The gap between AI policy and AI agents

Most organisations have an AI governance policy. Very few know how many AI agents are actually running in their environment right now.

That gap, between what policy covers and what is actually deployed, is where the next wave of security incidents will come from.

On LinkedIn I shared a short carousel on what an unreviewed agentic AI deployment looks like, and a three-step framework to close the gap. The principle underneath it is simple: treat every agent as an identity. Give it an owner, least-privilege access, an audit trail, and a human approval step where the action genuinely matters.