The map

Every page, three reading paths, and what the status labels mean. This page navigates; the README argues.

Pages are organized by the question they answer. Concerns are what goes wrong, concepts are what things mean, patterns are how it is built, controls are what mitigates it, tools are who sells it, implementation is when to do it, operation is what a firm does forever after, and people is who does it. A concern and its control are always separate pages: concerns link forward to controls, controls link back.

Reading paths

• Exec, 30 minutes: the problem → governance → risk tiers → sequencing → build vs buy.
• Platform lead: the problem → security → the lethal trifecta → three-zone architecture → the agent control plane → the controls, in the order sequencing gives them.
• Builder or reviewer: the problem → citizen developer roles → training curriculum → threat-modeling a citizen agent → promotion gates.

Start here

• The problem: citizen agent development is already here

The twelve dimensions

Hubs are navigational. Each carries a claim, the mechanism behind it, a Crawl/Walk/Run/Fly table with the cheapest next move per level, and links out. They route rather than restate.

1. Leadership — sponsorship is no longer the constraint; the unanswered question is.
2. Teams & roles — owner of record, successor, and the certifier role IT becomes.
3. Data — consolidation and blast radius are the same lever.
4. Technology platform — the platform is the enforcement point a firm actually has.
5. Observability & monitoring — where, why, how, by whom; and the authority to intervene.
6. Governance — the least-ready capability in every instrument that measures it.
7. Security — cut a leg of the trifecta before deployment.
8. Training & enablement — teach where the tool stops working, not how to use it.
9. Analytics & evals — 5% have defined success metrics.
10. Use cases & portfolio — which use cases a firm refuses, and who may retire the rest.
11. External partnerships & vendors — a vendor update is a code push into the firm’s agents’ hands.
12. Process & business integration — an agent in an unchanged process automates its failure modes.

Concerns — what goes wrong

• Prompt injection and goal hijack — an agent that reads untrusted text will eventually obey a sentence nobody at the firm wrote; filters delay that without preventing it.
• Data exfiltration — a property of a sequence, not of any single action, so DLP, RBAC and EDR each report nothing while the data leaves.
• Shadow agents — a low agent count measures the instrument rather than the population; two surveys of the same population disagree by an order of magnitude.
• Memory and context poisoning — injection ends when the session does; a poisoned memory doesn’t, because the agent wrote it and nobody approved the write.
• Tool and supply-chain compromise — a tool description is an instruction from a stranger, rewritable after approval.
• Privilege and identity abuse — never whether the agent was authorised, always whose authority it spent and whether anyone can tell afterward.
• Agent sprawl — not a count, an ownership ratio; the flagship success story and the orphaned-agent problem are the same dataset.
• Resource overload and runaway cost — the looping agent burning the quota a production workflow depends on, with no attacker anywhere in it.
• Multi-agent cascades — individually compliant agents compose into violations, and no per-agent monitoring view can see it.
• Cross-session delayed detonation — no single session holds evidence of the attack; monitoring is scoped to the unit that never sees both.
• Quality debt and orphaned apps — ordinary technical debt is owed by someone who can read the code; this is owed by someone who cannot, then by nobody.
• Unreliable output acting on your systems — confidently wrong, too polished to trigger suspicion, and reviewed by someone whose catch rate drops as they trust it.
• Recordkeeping and compliance gaps — the most widely deployed platform deletes transcripts at 30 days, under every period that could bind a firm.
• Regulatory exposure — inadequate written procedures is itself the violation, chargeable before anyone is harmed; and the redemption outranks the penalty.
• Agent disclosure and AI-washing — overstating what the agents do, and a regulator testing whether a claimed capability is real.
• Emergent market abuse — an agent optimising a profit objective discovers spoofing; the detection duty has no intent element.
• Oversight decay — the gate designed at deployment ends up governing a version of the system that no longer exists.

Concepts — what things mean

• The lethal trifecta — untrusted text, sensitive data, network reach: cut one leg in the architecture, and put guardrails on top of the cut, never instead of it.
• Why agents break application governance — application governance assumes a behaviour is verified once; there is no “the” behaviour to review.
• Risk tiers and trust zones — governance effort scales with autonomy × authority × criticality, a model arrived at independently at least five times.
• Model Context Protocol — standardises how an agent reaches a firm’s systems and nothing about whether it should; it secures the pipe, not the counterparty.
• Non-human identity — an agent authenticating as its builder writes the wrong actor into the audit trail, and logging cannot fix that afterward.
• The jagged frontier — capability is jagged, not level, and just past the boundary the tool makes competent people measurably worse.

Patterns — how it’s built

• Three-zone architecture — a gate is a zone transition with a border to enforce; without zones, a gate is a meeting that changes nothing.
• Dual-LLM quarantine and friends — the only defence family here whose guarantee doesn’t depend on the model behaving, bought with about seven points of utility.
• The agent control plane — registry plus observability plus policy enforcement; interposition is what makes it a control rather than a service.
• Threat-modeling a citizen agent (worked example) — one agent, end to end, where the control that looks decisive leaves overall risk unchanged.

