Workato
Azure
MuleSoft
Salesforce
AWSReady To Modernize Your Architecture?
Discuss your current infrastructure and scalability goals with our integration experts.
Article Series
"The AI Decided" Is Not a DefensePart 1 · you are here
You are being held personally accountable for the actions of software you cannot inventory, cannot see acting, and cannot switch off.
The short version
01The inventory you think you have is not the one that’s live. In a 2026 CSA survey, 82% of organizations found agents in their environment they didn’t know about.
02Autonomy is not a liability defense. Accountability for what an agent does runs to the humans and entities behind it.
03These are governance failures, not model failures. Gartner expects 40% of agentic projects cancelled by 2027 on cost and risk controls.
04Every framework converges on four controls — and all of them live outside the agent, at a layer it cannot rewrite.
01 — The three questions an auditor will ask first
“How many AI agents are running in production, who owns each one, and what can each one touch?”
Many organizations cannot answer these questions reliably — and the gap is quantified. Per IBM’s Cost of a Data Breach 2025, 63% of breached organizations either had no AI governance policy or were still writing one. Among organizations breached through an AI model or application, 97% lacked proper AI access controls. Those two statistics are the same fact wearing different clothes: the breach and the missing control travel together. The “sort of” answer is the dangerous one. In the Cloud Security Alliance’s 2026 survey of 418 organizations (with Token Security), 82% discovered agents running in their environment that they didn’t know about in the past twelve months — and 65% had a security incident caused by an AI agent. The inventory you think you have is not the one that’s live. The money is real, too. The average breach now costs $4.44M globally and $10.22M in the United States. And “shadow AI” — the tools nobody approved — added an additional $670K in costs, featured in 1 of every 5 breaches (IBM 2025). Figure 1
The breach and the missing control travel together
63%
of breached organizations had no AI governance policy — or were still writing one.
97%
of organizations breached through an AI model or application lacked proper AI access controls.
82%
discovered agents running in their environment they didn’t know about, in the past twelve months.
65%
had a security incident caused by an AI agent.
Sources: IBM Cost of a Data Breach 2025 · Cloud Security Alliance + Token Security, 2026 (n=418)
Figure 2
Baseline breach economics, before the shadow-AI premium
$4.44M
average breach cost, globally
$10.22M
average breach cost, United States
+$670K
added by shadow AI — tools nobody approved
1 in 5
breaches feature shadow AI
What this means for you
If you can’t produce a live agent inventory with an owner per agent today, you are already in the majority that a regulator will treat as unprepared. The inventory is the first control, not the paperwork after it.
02 — The liability moved to humans
The biggest shift of 2026 isn’t technical. Per Baker McKenzie’s July 2026 analysis of U.S. law, accountability for what autonomous agents do runs to the humans and entities behind it — organizations cannot claim AI autonomy as a liability defense. “The AI decided that on its own” will not survive contact with a courtroom, a regulator, or your board. Your peers have also taken notice. AI risk disclosure among S&P 500 companies jumped from 12% in 2023 to 72% in 2025 (Harvard Law Forum / The Conference Board), and the Conference Board’s April 2026 update puts it at 83% when compared to December 2025 data. The SEC’s Investor Advisory Committee formally recommended AI risk disclosure in December 2025. If you’re still in the non-disclosing minority, you’re the outlier when something goes wrong.
The costs also run away before anyone notices. Gartner predicts over 40% of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls — governance failures, not model failures. Uber exhausted its entire 2026 Claude Code budget by April, as the tool spread to roughly 5,000 engineers (Forbes, May 2026). That is what “no budget guardrail at machine speed” looks like. 03 — This isn’t an AI problem
It’s a governance problem wearing an AI costume, and we solved this exact shape with APIs a decade ago: the winners didn’t ban APIs, they governed them. What’s genuinely new is the failure speed.Traditional application
Deterministic
Acts under one identity
Waits for a human to approve consequential actions
AI agent
Reasons
Picks tools on the fly, fans out across trust domains
Acts first
CVE-2025-32711A single email made Microsoft 365 Copilot silently exfiltrate mailbox data with zero clicks (EchoLeak).
