Article 5 - The 90-Day Agent Governance Plan

By now, most organizations have had the conversation. AI agents are coming, some are already here, employees are experimenting with them, business teams are building them, IT is trying to understand the landscape, security is asking what they can access, and data teams are discovering that years of information governance decisions suddenly matter so much more. 

And leadership is asking a reasonable question: "So what should we actually do?" 

The answer doesn't need to begin with a three-year transformation program. Start with 90 days—not to solve agent governance, but to establish the foundation for a repeatable operating model. Because the objective isn't to make every agent in the enterprise perfect. It's to move from: 

"We think people are using agents." 

to: 

"We know what we have, who owns it, what it can reach, and how we're going to govern it." 

That's a very different starting position. 

90-day roadmap at a glance 

The plan follows a simple sequence: Days 1–30 establish the baseline by inventorying agents, assigning ownership, and mapping connections. Days 31–60 strengthen the data foundation by reviewing access, sensitivity, ownership, and content lifecycle. Days 61–90 apply the model to one representative agent from identity and access through monitoring and retirement. 

Days 1–30: Establish the baseline 

The first month is about discovery. Resist the temptation to start by writing a 40-page agent policy. Start by finding out what's actually happening. 

Inventory the agents 

What agents already exist? Don't limit the exercise to formally approved projects. Look across the environment for the agents people are creating and using. You want to establish a baseline. Capture each agent’s purpose, creator, accountable owner, connected systems, data sources, and current operating status. You may discover that your organization has more agents than anyone realized. That's not necessarily bad news, that's useful information. You can't govern an unknown population. 

Identify the owners 

Once you know what exists, determine who is accountable. Some agents will have obvious business owners, others will have a technical creator but no clear business sponsor. Some may turn out to be experiments that nobody is using anymore. That's exactly the kind of information the baseline should uncover. The question isn't simply: 

"Who built this?" 

It's: 

"Who is accountable for this continuing to exist?" 

That distinction becomes increasingly important as agents move from experimentation into business operations. 

Map the connections 

An inventory tells you what exists. The next step is understanding relationships. What does each agent connect to? 

• Which applications? 
• Which sites? 
• Which information sources? 
• Which identities? 
• Which services? 

This progression leads toward an agent map: a view of the relationships among agents, users, applications, and data. This is where the first 30 days begin to produce something more valuable than a list. They produce context. 

Days 31–60: Fix the data underneath the agents 

Once you understand the agent population, don't immediately try to lock everything down. Look underneath it. 

The second month focuses on strengthening the data foundation. Review access on priority sites, apply sensitivity labels, retire content with no accountable owner, and establish clear ownership for the information agents depend on. In other words: Fix the data foundation where it matters most. 

Start with the most important sites 

Don't try to clean the entire enterprise. Identify the repositories supporting your highest-value agent use cases. Then ask: 

• Who owns this information? 
• Who can access it? 
• Is that access still appropriate? 
• Is the information sensitive? 
• Is the information still current? 
• Does this content still need to exist? 

This is not a prerequisite for every AI experiment; it's targeted preparation for the places where agent adoption is becoming real. 

Retire what nobody owns 

One of the most valuable outcomes of this exercise may be identifying obsolete or unowned information that remains accessible. 

• Old project sites. 
• Abandoned content. 
• Outdated documents. 
• Repositories with no clear owner. 
• Information that exists because nobody ever decided to remove it. 
• The recommendation is simple: retire content nobody owns. That is sound information governance whether or not an agent ever touches the data.

Agents make it more urgent because they can surface unowned, outdated, or unnecessary information through conversational interfaces, expanding the risk of inaccurate or inappropriate use. If an organization is going to make more of its information discoverable through conversational interfaces, the question of whether that information should still exist becomes harder to ignore. 

Days 61–90: Govern one agent end-to-end 

This is the most important part of the plan. Choose one meaningful agent—not the most complicated one or the one with the largest architecture diagram, but one that represents the type of agent the organization expects to deploy broadly. Then govern it from beginning to end. 

Give it an identity

You should know exactly which agent you're dealing with. It shouldn't be an anonymous piece of automation hidden somewhere in the environment. Identify it. 

Give it an owner

Assign a named sponsor and owner. Someone should be accountable for its business purpose and continued operation. Own it. 