Controls — what mitigates it

• Identity and access for agents — its own identity, credentials scoped to the task and expiring before an incident matures; the IAM a firm already runs will do it.
• Egress control — the cheapest trifecta leg to cut, but only if every channel is enumerated: blocking curl leaves the agent’s own rendered output alone.
• Sandboxing and isolation — worth exactly what provably runs inside it, and that set is always smaller than the team assumed.
• Human approval gates — put them where a human can genuinely judge and damage cannot be contained; everywhere else they manufacture rubber-stamping.
• Logging and audit — an output log falls short of an audit trail; the trail carries the decision chain, because that is what reconstruction means.
• Secrets management — design so the agent never holds the credential; scanning and rotation are races that must be won continuously.
• Kill switches and revocation — killing the process leaves revocation undone; the honest test is what the identity can still do for the next hour.
• Runtime guardrails and policy enforcement — a guardrail the agent could choose not to invoke is self-regulation.
• Agent inventory and registry — registry coverage is the hard ceiling on governance coverage; the registry is the denominator rather than paperwork.
• Data access governance — vector indexes and on-behalf-of permission models both quietly fail to inherit the entitlements people assume they inherit.
• Supply-chain vetting — every programme on the market gates admission, and the attacks arrive through updates.
• Cost controls — a containment control, not finance hygiene, and the two tools most firms reach for have holes exactly where agent spend lands.

Tools — who sells it

One page per category, never per vendor. Each applies the same enterprise bar and says where the category is immature.

• Enterprise AI assistant platforms — ChatGPT, Copilot and Claude sit at parity on the published enterprise bar, so where the data already lives decides.
• Low-code agent platforms — the platform decides which controls exist at all, and on the category leader the governance layer is a paid tier.
• AI gateways (and MCP gateways) — the one place to put auth, logging and egress policy in front of every model call; an enforcement point, not a detection point.
• Guardrail products — probabilistic filters bought to solve an architecture problem: fine as a layer, dangerous as the line of defence.
• Observability and eval platforms — two products, not one; decide where the traces live first, because that store is a records system.
• Agent runtime security — no credible vendor yet, and the absence of a leader is the finding: runtime controls come from architecture.
• Identity platforms for agents — an anchor inside every stack already bought and nothing at all between them.
• DSPM and data classification — how a firm finds out what an agent can reach before the agent demonstrates it.
• Comms archiving and surveillance — these vendors survived the off-channel enforcement wave; agent execution records still have no retention grade.
• AI governance platforms — a registry that maps to no enforcement point is a compliance artifact, not a control.
• Domain-specific finance AI platforms — converts the governance problem from code review into vendor oversight, which is a trade worth making.

Implementation — when to build what

• Day 3 sequencing — the canonical order, sized for 20–500 people. Hubs link here rather than restating it.
• 90 — without a named metric, owner and decision date it will still be running in a year, and by then it is production.
• Build vs buy — buy the platform, build the agents on it, and treat the contract terms as the real deliverable.

Operation — what you do forever after

• Promotion gates — a named approver with authority to say no and a recorded decision; the form is the least important part.
• Risk-tier assignment — builders under-tier their own agents, so the scorer cannot be the owner.
• Evals — a demo is an anecdote; 4 of 30 indexed deployed agents ship safety evaluations, so the firm’s eval is probably the first the agent has faced.
• Registry review cadence — an unreviewed registry is a list of what the firm believed last quarter; the calendar is the control.
• Agent incident response — containment that revokes tokens and terminates sub-agents, and evidence that includes prompts and traces.
• Offboarding agents and owners — the departing human is the trigger firms miss; the agent keeps running on their credentials.
• When to involve legal and compliance — the clock starts at the vendor’s awareness, and the conversation assumed to be privileged is not.
• Supervisory review — archiving falls short of supervision, and logged but unreviewed is the worst of the three positions.
• Exam readiness — supervisors published the questions they will ask about AI, and almost nobody in this industry has read them.

People — who does it

• Citizen developer roles — Davenport’s builder taxonomy plus the role every taxonomy misses: the verifier.
• The reviewer pool — “a senior person will look at it” describes an intention rather than a pool; size the named bench before the gate that depends on it opens.
• Training curriculum — 40 to 80 hours is the documented range, graded on visible judgment rather than on whether the deliverable runs.
• The support model — incentives to surface hidden use beat bans; whether the hub belongs at the centre or in the business units is genuinely unsettled.
• Compliance as an approver — the failure-to-supervise defence needs a system for applying the procedures, which an unlistable agent fleet destroys.

Reference

• Glossary — the terms, defined once.
• Crosswalk: concern → dimension → control → gate → maturity — generated from the link graph; the table an examiner will actually ask for.
• Frameworks — ISO 42001 and friends, NIST AI RMF, OWASP, ATLAS, SAIF, and which ones are worth the time.
• Templates and checklists — the printable artifacts: intake form, tiering rubric, gate checklists, user contract.
• Bibliography — what to read in full after this.
• Open questions — what nobody knows yet.
• Changelog — what changed and when.

Status legend

Every page carries a status in its front matter:

• settled — the evidence converges and the page states a position.
• contested — credible sources disagree; the page shows both and dates each.
• unverified — asserted but not checked against a primary source.
• speculative — ahead of current practice, labeled as such.

confidence is separate and describes how much the page’s own recommendation should be trusted: a page can be settled about what the evidence says and low-confidence about what to do. last_verified is the date someone last checked the sources, not the date the file changed; vendor and market claims age in months.

The evidence is graded; the advice is not

Findings on these pages carry their vintage, sponsor, sample and confounds. Recommendations carry nothing, and most of them cite nothing, because no source supplies them, yet they are written in the same voice. Treat every “What to do” section as practitioner judgment unless it cites something. Human approval gates marks the seam explicitly for anyone wanting to see the distinction on the page.