CVE-2025-53773Hidden repo text tricked GitHub Copilot into flipping its own settings to auto-approve every command.
CVE-2025-8217A supply-chain compromise pushed destructive instructions into Amazon Q, where a syntax error — not a control — prevented mass data wiping.
In each case the guardrails lived inside the agent — and the agent, or its attacker, could reason around them. More on these incidents — and what containment actually requires — is coming in Part 2 of this series.
Figure 4 · What good looks like
The control plane: four controls, outside the agent, on every call
Every authoritative framework — NIST/CSA’s agentic profile, Forrester AEGIS, Gartner — converges on the same four controls, and all four share one property: they live at a layer the agent cannot rewrite.
1
See everything
A live inventory of every agent, its owner, and what it can touch.
2
Gate every action
One chokepoint enforcing identity, policy, and PII rules at call time.
3
Propagate identity
The end-user’s identity rides every hop, not a “god-mode” service account.
4
Watch and cap
Real-time telemetry and enforced consumption limits.
A guardrail the agent can edit is not a guardrail. Every control above sits outside the runtime — that is the whole design.
Controls live outside the agent — a registry it can’t hide from, a gateway it can’t reconfigure, an identity it can’t escalate.
04 — How MuleSoft Agent Fabric answers each one
This is no longer a roadmap conversation — each control is a shipped, documented capability.See everything The Agent Registry (GA October 2025) is a system of record with ownership and lifecycle metadata; Agent Scanners (GA January 2026) continuously detect new, updated, or deprecated agents across Agentforce, Bedrock, Vertex AI, and Copilot Studio. Scanning builds inventory; Omni Gateway builds enforcement. Discovery tells you what is running — it does not force that traffic through a policy chokepoint.
Gate every action Omni Gateway (May 2026) puts a policy chokepoint on agent traffic — A2A, MCP, and LLM alike — with policies for PII detection, tool allow-listing, ABAC, and schema validation. Crucially, the agent cannot edit gateway policy from inside its own runtime — the exact property the Copilot incident proved necessary.
Propagate identity Trusted Agent Identity (GA April 2026) exchanges the end-user’s OAuth token at every hop, so backends enforce that person’s access, not a shared service account. CIBA step-up pushes an MFA prompt to the user’s own device before high-risk actions, with zero application code changes. An agent can’t self-approve what a human must approve on another channel.
Watch and cap Agent Visualizer (GA October 2025) renders the live agent network — nodes, call volumes, drill-down to traces — and rate limits enforce per-user quotas. One honest note: these are token quotas, not dollar-denominated budget caps; tiered budget schemes are configuration patterns you design, not published product features. Precision here is what keeps the rest of the story credible.
It’s already in production — Salesforce cites AstraZeneca, Barco, Capita, Rush University System for Health, and Wynn/Encore Las Vegas among adopters. But the product is the easy part; the hard part is delivery judgment. That’s practice work, not license work.
05 — Where API People can help
That “practice work” is exactly what we do. API People is an integration and automation partner with deep MuleSoft Anypoint expertise and a delivery record where agent governance bites hardest — banks, credit unions, and fintechs on cores like Fiserv, Jack Henry, and FIS, plus healthcare and other regulated environments. Because we work both sides of the Salesforce house — Data 360 (Data Cloud), Agentforce, Financial Services Cloud, and OmniStudio on one side, MuleSoft API-led connectivity on the other — we stand up Agent Fabric the way it’s meant to be used:A discovery workshop that builds your first real agent inventory
A roadmap assigning each agent an autonomy tier and an owner
Gateway policies and end-user identity propagation designed around your core systems
The audit evidence your examiners will actually accept
06 — The clock is ticking
The EU AI Act’s penalty regime — up to €35M or 7% of global turnover — has been applicable since August 2, 2025, and the Commission’s power to fine general-purpose-AI providers switches on August 2, 2026. (High-risk obligations were pushed to December 2, 2027 by the Digital Omnibus — a delivery schedule, not a pardon.) Healthcare had its worst year on record by breach count in 2025 (772 large breaches, ~139.7M individuals, per HHS OCR), and the first major HIPAA Security Rule update in twenty years explicitly cites AI. The regulators are not waiting for your inventory.Ask the three questions today
What’s running, who owns it, and what can it touch?
