Your agents have shipped. Now, who owns them?

Ownership was inherited, not designed

Geordie AI opens its two-part study with a diagnosis that will sound familiar to anyone who has watched agents spread through a company: ownership of agent security and operations is typically inherited rather than designed. Agents have transitioned from rogue pilots to essential workers in the space of two years, according to the study, and the organizations around them have not been redesigned to match. Security owns whether an agent may act, while agent operations owns whether it is acting well and what it costs, and separating those two jobs creates gaps in accountability. Mandates for agent adoption are usually top-down and funded, the study says, while mandates for control are bottom-up and unbudgeted. m:…6950

The study lays out five organizational models it found in practice. About 12 organizations fit the model where security absorbs agent work, about 7 fit a function inside IT, about 10 fit a standalone AI function, about 7 fit platform engineering, and about 10 fit no function at all. The platform engineering model treats agents as production workloads with service levels and on-call rotations. Standalone AI functions are likely transitional arrangements, the study says, that will be absorbed into IT and platform teams. The numbers behind the urgency come from Gartner, as cited by Geordie AI: 33% of enterprise software will include agentic AI by 2028, 15% of day-to-day operations will be completed autonomously by 2028, and 40% of agentic AI projects will face cancellation due to unmanaged risks. m:…6950

Thirteen jobs, and nobody signed up for several

The second part of the Geordie AI study divides the work into 13 tasks and asks who owns each one. The answer, for several of them, is nobody. Agent discovery is foundational, yet ownership is often split between IT, which holds the tooling, and security, which is asking for it. Intake and approval processes are currently unresolved in most organizations. Tool, connector, and MCP server vetting is split between security and platform engineering. Recertification, deprovisioning, and retirement of agents are currently unowned in most organizations. Runtime guardrails and enforcement are also unresolved and often split across multiple teams. m:…6949

Some tasks do have a home. The study says agents should carry their own non-human or workload identities from the first day of operation, that entitlement scoping requires shared ownership between identity, the data owner, and security, and that cost and FinOps should be owned by business units with finance setting the chargeback model. Reliability, quality, and improvement should sit with operations, with business owners evaluating value. Threat detection and response is owned by security but depends on telemetry from operations. Incident response and forensics are led by security, using context from business and operations, while audit evidence, compliance, and reporting are owned by governance, risk, and compliance, privacy, and legal teams. The study says ownership should be assigned on regulatory exposure, blast radius, and build origin. The practical takeaway is to write the list down and assign names before the next agent ships, because the unowned tasks are the ones that fail quietly. m:…6949

The change is outrunning the steering

Waydev describes what happens when the ownership gap meets real output. Engineering organizations are experiencing an internal denial of service, it says, where change generation outpaces leadership's ability to steer, and the primary bottleneck is leadership attention, not output capacity. Waydev says it measures AI agent performance by tracking change generation, landing rates, review load, and alignment with company bets, and that aggregate views let leaders track effort, overlap, and churn without reviewing individual pull requests. Linear, the piece notes, has locked down its internal release channel to ensure changes are considered collectively rather than individually, though the gate helps track changes without yet confirming whether work aligns with the desired company direction. Karri Saarinen of Linear is quoted in the piece as saying organizations are being overwhelmed from the inside by their own people and agents, and Waydev's Alex Circei argues engineering leaders are steering with outdated dashboards despite upgraded AI engines. m:…2501

Squirro adds the rules for the riskiest case: scheduled agents that run without human oversight. It says organizations must treat these agents like new employees, vetting access, permissions, and boundaries before unattended work, and that unattended runs should fail closed, requiring human approval for actions that send, change, or delete data. Every claim should be traceable to a source passage, and agents should retrieve documents under the task owner's permissions. Prompt injection is ranked the top risk for LLM applications in the OWASP Top 10 for 2025, and Article 12 of the EU AI Act requires automatic logging for high-risk systems. m:…0568

2027 is when the bill arrives

SAS frames the next year as the moment this stops being a governance debate and becomes a performance test. It predicts 2027 will be the year of AI consequences, when enterprises demand proof that AI delivers business value, and organizations will struggle to demonstrate business performance improvements despite producing higher volumes of AI-generated content. CIOs must reimagine enterprise infrastructure to govern autonomous digital agents rather than human users, SAS says, and companies will need clear rules for what an AI agent can decide independently versus what requires human involvement. Agents will begin making consequential financial decisions, such as transferring money on behalf of human principals. Enterprises will shift focus from AI consumption costs to the cost of delivering trusted business decisions, and data leaders will prioritize explainability, ethics, and collaboration over raw decision speed. m:…4185