Enterprise artificial intelligence (AI) governance flipped from permission to containment last month, and the tell is in what shipped. Over the past year one in three firms watched staff slip past an approval queue that was too slow. Half of the agents security teams find have no known owner. The brake the industry added in September is aimed at that group, but it can only stop what someone can name. [5]

The big picture:

The new standard for AI control is the power to stop, not the power to start.

Rules used to gate an agent before it ran. OneTrust’s 2026 AI-Ready Governance Report, out on 14 September, shows how that went. It polled 1,200 senior staff in eight markets. In 87% of their firms, agents are encouraged. Only 47% say that use sits behind clear rules, oversight and controls. [1]

Bad days are now the norm. Eighty-six percent had at least one AI-related incident in the past year, and 28% had two or more in which a system or agent took a step that was not approved. Only 27% slowed or paused their AI work in reply. I keep coming back to that mix. The incidents are common enough to be a baseline, and the reflex is still to press on. [1]

Okta supplies the other half of the story. On 22 September it shipped single sign-on (SSO) for agents, agent-to-agent links and access sign-offs. Then it dated the parts that matter for control. Its agent gateway and its hunt for hidden agents were set for the third quarter. The wider kill switch, which cuts live tokens at that gateway, was set for the fourth. [2]

Twelve firms that otherwise compete agreed on one principle that day. Okta, Amazon Web Services (AWS), CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler launched the Blueprint Alliance, a group formed to run an agent estate as one governed system. Their shared aims start with identity and a traceable chain of delegation, and both name containment that is “instant and reversible.” [3]

Okta’s own poll of 306 security chiefs points at the wider block. Forty-eight percent say poor sight of AI identities is what stops them, rising to 74% in the United States. [6]

Put the two releases side by side and the drift is plain. The gate is what is being demoted. The brake is what is being built, dated and standardised.

By the numbers

  • 87% vs 47% — Encouraged, not governed: firms that encourage agent use against those whose use has clear rules, oversight and controls [1].
  • 86% — Incidents are the baseline: firms that had at least one AI-related incident in the past year; only 27% slowed or paused their AI work in reply [1].
  • 33% — Shadow AI by queue: firms where staff used unapproved AI because the approved tool or path was not quick enough [1].
  • 79% vs 2% — Live against governed: firms already running agents in production against those with identity tools built to govern them [4].
Kill Switch Misses Half Your Agents Figures as stated in this article's own numbers section (verified figures, %) Encouraged, not governed 87% ([1]) Shadow AI by queue 33% ([1]) Live against governed 79% ([4])

What I’d watch:

The people closest to this are already arguing over where the money goes, and I think three things decide whether containment-first is real or a slide deck.

  • The dates, not the features. Okta’s own note says the gateway and the runtime kill switch are planned for later quarters, not shipping today. [2] A brake you are still waiting for governs nothing.
  • Whether a hunt finds owners. SailPoint’s teams report that half of the agents they find have no known owner, and that one large firm which thought it ran none later found thousands, many holding standing admin rights. [5] A list with no named human on it is an asset register, not a control.
  • The first contested stop. The sharpest story from that event was an agent that reached cluster admin rights in under a second by running 14,000 actions and working with other agents. [5] The first time a firm pulls that lever, the trail left by the stop becomes the record a watchdog will read.

Old habits are the other thing to watch. Only 5% of the OneTrust group say who does what is clear across the life of an AI system, and 47% call their own oversight slow, manual or reactive. [1] A slow review does not get fast because a seller adds a button.

The catch

A brake only works on agents you can name, and naming is the weak spot.

The same data that shows half of found agents have no owner also shows why. One in three firms saw staff leave the approved path because it could not keep up. Cutting access is a way to halt harm, not a fix for the cause.

I would read the sourcing with care as well. The two loudest claims in September came from vendors selling the control layer, and the event write-up with the best lines says up front that it was paid for by the conference. [5] The adoption data is worth the attention. I could be wrong, but the idea that a kill switch settles who answers for an agent looks like marketing until a watchdog or an incident report says otherwise.

The approval step is not the villain either. It is the one place where a named person agrees to carry the risk. Drop it without putting something in its place, and the risk does not go away. It lands on whoever notices the agent first.

At a glance

  • The Big Shift: Agent governance has flipped from permission-first to containment-first. 86% of firms had an AI incident in the past year, a third watched staff skip the approval queue, and the answer that shipped in September was a runtime kill switch and a 12-firm alliance, not a faster review.
  • Why It Matters: Control now means cutting live access, not signing off before launch. That changes what counts as proof, and it strands any program whose only evidence is an approval record.
  • What I’d Watch: whether the cut-off path ships on the vendor timeline, and whether a hunt for hidden agents turns up owners rather than lists.
  • Runtime cut-off: killing an agent’s live tokens mid-task, so it stops at once instead of waiting for the next review.
  • Shadow agent: an agent running without approval or a registered identity, so nobody answers for what it touches.
  • Agent owner: the named person who carries the risk of an agent’s acts and can order it switched off.
  • The Catch: a kill switch only reaches agents that someone can name, and half of the ones found have no owner. A vendor launch is not proof that anyone answers for the work.

Related reading

Sources

[1] OneTrust — “OneTrust Research: 86% of Organizations Experienced AI-Related Incidents, yet Few Slowed Deployment” (https://www.onetrust.com/news/onetrust-research-86-of-organizations-experienced-ai-related-incidents-yet-few-slowed-deployment) [2] Okta — “New Okta for AI Agents innovations increase visibility into agent behavior, secure connections at runtime, and enforce continuous agent governance” (https://www.okta.com/newsroom/press-releases/ai-innovations-oktane-2026) [3] Okta — “Industry leaders form the Blueprint Alliance to advance a shared architecture for securing AI agents” (https://www.okta.com/newsroom/press-releases/industry-leaders-form-the-blueprint-alliance) [4] SailPoint — “From Chaos to Control: SailPoint Unlocks a Secure Agentic Era with Autonomous Identity Security” (https://www.sailpoint.com/press-releases/sailpoint-unlocks-a-secure-agentic-era-with-autonomous-identity-security) [5] SiliconANGLE — “18 insights from SailPoint’s Navigate event: Enterprises race to bring identity security for AI agents up to machine speed” (https://siliconangle.com/2026/10/09/identity-security-ai-agents-18-insights-from-navigate-2026-sailpointnavigate) [6] Okta — “Global CISO Insights 2026” (https://www.okta.com/newsroom/articles/global-ciso-insights-2026) [7] OneTrust — “The OneTrust 2026 AI-Ready Governance Survey Report” (https://www.onetrust.com/resources/onetrust-2026-ai-ready-governance-report)