Who Approves What: Enterprise Agent Governance in 2026

The gap, measured

For most of 2025, "agent governance" was a slide in a vendor deck. In 2026 it has a number attached, and the number is bad. Gravitee's State of AI Agent Security 2026 report, published February 4 and built on a survey of 919 executives and practitioners across the US and UK, found that 88% of organizations had a confirmed or suspected AI agent security incident in the past year — while 82% of executives said their current policies protect them from unauthorized agent action. That gap between felt safety and measured incidents is the whole story.

The supporting detail is worse than the headline. Only 21% of respondents said they have runtime visibility into what their agents are actually doing once deployed. Only 21.9% treat an agent as an identity-bearing entity with its own credentials and lifecycle; 45.6% still run agents on shared API keys, which means an incident can''t be traced to a specific agent, let alone a specific approval. And 25.5% of deployed agents can create and task other agents — sub-agents spawning outside whatever review process approved the parent. VentureBeat''s coverage of the same data adds that agent fleets have roughly doubled since December 2025, while monitoring coverage and pre-deployment approval rates barely moved. Growth outran control, not the other way around.

The platforms built to close it

Two enterprise identity vendors shipped the infrastructure for an answer this year.

Microsoft''s Entra Agent ID reached general availability in April 2026, giving an AI agent the same kind of first-class object in Entra that a user or service principal gets: its own identity, its own conditional access policies, its own audit trail. It sits underneath Microsoft Agent 365, which went GA on May 1 as the management layer on top — discovery of agents running across Windows, AWS Bedrock, and Google Cloud, policy-based lifecycle controls, and network-level blocking of agent traffic that looks wrong. It''s priced at $15 per user per month standalone, or bundled into Microsoft 365 E7. New service plans for Conditional Access for Agents and ID Protection for Agents are rolling out through July and August 2026, which is the part that actually lets an admin say an agent may act from this network, at this time, with this scope, the same way conditional access already gates humans.

Okta shipped a parallel play: Okta for AI Agents went GA on April 30, 2026, adding agent discovery, ownership attribution, and least-privilege enforcement to its existing identity fabric. Alongside it, Okta has been pushing Cross App Access (XAA), an OAuth extension meant to let an agent authenticate into one app and use that identity to reach others without the app-to-app credential sharing that produces exactly the shared-API-key mess Gravitee''s survey found. XAA moved from announcement to early access in January 2026, expanded its integration list past 25 partners in June, and is due to reach Auth0 developers in early access at the end of July.

What "governed" is supposed to mean

Strip away the product names and the pitch decks converge on the same four controls, and they map directly onto how any non-human identity should be run: an agent gets registered and approved before it goes live, not after; its access gets reviewed on the same cadence a human''s would, not left to accumulate; something is watching what it does at runtime, not just what it was granted at creation; and when it''s retired, its credentials actually die instead of lingering as an unowned service account. None of that is novel identity theory — it''s the standard non-human-identity lifecycle enterprises already apply to service accounts and API keys. What''s new is that agents proliferate and act with enough autonomy that skipping any one of the four now shows up as an incident within months rather than sitting dormant for years the way a forgotten service account might.

It''s worth being honest about what this layer is and isn''t. Entra Agent ID and Okta for AI Agents are vendor platforms, not a shared standard — an enterprise adopting one is buying into that vendor''s identity fabric, the same trade-off as any IAM decision before agents existed. Cross App Access is the one piece with standard ambitions, an OAuth extension Okta is trying to get other vendors to implement rather than a proprietary API, but it''s early enough that "open standard" mostly describes intent so far. That''s a different maturity picture than the tool-calling layer, where MCP settled the question of which protocol wins. Here, the protocols for provisioning and revoking agent access are still vendor-shaped, and the report data suggests most enterprises haven''t finished deciding whether to adopt any of them.

The part a platform purchase doesn't fix

Buying Entra Agent ID or Okta for AI Agents gets an organization the plumbing: an identity object per agent, a place to attach conditional access, a dashboard that can show what''s running. It doesn''t by itself produce the 88%-to-82% gap closing, because that gap is a process failure as much as a tooling one. An agent identity platform doesn''t decide who signs off before an agent goes to production, or how often someone reviews what it''s still allowed to touch six months later — those are still organizational choices, and Gravitee''s 14.4%-full-approval number suggests most organizations haven''t made them yet, tooling or not.

The pattern rhymes with what''s true of the approval gate and permission modes at the individual-agent level: the mechanism for staged, revocable access existed well before most teams used it consistently. Enterprise governance is the same problem at fleet scale, with an added twist — an agent that can spawn other agents needs its access reviewed before it multiplies, not after. The identity platforms shipping now make that reviewable. Whether it gets reviewed is still a 2026 open question, and the tracker''s OS-level agent workspaces entry is worth watching for where the next layer of that answer lands.