Scope its access

Document what the agent needs to reach. Then remove what it doesn't need. The principle is familiar: Least privilege. The agent should have enough access to accomplish its defined purpose—and no more. Granting access for conceivable future uses expands risk without supporting the current business need. Scope it. 

Understand its data

Know which information sources it depends on. Make sure those sources have appropriate access and protection. If the agent is operating against sensitive information, understand the implications. Protect the data around it. 

Watch what it does

Establish visibility into activity and usage. 

• Can you tell whether the agent is actually being used? 
• Can you understand its connections? 
• Can you identify unusual or concerning activity? 
• Can security investigate when necessary? 

The objective isn't surveillance for its own sake. It's operational visibility. Watch it. 

Define its exit

Finally, answer a question organizations frequently forget until it's too late: When does this agent stop existing? 

• What happens when the business process changes? 
• When the owner leaves? 
• When the agent is replaced? 
• When nobody uses it? 
• When its data sources change? 

Define the retirement path before you need it. Retire it. 

What you should have after 90 days 

The goal is not a perfect agent governance program. It is a repeatable operating model that shows what agents exist, who owns them, what data they use, and how one representative agent is governed across its lifecycle. A repeatable model. 

After 90 days, you should be able to demonstrate: 

• A baseline - You have a picture of the agent population. 
• Accountability - You know who owns the agents that matter. 
• Data readiness - You've addressed the most important underlying data governance issues. 
• A governed example - You've taken at least one meaningful agent through the complete lifecycle. 
• A repeatable framework - You now know how to apply the same controls to the next agent. 

That's the beginning of an operating model. The operating model begins with a practical sequence: discover the agent landscape, strengthen the information foundation, govern one representative agent, and scale the pattern. 

Don't make the 90-day plan a technology project 

There's an important distinction here. This isn't fundamentally about buying another tool. Tools can help with discovery, identity, access control, data protection, monitoring and lifecycle management. But the first question is organizational: 

What does "governed" mean for an agent in our environment? 

If the answer isn't clear, technology won't solve the ambiguity. That's why the sequence matters. 

• Discover. 
• Understand. 
• Fix the foundation. 
• Govern one. 
• Scale the pattern. 

Ask for the sequence, not the decision 

There's a useful leadership lesson buried in all of this. When an organization is facing a new technology, executives often ask for a decision: 

"Are we ready for agents?" 

That's almost impossible to answer as a binary question. A better question is: 

"What's the sequence that gets us ready?" 

Ask for the sequence, not a binary decision. For emerging technology, readiness develops through action: understand the agent landscape, learn how the organization uses it, fix the foundation, govern one representative agent, and scale what works. 

• You need to know what you're going to learn first. 
• Then what you'll fix. 
• Then what you'll govern. 
• Then how you'll scale. 

The 90 days are the beginning, not the destination 

After the first 90 days, the work continues. 

• The agent population will grow. 
• New capabilities will emerge. 
• New data sources will be connected. 
• New risks will appear. 
• Some agents will become critical business infrastructure. 
• Others will disappear. 

Lifecycle governance is a continuing discipline, not a final state called “Agent Governance Complete.” The objective is to establish a lifecycle that keeps working as agents, data sources, capabilities, and risks change. 

Inventory it. Identify it. Own it. Scope it. Watch it. Retire it. 

Then do it again.

We've done this before, and that's ultimately the message of this series. We didn't learn how to govern enterprise assets overnight, we learned through successive waves. 

• Identity 
• Devices 
• Applications 
• Data 
• And now agents 

Each wave introduced new technology and new risks but the organization eventually developed a way to bring that technology into an operating model. 

Agents are the fifth major governance wave. Organizations do not have to start from zero; they can adapt lessons from identity, device, application, and data governance. The starting point is not a massive transformation program, a perfect policy, or a prediction about where AI will be five years from now. 

With 90 days 

• Thirty days to understand what you have. 
• Thirty days to improve the data underneath it. 
• Thirty days to govern one agent from beginning to end. 

Then take what you learned and scale it because the goal isn't to govern the future, it's to start governing what you already have. 

This is the fifth and final article in the initial series exploring the "fifth lifecycle" of enterprise IT: the governance of AI agents alongside identity, devices, applications and data.