Before the Agents Bring Themselves

Agent sprawl and shadow AI are outrunning enterprise governance. BYOA is the case for governing the agents you already have.

Try counting the AI agents running inside your organization right now. If the honest answer is a shrug, you have company. And that shrug is precisely the problem. Gartner expects the average global Fortune 500 enterprise to be running more than 150,000 agents by 2028, up from fewer than 15 in 2025. Set against that, only 13% of organizations believe they have the right governance for what they operate today, never mind what is arriving.

The reflex, understandably, is to clamp down: approve a short list of tools and block the rest. Gartner is blunt about why that backfires – when people can’t work inside the sanctioned set, they route around it to shadow AI, which carries far greater risk than the thing you were trying to contain. The World Economic Forum describes the same pull: unapproved tools are quick and easy, so teams quietly move sensitive work and customer data outside any trusted system. The smarter response, it argues, is to give people AI inside an environment built for trust.

Meeting the sprawl rather than outlawing it is the thinking behind Bring Your Own Agent or BYOA, one of the organizing ideas in YASH’s NEUPAC platform. Instead of forcing every team onto a single blessed agent, BYOA lets you integrate, govern, and scale the agents your teams have already built inside one platform, while pulling the shadow-AI activity nobody can see into managed, visible assets. Start with why the agents multiply at all.

Why the agents multiply, and why standardizing them backfires

Agents proliferate because they work and because they specialize. Gartner has tracked the slope: task-specific agents sat inside fewer than 5% of enterprise applications in early 2025 and are on course for roughly 40% by the end of 2026, as assistants that merely suggest give way to agents that carry tasks end-to-end. Add the wider signal – only about 17% of organizations had deployed agents when Gartner last measured, while more than 60% intend to within two years – and the trajectory is plain: most of the sprawl hasn’t happened yet.

The part leaders sometimes miss is that an agent’s value often lives in its narrowness: a yield-optimization agent tuned to one plant, a claims-triage agent shaped by one regulator’s rules. Collapse all of that into a single general-purpose agent, and you sand off the specialization that made it worth building. Forrester sees leading adopters moving the other way, abandoning isolated point tools for platforms that orchestrate many specialized agents together. The lesson we keep relearning: heterogeneity isn’t the enemy of governance. Ungoverned heterogeneity is.

BYOA changes the question from “which agent” to “whose rules”

Once you accept that teams will keep building and buying their own agents, the question stops being how to standardize the agents and becomes how to standardize the controls around them. A pattern from capital markets is instructive. IDC found financial institutions increasingly prefer platform-level governance over bolting bespoke controls onto each individual use case, because the second approach does not survive contact with hundreds of agents. The same research punctures the fantasy of hands-off autonomy: only about 4% of those institutions think agents should run fully autonomously, while more than three-quarters rate transparency as very or extremely important – roughly 88% among the most advanced firms.

BYOA is the structural answer to that preference. The agent keeps its identity and its specialization; the platform supplies the connective tissue every agent passes through, i.e., who built it, what data it may touch, which actions need a human’s sign-off, and what it costs to run. McKinsey states the principle without hedging: agents should not invent their own governance rules; they should inherit the same standards as every other system, applied automatically as autonomy rises. The platform becomes the place where those rules live.

What “Governed” looks like when it’s real

Strip away the acronym, and BYOA is a set of quiet structural controls. NEUPAC’s Govern layer bundles them: role-based access control, PII and data-privacy handling, team and user management with budget governance, and the FinOps accounting that ties an agent’s spend to a function or initiative. Underneath sits the part that makes the rest credible – governance and observability that records every agent action, decision, and policy enforcement in real time, so the audit trail is already standing by rather than reconstructed after something breaks.

That maps closely onto what the research says scaled governance should look like. Gartner’s prescription for taming sprawl begins with a centralized inventory of every agent, sanctioned and shadow alike, then clear identity, permissions, and a lifecycle that retires the redundant ones before they pile up. McKinsey frames the operating model in kindred terms: domains own day-to-day governance of their agents while central data and AI teams hold the shared platform, guardrails, and oversight – and organizations that name an explicit owner for responsible AI score markedly higher on maturity than those that leave it ambient. None of which is a brake; IDC’s read on the firms pulling ahead is that governance, done well, is what lets them deploy more agents with fewer surprises. Visibility is what makes it safe to say yes.

The best worth making

The enterprises that come out ahead won’t be the ones that picked the single best agent, nor the ones that locked agents out until the risk felt comfortable – that comfort never arrives. They’ll be the ones that let their teams keep building, keep every agent inside one governed perimeter, and could answer at any moment what each agent is doing, on whose authority, and at what cost. Done right, BYOA turns an ungoverned swarm into a managed, reusable portfolio; a model proven in one business unit travels across the group instead of being rebuilt from scratch.

If your agents are multiplying faster than your ability to see them, that’s the gap NEUPAC was built to close. See how NEUPAC governs, optimizes, and scales enterprise AI agents.