150,000 agents per company by 2028. Who is actually in control?

Gartner put a number on something many of us already felt: by 2028, the average global Fortune 500 enterprise will have over 150,000 agents in use. In the same release, only 13% of organizations said they believe they have adequate AI agent governance in place. Some sectors are already there: in financial services, fleets of agents already operate as part of the workforce. This is already in production in North America; Europe will likely take longer, notably because of labor and data regulations.  

Those agents will not live in one place. VentureBeat's Pulse research from July 2026 found enterprises running an average of 3.1 agent orchestration platforms at the same time. The sample is small and skews toward tech-heavy organizations, so it should be read as a directional indicator rather than market share, but the direction is clear. 

So, the question is no longer whether companies will run agents at scale. It is this: when an agent acts on your systems, who decides it can, and can you stop it? 

Over the past months, our GenAI engineering team studied that question in depth: what a control layer for a fleet of agents must cover, what the market offers today, and how to put one in place without waiting for a standard that does not exist yet. We deliberately leave one question aside here: what it means, for HR and for management, to run a workforce that never tires, needs no motivation and never asks for a promotion. That deserves its own discussion. Here is what we learned. 

Traditional software executes rules someone wrote. Behavior is fixed and repeatable, every step was approved in advance, and when something goes wrong, you can trace it back to a line of code. Ask it to compute 2 + 2, and you get 4, every time. 

An agent works differently. Ask it to reconcile an invoice and it chooses the steps itself, at run time, and may choose different ones tomorrow. When it gets something wrong, the error traces back to a judgement, not a rule. 

That shift moves the risk from delivery to decision. And because agents now act on live APIs, data and business applications, sometimes in front of external users, the risk lands directly on operations. Owners and auditors end up asking one very simple question: who did what, under what authority? 

Most organizations already have monitoring, identity management, network controls, governance policies, and cost tracking. The problem is that each of them stops short of the agent: 

→ Monitoring shows what happened, after the fact, in dashboards segmented by use case. Agents need a live view and the ability to act while they run. 

→ Identity and access was designed for human users and shared service accounts, not for an agent acting on behalf of a user. Agents need their own identity, with scoped rights that can be revoked. 

→ Connectivity controls see traffic, not intent. They cannot tell a legitimate call from a well-formed but inappropriate one. 

→ Governance rules that are too rigid push teams toward Shadow AI. What works is one policy with one enforcement point across every path. 

→ Cost controls breaks down for agents: retries, loops, and runaway token usage go unbudgeted, and agents can trigger third-party services with their own pricing. Cost comes from multiple, heterogeneous sources, so budgets and rate caps must apply per agent and per user.

In other words, traditional controls stop at the connection. Agentic controls have to protect the operation itself. That is what we call an Agentic Control Tower. 

We structured the scope into seven pillars, broken down into 42 capabilities, each with a concrete test a solution should be able to demonstrate: 

✓ Inventory and lifecycle: which agents exist, on which platform, in which version, at which stage 

✓ Identity and access: who the agent is, what it may reach, with which credentials, for how long 

✓ Observability and traceability: what the agent actually does in production, down to each model and tool call 

✓ Runtime control and safety: policies, guardrails, human approval, and a stop that actually stops 

✓ Evaluation and performance: whether the agent does its job correctly, and whether that drifts over versions 

✓ Governance, risk, and compliance: risk classes, approvals, evidence files, alignment with named frameworks 

✓ Cost and value: what the agent costs per run, and what it delivers against business KPIs 

Our view: runtime control is the pillar that matters most. It is what separates a tower that observes from a tower that protects. A beautiful registry of agents you cannot interrupt is an inventory, not a control system. 

We benchmarked eight solutions against those 42 capabilities: enterprise platforms, Hyperscalers and data-platform stacks, governance systems of record, agent management platforms, and a composable open-source stack. 

Three things stood out. 

No solution covers the seven pillars on its own. Each one has a clear center of gravity, whether identity, data, orchestration, governance, or infrastructure, and it is strong there. 

Governance and runtime control rarely come together. The solutions that are the strongest in risk classification, approvals, and evidence tend to be lighter at blocking an action before it happens. The stacks strongest on runtime control generally leave governance workflows to be built on top. Interrupting an agent in the middle of an active session, rather than blocking its next call, remains rare across the panel. 

