The AI agent governance gap: what 700 enterprises believe vs. what they can actually do
Enterprise confidence in AI agent governance runs 33 to 55 percentage points ahead of the controls that would justify it. In the State of Agent DLC 2026 report published by Harness on 10 September 2026, 77% of 700 technology professionals said they held a complete inventory of every agent they run — and 44% ran any active discovery tooling to find out (independently reported, read September 2026). Every other control Harness tested showed the same shape.
TL;DR
- Harness surveyed 700 technology professionals at enterprises with 1,000+ employees and $100M+ revenue across the US, UK, France, Germany and India, fielded by Sapio Research in July 2026.
- Confidence clusters at 74–77% across all five governance domains Harness tested. The matching controls sit between 19% and 44%.
- 76% believe they could disable a misbehaving agent in under 15 minutes. 33% have an instant kill switch.
- 75% say their agents are secure end to end. 88% of that group reported a security incident anyway — slightly worse than the 87% overall rate.
- The fix is not more confidence. It is six specific controls: discovery-built inventory, a reachable kill switch, per-conversation evaluation, blocking release gates, per-agent spend and action telemetry, and a named incident path.
This article covers the controls side of AI agent governance. For what to log and report when an agent goes wrong, see AI incident reporting in customer service. For the operator's view of a hybrid AI workforce, see AI Manager.
What is the AI agent control gap?
The AI agent control gap is the distance between what an organisation believes it can do to an agent in production and what it has actually built the mechanism to do. It shows up as a pair of numbers: a high confidence figure and a much lower capability figure measuring the same thing. Harness measured five such pairs across 700 respondents in September 2026, and confidence won every one.
The gap matters because belief is what gets an agent approved for production, and mechanism is what saves you at 4:58pm on a Friday. A quarterly risk review signs off on the first. Only the second answers a customer whose refund an agent just processed twice.
Where does confidence break from control? The six pairs
Across the five governance domains Harness tested for confidence, belief sat between 74% and 77% while the matching control sat between 19% and 44%. The table below reproduces each pair as published, plus a sixth row on change-control process. Every row is independently reported survey data from the Harness State of Agent DLC 2026 report, n=700, read September 2026.
| Domain | What leaders believe | What they have built | Gap |
|---|---|---|---|
| Agent inventory | 77% are confident they hold a complete inventory of every agent | 44% run active discovery tooling | 33 pts |
| Kill switch | 76% believe they could disable a misbehaving agent in under 15 minutes | 33% have an instant kill switch | 43 pts |
| Release testing | 74% are confident testing would catch production-impacting failures | 19% have automatic gates that block a bad release | 55 pts |
| Spend control | 74% report complete visibility into spend per agent | 60% overran their agent budget last quarter | belief vs. outcome |
| Security | 75% say their agents are secure end to end | 88% of that same group reported a security incident (87% overall) | belief inverted |
| Change control | 53% route agent changes through standard pipelines | more than 40% of teams pushing agent changes have no fixed promotion standard | process gap |
Two figures set the context. Only 23% of these organisations run a dedicated AI-agent security layer in production, and 58% report more production incidents per 100 changes since deploying agents, against 25% reporting fewer (independently reported, Harness blog, read September 2026). Confidence is remarkably stable at 74–77% no matter which domain you ask about, which is itself the tell: that is not six independent assessments, it is one disposition answering six questions.
What is an agent control plane?
An agent control plane is the layer that sits outside your AI agents and holds the authority to see, constrain, pause, and stop them — independently of the agents themselves. It maintains the inventory of every running agent, the permissions each one holds, the actions each is allowed to take, the telemetry of what each actually did, and the enforcement point where a human can halt work in progress. It is a control plane precisely because an agent cannot modify it, disable it, or route around it.
Three properties distinguish a control plane from a dashboard. It is authoritative — the inventory is built by discovery, not self-declaration. It is enforcing — a policy in it changes agent behaviour at runtime rather than describing intended behaviour. And it is out of band — it keeps working when the agent stack is the thing that has gone wrong.
That last property is the one most often missed. As the security firm AccuKnox puts it in its analysis of agentic containment: if your AI agent can reach the kill switch, you do not have one. You have a suggestion.
What should an agent inventory for a support stack contain?
An agent inventory should record, for every agent running against your helpdesk, nine fields: agent ID, business owner, the channels and queues it serves, the systems and tools it can call, the write actions it is permitted, the data classes it can read, the model and prompt version currently deployed, the date of its last evaluation, and its escalation path. Anything less is a list of names, and a list of names is why 77% feel covered while 44% actually look.
The write-actions field is the one that decides blast radius. An agent that can read order history is an information risk; an agent that can issue a refund, cancel a subscription, change a shipping address, or email a customer is an operational one. Those belong in separate rows with separate approvals.
Build the inventory from discovery, not from a survey of your own teams. OWASP's Top 10 for Agentic Applications 2026 (published December 2025) lists ASI03 Identity & Privilege Abuse and ASI10 Rogue Agents among its ten risks — both of which describe agents your registry does not know about, or knows about inaccurately. Aissist.io's AI Manager exists to hold exactly this view across a hybrid human-and-AI workforce.
