Between August 20 and September 1, 2026, six publishers who do not cite each other reached the same finding: enterprises deploy agents faster than they can authorize and audit them, and the platform vendors have now written down that authorization per action is the customer's job. I read each at the source and kept only figures I could verify there. Two of the sources are vendor sponsored, one is a self reported survey and one is telemetry from a single platform's customers.

Four documents, one gap

The survey. EMA for Cequence Security, Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise, August 31, 2026: 202 IT and security leaders at organizations with 1,000 or more employees.

The telemetry. Reco, The State of Agent Security 2026, August 26, 2026: telemetry from 62 large enterprises, January 1 to August 1, 2026, plus 500 published MCP servers on npm and NVD data to June 2026.

The vendor's position. Microsoft, AI agent shared responsibility model, August 26, 2026.

The adoption curve. McKinsey, The State of AI in 2026, August 25, 2026, 1,719 respondents, cited through The Register because the primary would not load for me.

Two more bracket the week: the UK NCSC's Managing the cyber risk of agentic AI (August 20) and OWASP's 2026 Top 10 for LLM Applications with a new Agent Control Standard (September 1).

The numbers

Adoption. 40% of McKinsey respondents at organizations above 1 billion dollars in revenue are scaling AI agents, up from 27% a year earlier.

Out of scope actions. 65% have had an agent act outside its intended scope, 29% with measurable business impact. 32% contained it within minutes; 54.5% needed hours and manual intervention.

Authorization at the moment of action. 34% evaluate an agent's authorization at the moment it attempts a specific action.

Confidence versus practice. 94% are confident their agents have no more access than they need. 33% provision least privilege.

Audit and inventory. 46% could not produce a complete audit trail of agent activity over 30 days. 47% lacked a reliable agent inventory.

The MCP surface. Of 500 MCP servers on npm, 62% combine local file read with outbound network connectivity; half can run shell commands, more than eight in ten read or write local files and roughly three quarters make outbound calls. Four in five AI tools in Reco's telemetry run outside IT oversight.

The vulnerability rate. Reco tracks 637 vulnerabilities across agent and LLM tooling, 525 disclosed in the past 18 months, at least 111 critical. The monthly rate went from fewer than five in 2023 and 2024 to roughly 29 since January 2025, the pattern we see in the CVE record.

governance gap · ledgeraug 2026
1scaling agents (>$1B rev)   40% was 27% · McKinsey n=1,719
2agent acted out of scope    65% 29% w/ impact · EMA n=202
3authz checked per action    34% EMA
4confident no excess access  94% vs least privilege 33%
5no 30 day audit trail      46% no agent inventory 47%
6AI tools w/o IT oversight   4 in 5 Reco · 62 enterprises
7mcp: file read + network    62% of 500 on npm · shell 50%
8agent tooling CVEs         ~29/mo since Jan 2025 · was <5
Eight numbers, four sources. Lines 2 to 5 are self reported by 202 leaders in a vendor sponsored survey; 6 to 8 are one platform's telemetry. Neither is the population. Both point the same way.

What the vendors now say

Read Microsoft's model as a requirements list. Regardless of deployment model the customer retains "Authorization of actions: what the agent is allowed to do, especially irreversible or sensitive operations." The tools and actions layer asks for least privilege per tool, "Authorization on every action, not only at session start," approval gates for irreversible actions, sandboxing with egress control and "Action auditing. Log every tool invocation with inputs, outputs, the identity used, and the decision rationale." The page closes: "Autonomy never reduces accountability."

The NCSC says it in plainer English: "humans approve actions before they happen," every agent gets its own unique identity, the network is deny by default with allowlists, "logs should be immutable so you can trust them during an investigation" and you should always be able to "pull the plug."

OWASP's 2026 Top 10 is the first edition weighed against real incident data, and the risk where the ranking and the record agree most clearly is Excessive Agency, at number three. The Agent Control Standard donated the same day extends the project's work "toward practical runtime enforcement."

A cloud vendor, a national security agency and a standards body now name the same controls. Set them next to the survey: per action authorization, 34%; least privilege per tool, 33%; unique agent identities enforced, 54.5%; a complete 30 day trail, missing at 46%.

"The gap is between what's written down and what's enforced when an agent takes an action nobody approved." Christopher M. Steffen, VP of Research at EMA

Where the gap actually is

Written versus enforced. Steffen's own reading is that the gap "isn't a lack of awareness; most organizations have policies in place and express real confidence in them." A policy document does not stop a tool call. Something in the execution path has to read the policy and decide, and in two thirds of these organizations nothing does.

Session start versus each action. Microsoft's instruction to recheck "that this action, on this resource, is permitted" describes a control 34% have. The rest trust a decision made before the agent read the document, tool output or other agent's message that changed its plan. That interval is where injection lives, which is why authorization at the boundary is the control that does not depend on the attack.

Confidence versus evidence. 94% are confident about access that 33% enforce, where 47% cannot enumerate their agents and 46% cannot reconstruct 30 days of activity. Confidence about access you cannot list, against a trail you cannot produce, is a belief, not a finding. When 62% of servers can read files and reach the network, an out of scope action is a potential exfiltration path, and "what did it touch" needs evidence, not memory.

What this means for defenders

  1. Inventory agents as capabilities, not names. 47% have no reliable inventory. For every agent, list the servers, skills and tools it can reach and what each can do: files, shell, network, credentials.
  2. Move the authorization check to the moment of action. 34% do this. Policy consulted only at deployment or session start is a document. Evaluate it deterministically per tool call, in the execution path, deny by default.
  3. Measure least privilege instead of surveying it. 94% versus 33% is the cost of asking. Give every agent its own identity, diff the scopes it holds against the scopes it used in the last 30 days and revoke the difference.
  4. Keep a per call record you can produce for any 30 day window. 46% cannot. Microsoft's fields are the floor: inputs, outputs, identity used, decision rationale, plus the policy version in force. Immutable and verifiable against the policy, not just stored.
  5. Treat MCP servers and skills as suppliers with a disclosure rate. Roughly 29 vulnerabilities a month and 62% of published servers with a file to network path make the approved list a living document. Pin by content, grade before first use, review again on change.

This is the shape of what we build. Oktsec Control approves or blocks each agent action against signed deterministic policy before it runs and keeps hash chained evidence you can verify offline; Oktsec Signal grades MCP servers, skills and packages with deterministic rules and grades them again when they change.

Six documents agree on the requirement and one survey measures the distance to it. Closing it is engineering, not policy, and the numbers say most organizations have not started.

Sources