Evaluation and cost per outcome are the least mature areas overall. Most solutions measure token spend; far fewer connect cost to the business result the agent was supposed to produce. 

This market is moving fast, and every player is shipping. That is precisely why we recommend testing capabilities against a common grid rather than comparing roadmaps. We have deliberately kept the solution-by-solution results out of this paper: scores age quickly, and they only make sense against a given estate. We walk clients through the detailed grid, capability by capability and test by test, in working sessions. 

There are three ways to put a control tower in place. 

Buy: a market Control Tower becomes the backbone. It is the fastest route when one ecosystem already dominates, at the cost of partial coverage of agents running elsewhere. 

Federate: a transversal layer sits over the platforms already in place, with a common registry and a shared model of agent, version and owner. It reuses existing investments and gives the widest coverage, in exchange for integration work. 

Build: a custom or open-source layer, engineered end to end. It gives full control and sovereignty, but lifecycle, runtime control, approvals, and evidence become yours to build and run. 

Our recommendation is to federate by default, unless the estate is so heterogeneous that no provider layer can carry it. In our estimates, federating roughly halves the time to control compared with a custom build, for the same seven pillars proven. 

The key idea is that the architecture follows where the agents already live. A Databricks-centric estate, an AWS-centric one, a data platform at the heart of operations or a fully open-source environment will not land on the same variant, and none of them should be forced to migrate onto a single platform just to be governed. 

Sia is its own client zero. Our GenAI engineers, who work as FDEs (forward-deployed engineers) at clients and in-house, built SiaGPT, our enterprise AI, back in Q1 2023, before we equipped the whole firm with a market solution this summer. One gap remained that no tool covered: a single place where every agent and application is visible to everyone, with a known owner, and from which it can be opened to a client once the technical team has validated security, cost and data. So we built it: AgentForge. Three lessons from that work, and from our client programs, shaped our thinking. 

The first is about evaluation. On one program automating document-heavy workflows, the hard part was never building the agents. It was proving they were reliable without having to review every output by hand. A three-tier approach made the difference: deterministic checks first, LLM-as-a-judge next, and human review kept for the high-stakes cases. Combined with a simple loop (find the failure, apply the smallest effective fix, re-run the evaluations), agent correctness went from 83% to 96% depending on the agent. 

The second is about the registry. We already run an inventory, intake, and reporting layer as an internal Sia asset, the AI Command Center, in production on program portfolios: one door to declare a new agent, automated checks on each submission, SLA, and usage reporting for the governance committee. It covers the first pillar well. Identity, runtime control, and evaluation still have to be added on top, and that is exactly where the real work of a control tower starts. 

The third is about how much framework is enough. On AgentForge, business consultants build their own agents and multi-agent applications with no-code and low-code tools, and test them in a sandbox where mistakes cost nothing (or close to nothing). Most had never written a line of code; many now act as AI delivery leads on client engagements. What keeps this safe is short, but non-negotiable: a named owner for every application, protected credentials and sensitive data, and governed access to models. Fifteen days after launch, sixty applications had been built, around ten of them already exposed to clients. More than a thousand agents are now available on our AgentStore, and internal adoption of our AI tools is above 80%. A light framework, strictly enforced, is what let us scale without losing control. 

We also built an illustrative demo of what a control tower could feel like on an open-source layer, answering three questions from a single view: what is running, is it behaving, and can we intervene? It is available on the Sia Agent Store as the AI Agents Control Tower, next to the AI-Powered Portfolio Hub, which applies the same single-view logic to program portfolios. For the cost pillar, the FinOps & Cloud Cost Optimization Agent brings the same discipline to cloud spend. 

Governing agents will not be solved by a single product this year. It will be solved by organizations that know which agents they run, give each one an identity and an owner, and can stop any of them without a crisis meeting. 

So here is a simple test for your organization: how many agents are running in production today, and could you stop one of them in the next five minutes? 

If the answer takes more than a few seconds, let's talk. In an hour, we can take you through the 42-capability grid, what the eight solutions actually demonstrated when tested, and which route fits your estate.