What does a real AI agent kill switch look like mid-resolution?
A real AI agent kill switch stops the agent from taking further action within seconds, lands every in-flight conversation in a human queue with its full context, and does all of it from a control point the agent cannot reach. Redeploying a service is not a kill switch. Revoking an API key is not a kill switch if it takes a ticket to your platform team. The test is whether a support lead can do it, alone, during an incident.
Six properties separate a working switch from a claimed one:
| Property | What "real" looks like | What fails |
|---|---|---|
| Latency | Enforced at the gateway; effective in seconds | Requires a redeploy or a platform-team ticket |
| Scope | Per-agent, per-queue, per-channel, and per-action-class | Global on/off only |
| Granularity | Degraded mode: reads allowed, writes blocked | Binary — all or nothing |
| In-flight handling | Open conversations hand off to a human with full transcript and context | Sessions drop; customer sees silence |
| Reachability | Control point sits outside the agent's own execution path | Agent, or its orchestrator, can disable the switch |
| Auditability | Records who flipped it, when, what was in flight, what resumed | No record; no post-incident reconstruction |
The "safe state" language is not ours. Article 14(4)(e) of the EU AI Act requires that a human overseer can "interrupt the system through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state," with high-risk obligations under Annex III applying from 2 December 2027. For a support agent, a halt in a safe state means the customer reaches a person — not that the agent vanishes mid-refund.
Which six controls close the AI agent governance gap?
Six controls close the six gaps in the table above — one each for inventory, stopping, evaluation, release gating, spend, and incident response. Each one is verifiable: you can ask for a demonstration rather than an assurance.
- Discovery-built agent inventory. Instrument the helpdesk and the integration layer so every agent that touches a ticket appears automatically, with the nine fields above. Target: inventory refreshed continuously, not quarterly.
- An out-of-band kill switch. Scoped per agent, per queue, and per action class, effective in seconds, with in-flight handoff to a human queue. Target: a support lead can trigger it without engineering.
- Evaluation on every conversation, not a sample. Aissist.io reports that traditional manual QA reviews 1–2% of interactions, leaving roughly 98% unexamined, and scores 100% of conversations instead (vendor-claimed, Evaluable AI, read September 2026). A 2% sample cannot tell you whether a prompt change broke anything.
- Blocking gates on prompt and configuration changes. Only 19% of Harness respondents have gates that actually block a bad release. A gate that warns is a log entry with ambition.
- Per-agent spend and action telemetry. Cost per resolution, actions taken per class, escalation rate, and an alert threshold on each. Harness found 74% claim this visibility while 60% overran budget last quarter — which is either a visibility problem or a very fast-moving dashboard.
- A named incident path with clocks. An owner, a log of what the agent saw and did, and the notification deadlines that apply — GDPR's 72-hour breach window reaches support teams whether or not the EU AI Act's high-risk rules do. Our AI incident reporting guide for customer service sets out the thresholds and the order of notification.
Sequence them by blast radius, not by effort. If your agents can take write actions — refunds, cancellations, account changes — build controls 1 and 2 first, because an agent you cannot find is one you cannot stop. If your agents are read-only today but a write integration is on the roadmap, build control 3 first: you will need a behavioural baseline from before the change, and you cannot collect one retrospectively. If you are running a pilot with a single agent on a single queue, control 6 is still not optional — the notification clock starts whether or not the deployment was a pilot.
What should you ask an AI vendor about agent governance?
Ask for eight things in writing, and treat a demonstration as the only acceptable answer to the first four. Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, and estimates only about 130 of the thousands of self-described agentic vendors are genuinely agentic — the rest it calls "agent washing" (independently reported, read September 2026). The questions below separate the two groups quickly.
- Show me the kill switch. Who on my team can trigger it, and what happens to a conversation that is mid-resolution when they do?
- What scope can I stop — one agent, one queue, one action class, or only everything?
- What percentage of conversations do you evaluate, and against what criteria? Show me a scored transcript.
- Where is the audit trail of every action an agent took, and how long is it retained?
- What write actions can the agent perform without a human, and how do I change that list myself?
- What is your notification commitment when your system causes an incident on my tenant — in hours, in the contract?
- What certifications do you hold, and can I see the current reports? (Aissist.io publishes ISO 27001, GDPR and SOC 2 alignment, AES-256 at rest and TLS 1.2+ in transit on its security page, vendor-claimed, read September 2026.)
- What does your agent do when it does not know? Escalation behaviour is a governance control, not a UX detail.
Bias declared up front: Aissist.io sells an AI operational layer, so we have an obvious interest in buyers asking these questions. Ask them of us too.
Why is governing AI agents different from governing software?
AI agents need runtime controls rather than release-time controls because the same agent, given the same input, can produce a different action on a different run. Deterministic software is governed by testing it once and trusting the build. An agent has to be watched while it works, because the behaviour you approved in staging is a sample, not a guarantee.
Keith Mann, Field CTO and Head of Research at Harness, put the mechanism plainly:
"An AI agent is not deterministic. The same agent, given the same input, can behave differently from one run to the next."
