Agent sprawl: a checklist for governance, security and cost

Four days at Gartner IT Symposium/Xpo in Orlando, and the CIOs I met kept asking the same question in different words: how do I get my hands around agent sprawl? Not "which model," not "which framework." Governance, security and cost, for agents that are already loose in the building.

Sprawl is not a new problem. It is shadow IT with a faster clock. Every team has a pilot, every pilot has tools, and every tool can act. The difference is that an agent reports its own success, and nobody checks.

So here is the checklist I would hand a CIO on Monday. Every item points at something you can run, and most of them point at open-source tools from our lab under MIT.

1. Inventory: you cannot govern what you cannot list

List every agent, and every tool each one can call. For agents that use the Model Context Protocol (MCP), the tool surface is explicit: each server declares its tools. That makes MCP the easiest place to start an inventory, because the list already exists in configuration.

Grade the APIs your agents touch. The apis.io catalog scores API providers for agent readiness in four bands, from "agent-native" to "human-only." Its own guide puts agent-native at about 1.7 percent of the catalog. Use it as an outside yardstick: an agent wired to a "human-only" API is relying on a person to paper over the gaps.

Done when: you have one table of agents, owners, tools, and the systems each tool can change.

2. Governance: an agent's "done" is a claim, not a fact

Require receipts. prove-it-done makes an agent's completion claim re-runnable: the commands, files, URLs and commits behind "done" are checked again against the real system. Self-reports do not count.

Check claims before a person reads them. The Bedrock Done-Claim Checker takes a claim plus its evidence and returns supported, partial, unsupported or unparseable. Deterministic checks run first. The model can make a verdict weaker; it cannot make one stronger than the evidence allows. (It is offline-tested and has not yet run against a live AWS account.)

Read the trace, not the summary. Agent Trace Clinic triages agent traces deterministically and links every finding to the evidence in the trace. It runs in the browser or a small CLI, so no trace leaves the machine.

Done when: no agent's work is accepted on its own word, and a reviewer can open the evidence behind any "done."

3. Security: assume the tools will misbehave

Test the failure path before production does. Most agent clients are tested against tools that behave. MCP Failure Lab is a deliberately faulty MCP server and reference client harness: tool errors, delays, malformed results and disconnects, with tests in a no-network container. If your client cannot survive a malformed result, you find out in a sandbox.

Minimize what an agent can see. oak-events gives agents camera events as JSON lines and MCP tools, and colour frames never leave the camera. The pattern generalizes: give the agent the event it needs, not the raw data it could leak.

Map your controls to a published framework. The Cloud Security Alliance's AI Controls Matrix has 247 control objectives across 18 domains, and its AI-CAIQ questionnaire turns them into yes/no/not-applicable answers per control. The Level 1 self-assessment for STAR for AI is free. Filling it in is the fastest way to find the controls nobody owns.

Done when: every agent has been run against bad tool output, and every AI control has a named owner.

4. Cost: decide what a call is allowed to cost before it happens

Cap before you spend. The Done-Claim Checker counts calls per day and refuses past a hard cap, and the check happens before the model is called. A cap enforced after the bill arrives is a report, not a control.

One model per job, chosen on purpose. No silent fallback chains that escalate to a bigger model when the small one is unsure. If a result must be traceable to one model, route to one model.

Read the bill by shape, not by size. Break AI spend down by model and by input versus output tokens. The line that matters is usually not the largest instance but the charge whose shape is wrong: a loop that resends the whole context, or an agent polling a paid API. Rightsizing returns a percentage. Fixing the shape returns a multiple.

Done when: every agent has a cap that fires before the call, and the bill can be read per agent and per model.

The one-page version

None of this needs a platform purchase to start. It needs a list, a rule that "done" comes with evidence, and a cap that fires first. The tools above are open source; the code is at github.com/cloudlabworks.