Picture a Tuesday afternoon at a 200-person company. An AI agent in the finance system approves and schedules a vendor payment. A different agent reads an inbound support message, decides it's a compliance matter, and routes it to legal. Both actions are correct. Both happened with no human in the loop. And if you asked, right now, who is accountable for what those agents just did — who scoped their authority, who can see what they touched, who gets the call if one of them is wrong — most companies could not answer.
That gap, not model quality, is the thing standing between "we deployed some agents" and "we get real value from agents." An API key gets an agent running. It does not make the agent governed — and ungoverned agents are how a productivity win turns into a liability.
We hired a workforce and skipped HR
The sharpest framing of this came from O'Reilly's Tyler Akidau, in an essay with a title that says the whole thing: "We All Built Agents. Nobody Built HR." His argument is that an autonomous agent is a genuinely new kind of worker, with a dangerous combination of traits:
"Agents combine the worst of both: unpredictable like humans, capable like software, but without the human judgment to question a bad plan."
Companies have spent decades building the machinery to manage imperfect humans — scoped access, approvals, monitoring, someone whose name is on the outcome. As Akidau puts it, "we never waited for perfect employees. We built systems that made imperfect ones successful." Then agents arrived, we handed them credentials, and we skipped all of that. The agent isn't the problem. The missing management layer between the agent and your data is.
The gap is real, and it's measurable
This isn't a hypothetical worry. In a May 2026 survey of 1,001 IT and security leaders across the US, UK, and Australia — conducted by Propeller Insights for the security firm DigiCert (a vendor that sells into this problem, so read the numbers with that in mind) — the findings were blunt:
- 78% of organizations had already experienced an AI-related security incident or identified an AI-related vulnerability.
- 90% said AI governance is discussed at the executive or board level — but only 57% have a dedicated budget to secure AI systems. Talk is near-universal; funded ownership is a coin flip.
- 47% admitted they cannot fully trace an AI decision back to the model and source data that produced it.
Sit with that last one. Nearly half of these organizations have deployed systems that take actions they cannot fully explain after the fact. In any other part of the business — a payment, a hiring decision, a customer commitment — "we can't reconstruct why this happened" is not an acceptable answer.
The billing gap that already cost companies billions
There's a useful historical rhyme here. A July 2026 analysis in CEOWORLD by Beeline CEO Doug Leeby (a vendor in the workforce-management space, so read it with that in mind) draws the parallel to contractor misclassification — the decades-long, multi-billion-dollar mess that came from one unresolved question: is this worker an employee or a vendor? Nobody decided, everybody guessed, and the bill came due later.
Agents are walking into the same trap. Nobody has decided whether an agent doing a worker's job should be governed like software or like a worker. So in the meantime: business units procure and deploy agents on their own, finance rarely tracks the usage-based billing, and IT holds no complete inventory of what's running or what it's authorized to touch. The company that gets ahead of this gives someone clear, named accountability for its agentic workforce — an owner, before an incident forces the question. That last part is our conclusion rather than the article's finding; what the analysis itself argues for is an agent registry and lifecycle discipline, so that when a regulator or auditor asks who authorized a given decision, there is a defensible answer.
What "managing" an agent actually means
Good news: you already know how to do this, because it's how you manage people. Translate the four things every employee has into agent terms and the whole problem gets concrete.
- A job description. A written, enforced scope: exactly what this agent may do, which systems it may touch, and — just as important — what it may never do without a human. "Answer billing questions and draft refunds under $50" is a job description. "Here's an API key, good luck" is not.
- A manager. One named human accountable for the agent's output. Not "IT owns all the agents" — the actual leader of the function the agent works in, the person who'd own the work if a human were doing it.
- Scoped, expiring access. Permissions limited to the task and short-lived, not a standing key with broad reach that lives forever in a config file. A new hire doesn't get root access on day one; neither should an agent.
- A record of everything it did. A full, tamper-resistant transcript of inputs, actions, and reasoning — captured outside the agent's own control — so when someone asks "why did it do that," there's an answer, and a precise kill switch to stop one agent without halting the business.
None of that restricts how smart the model is. It's the difference between an employee and a stranger with your passwords.
The infrastructure is arriving — which means the excuse is expiring
Until recently, some of this was genuinely hard to build. That's changing fast. The Model Context Protocol — the emerging standard for how agents connect to tools and data — shipped a major specification update on July 28, 2026 that reads like a maturation checklist: it went stateless so agents can run behind ordinary load-balanced infrastructure, hardened authorization on OAuth 2.1 and OpenID Connect, and added a formal 12-month deprecation policy so the ground stops shifting under production systems. The plumbing for governed, auditable agents is becoming real infrastructure rather than a research problem.
