According to the Deloitte AI Institute 2026 State of AI Report, About 74% of companies plan to deploy agentic AI within two years. Yet only one in five (21%) report a mature model for governing autonomous agents. Executives are most concerned about data privacy and security (73%); legal, intellectual property, and regulatory compliance (50%); Closely followed by governance capabilities and oversight (46%).
Enterprises may not even realize they are treating agents in their environment as first-class citizens with the keys to the kingdom, creating blind spots and potential exposure points. What is needed is a robust control plane that observes and secures how AI agents, as well as their tools and models, operate across the enterprise.
“The control plane governs at a common, centralized level what agents can access, with what permissions, under what policies, and with what models and tools,” according to Andrew Rafella, principal of Deloitte’s cyber practice.
“Without a real control plane, you don’t really have the ability to scale agents autonomously — you just have unstructured execution, and that comes with a lot of risk,” he says. “If you can’t answer what the agent did, by whom, what data it used, under what policy—and whether you can reproduce or prevent it—then you don’t have an active control plane.”
Governance, he says, should make these answers clear, not wishful thinking. Governance is what turns AI pilots into production use cases. It’s the bridge that lets companies move from immersive experiences to secure, repeatable, enterprise-wide automation.
Without governance, agent deployments do not fail over safely. They fail unexpectedly and at scale.
This content was produced by Insights, the custom content arm of MIT Technology Review. It was not written by the MIT Technology Review editorial staff. It is researched, designed, and written by human authors, editors, analysts, and illustrators. This includes survey writing and data collection for the survey. AI tools that might have been used were limited to secondary production processes that underwent thorough human review.