Visibility is where, why, how, and by whom an agent is used, and a firm that can answer all four still has nothing until someone holds the authority to intervene. Monitoring without the power to stop things is a dashboard.
Why this matters
The best definition in the literature comes from a peer-reviewed paper on agent visibility, and it is worth adopting whole: where, why, how, and by whom agents are used. It is a better organizing question than “do we have logs,” because it names four things a log alone answers badly. The same paper gives the three measures that supply them, and those three are the floor: agent identifiers, which map onto agent inventory; real-time monitoring, onto runtime guardrails; and activity logging, onto logging and audit.
It also supplies this dimension’s boundary, in the authors’ own words: visibility is not sufficient, because those harmed may lack the power to intervene. Every incident review that ends “we had the logs” is that sentence being learned the expensive way. Observability earns its budget only when paired with kill switches and gate authority.
Nobody knows how common any of this is, and the surveys disagree by enough to prove it. In an unsponsored US tracking survey of 801 enterprise decision-makers, 35% had a policy covering monitoring and auditing of AI outputs. That sits near the bottom of the responsible-AI policy list, up 8 points year over year, and 24% among the smallest firms surveyed ($50M–$250M revenue), the closest cut to a fund. In a vendor-sponsored survey of C-suite leaders at $1B+ firms fielded the same season, 85% claimed continuous monitoring among their agentic-governance measures. The two ask different questions, policy inventory versus agentic self-report, but the gap is why no “N% of firms monitor their agents” sentence is safe. Note also that the first number measures whether a policy exists, not whether telemetry does.
The business case, such as it is: firms with real-time monitoring were reported 34% more likely to see revenue-growth improvement and 65% more likely to see cost savings. That is an odds ratio from an ordered logistic regression on self-reported outcomes at $1B+ firms, with the comparison groups undisclosed. It is almost certainly confounded with overall maturity, and the publisher claims no causation, so the number can open a budget conversation but cannot close one.
Two structural blind spots decide where the money goes. Monitoring is almost always scoped to a session, and the attacks that matter cross sessions and cross agents: see cross-session delayed detonation and multi-agent cascades. Sub-agent detection is explicitly unsolved in the visibility literature, not merely unimplemented. An agent that spawns children on its own credentials is invisible to a control keyed on registered identities.
For a regulated fund the trace store is a recordkeeping system before it is a debugging tool, and that is the second reason to care where traces live: it holds full prompts and tool outputs, positions, counterparties, client identifiers. Retention and residency get settled before scorers are compared; see observability and eval platforms.
Where you stand
| Level | Looks like | Cheapest next move |
|---|---|---|
| Crawl | Agent activity is indistinguishable from user activity in every log the firm owns. | Give agents distinguishable identities so their traffic can be separated at all — the prerequisite for every row below. |
| Walk | Traces exist inside each platform. Nobody joins them, and nobody looks unless something broke. | Route agent traffic through one chokepoint so there is a single log to query, and decide retention on the trace store now. |
| Run | Identifiers, activity logs and runtime monitoring joined on a common ID; alerts have owners; a named person can stop an agent. | Add one cross-session check: does anything reconcile what an agent wrote last week against what it reads this week? |
| Fly | Detection conditions on execution history, sub-agent lineage is tracked, and monitoring findings feed tier changes automatically. | Test the intervention path, not the detection path. Time from alert to actual stop is the metric. |
Concerns this dimension covers
- Shadow agents — an agent that never registered cannot be monitored, and its traffic looks legitimate to every network control the firm owns.
- Multi-agent cascades — individually compliant agents composing into a violation no single-agent view catches.
- Cross-session delayed detonation — compromise that outlives the logged session.
- Oversight decay — what alert volume does to the people reading the alerts.
Controls that answer them
- Agent inventory and registry — identifiers first; everything else joins on them.
- Logging and audit — the decision chain, not the output log.
- Runtime guardrails and policy enforcement — enforcement that can condition on what the agent already did.
- Kill switches and revocation — the authority without which the rest is decoration.
- Built as: the agent control plane.
Who sells it
- Observability and eval platforms — traces, scorers, and the standards fight underneath them.
Sequencing and where this is checked
- Day 3 sequencing — visibility is the Day 1 move by consensus, and the consensus is right for once.
- Registry review cadence — reconciling the registry against observed traffic, the only test of whether the registry is real.
- Agent incident response — where the logs earn their storage bill.
Open questions
- What would a cross-session detection benchmark measure? None exists, and the attack class with the least coverage is the one with the longest dwell time.
- Sub-agent detection is unsolved in the published literature. A vendor claiming it should be asked what happens when the child runs on a personal API key.