The tools are catching up. The organizations that win won't be the ones with the cleverest model — that, as we've argued before, is a commodity. They'll be the ones who wrapped their agents in management.
Which is the whole point of "same team"
Our tagline is more output, same team — and an AI agent is, functionally, a new member of that team. You would never drop a new hire into your finance system with no manager, no scope, and no record of their work, then act surprised when something went sideways. An agent deserves the same structure, for exactly the same reasons.
That's the part a raw API key skips and a managed deployment doesn't. When we put an agent on your phones, your inbox, or your ticket queue, the job isn't done when it answers its first call. It has a defined scope, a human owner, permissions that stop at the edges of its job, and a transcript you can read. You get the output. You don't inherit an ungoverned liability. Same team — now including the one that never sleeps, and still has a manager.
Update — August 2026: OpenAI is retiring four agent surfaces in one quarter, and none of them is a model
The argument above is that an agent breaks in ways a model swap does not fix. Here is a quarter’s worth of evidence, from one vendor, on OpenAI’s own deprecations page:
- The Assistants API is removed on 26 August 2026. Notice was given on 26 August 2025 — a full year, which is the responsible end of how this is done.
- Agent Builder shuts down on 30 November 2026. Deprecation announced 3 June; ChatKit survives.
- The
v1/promptsAPI and reusable prompt objects shut down on 30 November 2026. Prompt content has to move into application code. - The Evals dashboard and API shut down on 30 November 2026, and existing evals become read-only.
Four separate surfaces, one vendor, roughly one quarter. Not one of them is a language model. If your mental model of “keeping the agent working” is watching for a model deprecation notice, all four of these would have gone past you.
The legacy text models are retiring too — gpt-3.5-turbo-instruct, babbage-002, davinci-002 and gpt-3.5-turbo-1106 all shut down on 28 September 2026 — but those are the easy case. A model has a documented replacement and a migration guide. An endpoint going away means the shape of the call changes; an evals dashboard going read-only means the thing you measured “working” with is gone, which is worse, because you may not notice until you need it.
This is the management layer, described as a calendar. Somebody has to own that calendar. If the answer to “who is watching the deprecation pages for every vendor in our stack?” is nobody, that is not a tooling gap — it is the job this post is about, unfilled.
One practical note that cost us time and may save you some: openai.com and help.openai.com both refuse automated requests, while platform.openai.com/docs/deprecations serves fine. If you are scripting a watch on this, point it at the platform docs host.
Questions we get asked
What does it mean to 'govern' an AI agent?
Governing an AI agent means giving it the same structure you give a new employee: a defined scope of work (what it is and isn't allowed to do), a named human owner who is accountable for its output, permissions that are limited and expire, and a complete record of what it did. It is not about restricting a model's intelligence; it is about building the management layer around the agent so its actions are scoped, attributable, and reversible.
Who should own an AI agent inside a company?
A specific, named human — usually the leader of the function the agent works in, not just IT. That is our recommendation rather than a survey finding. The supporting argument comes from a July 2026 CEOWORLD analysis by Beeline CEO Doug Leeby, a vendor in the workforce-management space, which makes the case for an agent registry and lifecycle discipline now, so that when a regulator or auditor asks who authorized a given decision there is a defensible answer. The failure pattern is the opposite: business units deploy agents independently, finance doesn't track the usage-based billing, and IT holds no complete inventory of what is running or what it can touch.
What are the risks of deploying AI agents without governance?
In a May 2026 survey of 1,001 IT and security leaders conducted by Propeller Insights for DigiCert, 78% of organizations reported an AI-related security incident or vulnerability, and 47% said they could not fully trace an AI decision back to the model and source data that produced it. The concrete risks are an agent taking an action nobody authorized, no ability to reconstruct why it acted, and no single person accountable for the result — the same accountability gap that made contractor misclassification cost companies billions.
Do small and mid-sized businesses need agent governance, or is that just an enterprise problem?
Mid-market companies need it more, not less, because they have less margin to absorb a mistake. Governance for a smaller company doesn't mean a committee — it means one owner per agent, permissions scoped to the task, and a transcript you can read. That is exactly the management layer a managed deployment provides: the agent is built, scoped, monitored, and owned, so you get the output without taking on an ungoverned liability.
Related reading: what a standing key actually reaches — an autonomous agent spent four days inside Hugging Face's production systems, and the numbers make this whole argument concrete. Also From ChatGPT Chaos to Integrated AI Systems — why loose AI tools scattered across a company never change how it operates, and why the model is a commodity and the deployment is the product.
Related service: AI integration — agents that arrive with scope, ownership and a way back, built on infrastructure you own.