Twelve months ago, agents sat inside a small fraction of enterprise applications. Gartner now projects that by the end of this year, forty percent of enterprise applications will carry an embedded agent. The industry moved from a rounding error to nearly half the stack in about a year.
Governance did not move at that pace. Policy gets written for the world it observes, and the world it observed a year ago barely resembles the one running today.
What Governance Assumes
Every governance framework carries a hidden assumption. Someone, somewhere, can review what happened. An auditor can pull the trail. A compliance team can reconstruct the decision. The framework doesn’t need to say this out loud, because for decades it was simply true.
That assumption held when a workflow lived inside a single system, with a single owner, and a single log. People in charge could point to where a decision got made because there was one place to point.
Why the Curve Broke It
The mistake is treating this as a speed problem. Write policy faster. Staff compliance teams larger. Neither closes the gap, because the gap was never about velocity.
The real question is whether the trail exists in the first place. An agent today touches a CRM, a ticketing system, a data warehouse, and a messaging platform inside a single task. Each of those systems keeps its own record. None of them keeps the connective one. The trail governance assumes was built for a single system’s memory. It was never built for a workflow’s memory.
Where the Reconstruction Happens
This stays invisible until something goes wrong. A regulator asks why an agent approved a transaction. A customer asks why an agent closed their ticket. The answer sits scattered across four platforms that were never designed to speak to each other, and reconstructing it becomes an investigation instead of a query.
That gap is the layer I think about constantly with Kosmos. Not because governance needs faster policy, but because the thing policy assumes exists usually doesn’t. Organizational memory isn’t a compliance checkbox. It’s the precondition for governance to mean anything at all.
I wrote in Observability Was Never Built to Explain Judgment that seeing what an agent did and understanding why it was right are different capabilities. The governance version of that gap runs deeper. Governance doesn’t just need to see the decision. It needs to find it, months later, across systems that were never built to remember together.
The Curve Isn’t the Story
The forty percent figure will keep climbing. Every quarter brings a new number, a new milestone, a new reason for leaders to believe the curve itself is the story.
The curve isn’t the story. The trail is. Governance built for a gradual world will keep getting patched for symptoms, one policy at a time, while the real question sits unexamined: whether anyone can actually find what happened once it’s scattered across the systems that did it.