Management presents its AI governance update: an acceptable-use policy, a list of approved AI vendors, a heat map with the AI row colored amber. A director asks a plain question. How many of our AI agents can move money or email customers without a person checking first? Nobody in the room knows, because nobody has counted.
That gap is common. In IBM's 2026 Cost of a Data Breach study, 92% of the organizations that had an AI-related breach lacked proper AI access controls, 68% of all breached organizations lacked governance to manage AI or detect unapproved AI use, and only 19% said their governance and security teams coordinated [1]. The sample is organizations that were breached, so it describes what was missing when things went wrong. That is the view a board should care about.
The fix is not a better maturity score. It is a short set of questions that can only be answered with a number or a name, asked the same way every quarter. Of the seven below, one matters more than the rest: which agents can take an action we cannot undo, and does the limit live inside the model or outside it?
Why does an agent need its own line in the risk report?
An AI agent is software that uses a language model to decide which actions to take, then takes them through tools and credentials: it looks up a record, issues a refund, sends an email, merges code. A chatbot answers; an agent acts. A list of projects and vendors with a maturity score cannot show what an agent is allowed to do.
OWASP calls the core failure excessive agency: an agent performs damaging actions in response to unexpected, ambiguous or manipulated model output. It names three causes: excessive functionality, excessive permissions and excessive autonomy [2]. All three are decisions management made, usually without recording them, when an agent was wired to a tool. None of them shows up in a vendor list.
The board's interest is not optional. For US public companies, the SEC's 2023 cybersecurity disclosure rules require a description of the board's oversight of risks from cybersecurity threats and of management's role in assessing and managing material risks [3]. An agent holding a payments key or a customer-data credential is part of that risk surface. The NIST AI Risk Management Framework says the same from the governance side: executive leadership takes responsibility for decisions about AI risks, and mechanisms are in place to inventory AI systems, resourced according to risk [4].
What should the board ask, and what does a good answer sound like?
A good board question has two properties. It asks for a number or a name rather than an assessment, and the answer differs between a company that has the control and one that does not. The seven below meet both tests. Figures in the strong answers are illustrative; listen for their shape.
| Question | A strong answer sounds like | A weak answer sounds like |
|---|---|---|
| 1. How many AI agents run in production, and how did you count them? | Forty-one, counted from gateway traffic, identity-provider app grants and code scans, reconciled monthly. Six this quarter were not registered. | We have twelve approved AI tools. (That counts vendors, not agents, and registrations, not use.) |
| 2. Which agents can take an action we cannot undo without a person approving it? | Four: claims payment, broker email, a coding agent and a data-cleanup job. Each has a limit enforced in the system it calls, listed with its owner. | The agents are instructed not to do that. (An instruction to a model is not a control.) |
| 3. Who can put text in front of those four agents? | Two read documents or email from the public. Neither can reach a payment tool in the same session without an approval. | Only our staff use them. (Emails, uploaded files and web pages are all input.) |
| 4. When an action is risky, who says yes, and how often? | Named approvers per agent. About 300 requests last quarter, a few minutes' median wait, a small share denied, and three always-approved rules retired. | There is a human in the loop. (With no counts, nobody knows whether the loop is real or a rubber stamp.) |
| 5. If an agent did something wrong yesterday, how long to show what it did and why? | Under an hour. Every action is logged with the input that triggered it and the rule that allowed it. We test this quarterly. | We would ask the vendor. Or: we have logs. (Logs that cannot link an action to its cause do not answer the question.) |
| 6. What happens when a control fails or the checking service is down? | Consequential actions stop rather than run unchecked, and each agent can be paused on its own. Both were tested last quarter. | It has never gone down. (Not tested means not known.) |
| 7. Who owns each agent, and what triggers a fresh review? | A named person per agent. A new tool, a new credential or a new source of input triggers a review before release. | IT owns AI. (Risks owned by a department tend to stay open.) |
The questions group into inventory, authority, oversight and evidence. A briefing that answers only the first column describes what exists; the board's real exposure sits in the other three.
