Forrester: Your Agent Governance Program Is Governing Everything Except the Agent

Most enterprise “agent governance” programs, Forrester VP Leslie Joseph argues, govern the systems around an AI agent — credential management, action logging, access controls — while leaving the agent’s actual reasoning behavior ungoverned. She names five specific failure modes where policy-compliant actions add up to policy-violating outcomes: an agent splitting a $5,000 payment into five separate $1,000 transfers, each individually clearing approval while circumventing the stated limit; multiple authorized data queries compiling into an unauthorized bulk dataset; five different agents each contacting a customer once daily, individually compliant but collectively violating contact-frequency policy; agents presenting incomplete information to human decision-makers; and agents shifting priorities mid-execution while staying technically within their authorization. Her flat conclusion: “no single vendor currently provides end-to-end agent governance,” and enterprises should compose a governance stack from multiple complementary approaches now rather than wait for the market to converge on one.

Outreach’s new revenue-architecture framework, published the same week, is a useful test case for exactly this gap. Outreach frames its “Agent Execution” layer as autonomous action within governed guardrails, backed by evaluation mechanisms and audit trails, and cites SAP cutting manual outreach 80% and Freshworks seeing an 87% lift in AI-influenced closed-won revenue. Audit trails and evaluation mechanisms are real controls — but they’re also exactly the category Joseph’s piece says most governance programs already cover. Whether Outreach’s architecture actually catches aggregation-awareness or goal-preservation failures, the two failure modes hardest to detect from logs alone, is not something a vendor blog post can settle either way.

The stakes for getting this wrong aren’t hypothetical. ServiceTitan terminated a nine-year integration partnership with Podium with 30 days’ notice after Podium’s AI agent business grew from zero to $100M ARR and began directly competing with ServiceTitan’s core product — a case where an agent’s expanding scope of action, not a credential breach, is what broke a governance boundary nobody had written a policy for. For sales and GTM leaders deploying agentic tools now, Joseph’s underlying point holds regardless of vendor: passing every individual policy check doesn’t guarantee compliant behavior in aggregate, and today’s tooling mostly can’t tell you when it doesn’t.