The governance you build now is the evidence you’ll wish you had when the regulator, the auditor, or the board asks what you knew and when.
So ask the three questions today. If you can’t answer them, that’s not an AI problem — and now you know exactly what the fix looks like.
If you want a real agent inventory, an autonomy tier and owner for each one, and gateway policies your examiners will accept — that is the conversation API People is built to have. Start with a discovery workshop scoped to your environment.
Reach out →Sources
Every figure in this article traces to one of the following.01IBM, Cost of a Data Breach Report 2025 — ibm.com/reports/data-breach
02Cloud Security Alliance + Token Security, “Autonomous but Not Controlled” (Apr 2026, n=418) — cloudsecurityalliance.org
03Gartner press releases: agentic project cancellations (Jun 2025); task-specific agents in 40% of apps (Aug 2025) — gartner.com/en/newsroom
04Harvard Law School Forum on Corporate Governance / The Conference Board, S&P 500 AI risk disclosures (Oct 2025; Apr 2026 update) — corpgov.law.harvard.edu
05Baker McKenzie, “United States: Legal accountability for AI agents” (Jul 2026) — bakermckenzie.com
06Forbes, “Uber Burns Its 2026 AI Budget in Four Months on Claude Code” (May 17, 2026) — forbes.com
07CISA-led six-agency joint guidance, “Careful Adoption of Agentic AI Services” (May 1, 2026) — cisa.gov
08 NVD: CVE-2025-32711 (EchoLeak) · CVE-2025-53773 (GitHub Copilot) · CVE-2025-8217 (Amazon Q, AWS bulletin AWS-2025-015)
09HHS OCR breach portal, 2025 totals — ocrportal.hhs.gov
10EU AI Act, Article 99 — artificialintelligenceact.eu/article/99
11MuleSoft Agent Fabric release notes and gateway policy docs — docs.mulesoft.com
12Salesforce, MuleSoft Agent Fabric announcement (named customers) — salesforce.com/news
FAQs
Can a company claim “the AI decided” as a legal defense if an agent causes harm?
No. Per Baker McKenzie’s 2026 analysis of U.S. law, accountability for what autonomous agents do runs to the humans and entities behind them. Autonomy is not a liability defense — it will not survive contact with a courtroom, a regulator, or a board.
Why don’t most organizations know how many AI agents they actually have running?
Agents get spun up by individual teams and tools faster than IT can catalog them. In the Cloud Security Alliance’s 2026 survey of 418 organizations, 82% discovered agents running in their environment that they didn’t know about in the past twelve months, and 65% had a security incident caused by one.
What are the four controls every AI governance framework converges on?
See everything (a live inventory of every agent, its owner, and what it can touch), gate every action (one chokepoint enforcing identity, policy, and PII rules at call time), propagate identity (the end-user’s identity rides every hop, not a shared service account), and watch and cap (real-time telemetry and enforced consumption limits).
What is MuleSoft Agent Fabric?
It’s Salesforce’s control-plane product for agentic AI, combining an Agent Registry and Agent Scanners for discovery, Omni Gateway for policy enforcement, Trusted Agent Identity for identity propagation, and Agent Visualizer for real-time monitoring — the four controls shipped as documented capabilities.
What happens if we can’t produce an agent inventory today?
You’re already in the majority a regulator will treat as unprepared. The inventory is the first control, not paperwork completed after the fact — and with the EU AI Act’s penalty regime already active and HIPAA’s updated Security Rule citing AI directly, regulators are not waiting.
How can API People help with AI agent governance?
We run a discovery workshop that builds a real agent inventory, assign each agent an autonomy tier and owner, design gateway policies and identity propagation around your core systems, and produce the audit evidence examiners will actually accept — drawing on our MuleSoft and Salesforce delivery experience in regulated industries.
Free PDF
Read it offline — get the full PDF
Fill in two fields and the download starts right here.
- Every figure and diagram at full resolution
- All sources, linked and cited
No spam. We respect your inbox and your data.
Contact Us
Talk to an integration expert
About your environment — no pitch deck required.