Question 2: where does the limit live?
An agent told in its instructions never to refund more than a set amount will usually comply, until a manipulated input or an odd edge case leads it not to. A limit enforced by the payments system, or by a checkpoint outside the model that refuses the call, holds whatever the model decides. Ask management to say, for each consequential agent, where the limit lives. If the answer is the prompt, record that risk as uncontrolled.
Question 4: is anyone actually saying no?
Approval steps work like a budget. If every action asks, people approve without reading, and the control decays into noise. A good answer gives the volume of requests, how long they take, how often a person says no, and what was done about requests that are always approved. A denial rate of exactly zero over a quarter deserves a follow-up question.
Question 5: how long does one trace take?
This is the question that exposes the logs. At Harrow Freight, a fictional logistics company (the figures are illustrative), the first board update listed nine registered AI applications. Counted from gateway traffic, identity-provider grants and code scans, the company ran 23 agents, three of which could act alone on something consequential. Tracing one randomly chosen payment back to the document that prompted it took three days, because the agent's logs recorded the payment but not the input.
Ask for the same page every quarter
The answers become useful when they arrive in the same format every quarter, because the trend tells the board more than any single number. Agree the format once, name the executive who owns it, and resist adding sections. One page forces management to choose what matters.
| Section | What it shows | Where the data comes from | Owner |
|---|---|---|---|
| Headline counts | Agents in production, agents found this quarter that were never registered, agents with authority to act alone on something consequential | Reconciled inventory from traffic, identity-provider grants and code scans | CISO |
| Consequential authority | Each agent that can move money, contact customers, delete data or change access, with its limit and where the limit is enforced | Agent configuration and the systems the tools call | Agent owners |
| Exposure | Agents that read untrusted input and can reach a consequential tool in the same session | Threat models and data-flow reviews | Security architecture |
| Oversight | Approval requests, median wait, denial rate, active exceptions and their expiry dates | Approval system records | Agent owners |
| Incidents and near misses | Blocked or denied actions of note, with one short story the board can follow | Decision logs and incident tickets | Security operations |
| Evidence test | Time taken to trace one randomly chosen agent action back to the input that caused it | A quarterly exercise | Internal audit |
| Decisions requested | Specific risks to accept, with a named owner and a review date, and specific funding asks | Management | CISO and the business owner |
A sample page with illustrative numbers. Headline counts sit on top, consequential authority and oversight in the middle, and the decisions the board is asked to make at the bottom.
Most of these numbers come from the path an agent's calls travel. Intertrace's gateway sits inline between agents and the models, tools and MCP servers they call, and records every decision with the agent, the action, the outcome, the rule that made it and the evidence, which turns the evidence test into a lookup. Its discovery scans cloud accounts, code repositories, identity-provider AI app grants and AI provider keys to find agents nobody registered.
Four quarters in, the page should look different
No single number proves a program works, but the combination is hard to fake. Unregistered agents are still found each quarter, but fewer, and each gets a decision within a few weeks; a count of zero usually means the discovery sources are too narrow. Every agent with consequential authority has a limit enforced outside the model. Approval volume is stable or falling while the denial rate stays above zero. The evidence test falls from days to under an hour, on an action chosen genuinely at random. Every exception has a named owner and an expiry date, and expired exceptions disappear rather than being renewed by default.
The page that never changes is the warning sign: a maturity score that cannot be checked, an inventory done once for a launch, or AI risk reported apart from cybersecurity risk, which leaves the agent with a customer-data credential out of both conversations.
The decision that belongs in the minutes
Send the seven questions in writing before the next risk or audit committee meeting. Then make the board's job explicit: for each agent with consequential authority, either accept a specific risk at a specific limit, with a named owner and a review date recorded in the minutes, or require a person to approve the action. Whether AI is risky is not a question a board can act on. Whether it accepts this agent at this limit is.