— Keith Mann, Field CTO & Head of Research, Harness, The AI agent confidence gap, September 2026
He also named why the usual reassurance does not apply here:
"Cloud and mobile both went through a phase where confidence outran governance, but eventually the controls caught up because the underlying systems stayed predictable once you built the guardrail. Agents don't hold still in the same way."
— Keith Mann, quoted in the Harness press release, 10 September 2026
Variability also sets the floor on accuracy. Aissist.io's Reliable AI analysis puts hallucination rates at roughly 3% for the best models, 6–15% for flagship models, and past 20% for reasoning-heavy models on grounded summarisation (vendor-claimed, citing published evaluations, read September 2026). At a few thousand tickets a month, a 3% floor is not a rounding error — it is the reason escalation and evaluation are controls rather than features.
Key takeaways
Enterprise AI agent governance in 2026 is confident and under-built: 74–77% belief against 19–44% capability across every domain Harness tested with 700 respondents. The two numbers that matter most to a support organisation are the kill switch pair — 76% against 33% — and the security pair, where 88% of the organisations most confident in their agents had an incident anyway.
Close the gap with mechanism, not assurance. Build the inventory by discovery, put the stop control outside the agent's reach, evaluate every conversation rather than a 2% sample, and write the incident clock into the contract. Then ask your vendor to demonstrate each one — including us.
Frequently asked questions
What is AI agent governance?
AI agent governance is the set of controls that let an organisation see, constrain, evaluate, and stop AI agents running in production — inventory, permissions, runtime telemetry, evaluation, release gating, kill-switch capability, and incident reporting. AI policy states intent; governance enforces it.
What is an AI agent kill switch?
An AI agent kill switch halts an agent's actions within seconds, from a control point the agent cannot reach, scoped to one agent, queue, or action class, and hands in-flight work to a human with full context. Harness found 76% believe they have this; 33% do.
How many enterprises can actually shut down an AI agent quickly?
33% of the 700 enterprises Harness surveyed in July 2026 have an instant kill switch, against 76% who believe they could disable a misbehaving agent within 15 minutes — a 43-point gap, the second largest of the six domains tested.
What should an AI agent inventory include?
Agent ID, business owner, channels and queues served, systems and tools callable, permitted write actions, readable data classes, current model and prompt version, date of last evaluation, and escalation path. Build it from automated discovery, not from a team survey.
Does the EU AI Act require a stop button for AI agents?
Article 14(4)(e) of the EU AI Act requires that human overseers of high-risk AI systems can interrupt the system through a stop button or similar procedure bringing it "to a halt in a safe state." Annex III obligations apply from 2 December 2027.
Are AI agents in customer service classified as high-risk under the EU AI Act?
Most customer service agents fall outside the EU AI Act's high-risk categories, so Article 14's oversight duties do not usually bind them directly. GDPR still applies in full, including its 72-hour personal data breach notification window, which reaches support teams regardless of AI classification.
Why do most AI agent security incidents happen at confident organisations?
Harness found 88% of the organisations claiming end-to-end agent security had experienced a security incident, versus 87% overall — confidence correlated with nothing. Only 23% of respondents run a dedicated AI-agent security layer in production, which is the control that would distinguish the two groups.
What percentage of AI conversations should be evaluated?
All of them. Manual QA typically reviews 1–2% of interactions, leaving roughly 98% unexamined (vendor-claimed, Aissist.io Evaluable AI, read September 2026). Because agents are non-deterministic, a 2% sample cannot establish whether a prompt or model change degraded behaviour across the remaining volume.
How do you budget for AI agents when spend is per-action?
Track cost per resolution, actions taken per class, and escalation rate for each agent, with an alert threshold on all three. Harness found 74% of enterprises claim complete per-agent spend visibility while 60% overran their agent budget last quarter.
Every control in this article is one you can ask a vendor to demonstrate. Aissist.io runs evaluation on 100% of conversations, scoped stop controls, and full action-level audit trails on the helpdesk you already use. Book a consultation →
Sources
- Harness, The State of Agent DLC 2026 — 700 technology professionals, US/UK/France/Germany/India, 1,000+ employees and $100M+ revenue, fielded by Sapio Research July 2026, published 10 September 2026. Read 14 September 2026.
- Harness, Organizations are confident their agents are behaving. But they can't check. Read 14 September 2026.
- PR Newswire, New Harness Report Reveals Enterprise Confidence in AI Agents Isn't Backed by Real Controls, 10 September 2026. Read 14 September 2026.
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. Read 14 September 2026.
- European Union, AI Act Article 14 — Human Oversight. Read 14 September 2026.
- OWASP GenAI Security Project, Top 10 for Agentic Applications 2026, published December 2025. Read 14 September 2026.
- AccuKnox, If your AI agent can reach the AI kill switch, you don't have one. Read 14 September 2026.
- Aissist.io, Evaluable AI, Reliable AI, Security & Compliance. Read 14 September 2026.
Changelog
- 14 September 2026 — Published. All figures verified against primary sources on this date.
