AI Agent Governance: Market and Thought-Leadership Landscape (2026)

Status: informative companion · Evidence date: 2026-09-30 · Owner: EP-B932453F / BI-2C3B3AC9

This brief records what the market, the research community and incident reports say about one question: how should AI agents be governed when they use tools and resources? It is the evidence base behind the Gated Permissions Process (GPP) and the public positioning of the standards family.

The brief is a dated snapshot, not a normative standard. Every figure carries its publisher and date. Figures published only by a vendor about its own product are labelled vendor-reported. Items that could not be checked against a primary source are listed in §8, and nothing in that list is stated as fact elsewhere. Re-check every figure against its source before reusing it in a public document.

1. The problem in one paragraph

Most agent tools offer two ways to govern tool use. One is to approve each call: the agent stops and asks before it runs a command, writes a file or calls an API. The other is to approve nothing, using the “YOLO”, --yolo, “always allow” or --dangerously-skip-permissions modes that most agent CLIs ship. Per-call approval does not hold up, because people stop reading the prompts. Once they stop reading, the second option becomes the actual operating mode, and the agent is effectively unsupervised. The 2025–2026 incident record (§3) is largely a record of agents that held broad credentials and met no gate at the moment a damaging action happened.

2. Evidence that per-call approval fails

What the evidence supports. The vendor field observations and controlled experiment motivate investigating the limits of repetitive approval prompts and alternatives to them. A rejection rate alone does not establish whether a plan decision was correct, and the field metrics are not results from the controlled tester cohort. The experiment measured detection of a displayed dangerous command in a test environment, not business outcomes or GPP. The proposed GPP design moves a checkpoint to a scoped decision that can authorize a bounded class of tool calls, while requiring enforcement on every call. Its efficacy remains unmeasured by this evidence; it needs its own implementation, failure-case testing and assessment.

What the evidence does not support. No independent survey was found that measures how many users run YOLO or skip-permission modes. Do not cite an adoption rate.

3. Incident record, 2024–2026

The repeating pattern. Almost every row has the same failure. The agent held authority broader than its task: a credential, a scope or a tool. Nothing evaluated the specific damaging action against who was entitled to authorize it. Detection and model-level guardrails were present in several cases and did not change the outcome. That pattern motivates GPP’s core rule: a consequential tool is reachable only through a gate whose owning authority is named, recorded and current.

4. Frameworks and thought leadership

5. Products and adjacent approaches

Market pattern. Responsibilities are consolidating along three lines. Identity vendors own agent identity. Cloud platforms own deterministic tool policy. Governance suites own inventory and policy authoring. Classifier and guardrail vendors are being acquired by large security platforms. No product reviewed models “who may decide this class of action” together with “which tool may run” as its primary object.

6. The gap GPP addresses

The nearest prior work is real. GPP should be presented as composing it, not as inventing governance:

• RBAC, ABAC and ReBAC (Zanzibar, USENIX ATC 2019) model who may do something. They do not model who may decide that a class of action is admissible in a given work context.
• ITIL change enablement pre-authorizes standard changes as a class and sends normal changes to a change authority. This is the clearest organizational ancestor of GPP: approval attaches to a class of change and its authority, not to each execution. Cite primary ITIL sources before relying on this analogy publicly.
• Delegation-of-authority matrices, RACI and segregation of duties name accountable deciders. They are not bound to machine-enforced tool reachability.
• Ibrahim & Li, Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI (arXiv 2606.03518, 2026-06) — https://arxiv.org/abs/2606.03518 — is the closest formal work: delegation types and resource-scope attenuation over relational policies. GPP differs in binding to named governance scopes (platform, organization, profession) and to versioned work-shape stages. A full comparison is owed before any novelty claim.
• Architecture & Governance Magazine, Five Decision Rights CIOs Need for Agentic AI (2026-09-25) — https://www.architectureandgovernance.com/artificial-intelligence/five-decision-rights-cios-need-for-agentic-ai/ — names decision rights and owners, and explicitly leaves tool binding to identity systems and gateways. GPP is that missing binding.

GPP’s position, stated narrowly. The industry’s current answer to approval fatigue is probabilistic: sandboxes plus a classifier that decides which calls to let through. Those controls have published false-negative rates and a published bypass. GPP proposes a deterministic, policy-compiled binding in which each consequential tool’s reachability traces to a named, recorded decision authority. That is the evidence an Article 14 oversight review or an ISO/IEC 42001 audit can examine. GPP does not replace sandboxing, egress control or credential isolation; it decides what those controls must permit.

7. Implications for DPF’s public claims

• Claim the design and the substrate that exists. Do not claim measured efficacy until DPF publishes its own denominators from AuthorizationDecisionLog, ToolExecution and DecisionInteraction. See GPP §11.
• Position GPP against classifiers and per-call prompts together, not against per-call prompts alone.
• Do not imply certification, standards-body endorsement or regulatory compliance.

8. What this brief could not verify

• The primary text of the Gartner press release of 2026-05-26 (secondary reporting only).
• Agent-specific clauses in ISO/IEC 42001 (not confirmed from a primary source; no clause is cited).
• Feature details for Cloudflare and Docker MCP gateways and the Salesforce Agentforce trust layer (secondary sources only; omitted from §5).
• Accounts of the July 2026 Hugging Face intrusion conflict on scale: one autonomous agent versus hundreds of coordinating agents. Cite the Hugging Face timeline and the METR report and name the discrepancy.
• Counts in the OpenClaw / ClawHub incident reporting vary widely between sources; omitted from §3.
• Anthropic’s own posts report the prompt-approval rate as both 93% and 97%. Both are vendor-reported and not independently replicated.
• No independent survey of YOLO or skip-permission adoption was found.