one permission-aware context layer under the AI tools your teams already use, with agents that have owners and cost you can track per task, bring your agent inventory to a call. Book a demo.

Frequently asked questions

What is enterprise AI governance?

Enterprise AI governance is the set of policies, owners and technical controls that decide who can use which AI tools and agents, on what data, at what cost, and how the company proves it. It covers use policies, tool and agent inventories, permissions, approvals for write actions, audit trails, cost tracking and regulatory mapping.

What is AI agent sprawl?

AI agent sprawl is the uncontrolled growth of AI agents across a company: duplicate agents built by different teams, agents with no owner, and agents with more data access than they need. Gartner predicts the average global Fortune 500 enterprise will have over 150,000 agents in use by 2028.

Which framework is best for enterprise AI governance?

There is no single best one. NIST AI RMF gives a risk vocabulary (govern, map, measure, manage), ISO/IEC 42001 gives a certifiable management system, and the EU AI Act sets legal duties for companies operating in the EU. Most programs combine NIST or ISO with an EU AI Act mapping.

When do EU AI Act obligations apply?

Prohibitions and AI literacy have applied since February 2, 2025, general-purpose AI rules since August 2, 2025, and transparency rules since August 2, 2026. After the Digital Omnibus amendments, high-risk rules for Annex III systems apply from December 2, 2027, and for AI in regulated products from August 2, 2028.

How do you stop shadow AI without blocking AI?

Give people sanctioned tools that are as useful as the ones they would bring themselves, with company context already connected. Gartner warns that blocking agents pushes employees toward shadow AI. Pair that with a clear use policy, regular audits of AI spend and SSO logs, and a fast path to request a new tool.

Should we buy individual ChatGPT or Claude seats for business teams?

For most business teams, governed access through one sanctioned workspace is easier to control than individual seats: SSO, permission-aware data access, shared agents and cost reporting in one place. Keep individual seats for a small group of power users who need a vendor's newest features first.

How do you measure AI cost per task?

Pick 10 to 20 recurring tasks, add up seat costs, usage charges and agent token costs per tool, and divide by tasks completed in the period. Track tokens per task too, because agents that re-read the same documents every run spend most of their budget on retrieval.

Related reading

• Enterprise AI security: what a review must check
• What is a context layer?
• What is a context graph?
• Organizational memory (OM2)
• MCP security: the risks, and what mitigates them
• AI cost optimization
• The best MCP memory servers, compared
• The enterprise AI buyer's checklist