Managing agent sprawl.
Last updated 6 July 2026 · By Udal Systems
Agent sprawl is what happens when every team ships its own AI agent on its own stack, with its own prompts, tools, credentials, and data access — and no one holds the map. This is a governance playbook for platform, risk, and security leaders in regulated industries.
What agent sprawl actually looks like
A year into the agent wave, most enterprises don't have one agent programme — they have thirty. Sales built a research agent on a SaaS platform. Ops wired an orchestration agent to production APIs through a personal token. A quant team stood up an LLM router on a private VM. None of it is on an inventory. None of it shares policy. Cost lands in three budgets, incidents land in none.
The symptoms are always the same: duplicated capability, opaque spend, credentials that outlive the humans who created them, and audit questions no one can answer inside a week.
Why sprawl is a regulated-industry problem first
In finance and government, every agent that touches data inherits obligations — residency, retention, access review, model transparency, and tamper-evident audit. Sprawl means those obligations are met inconsistently. A single ungoverned agent that exfiltrates one document to a third-party model is not a productivity story. It's a regulatory event.
Agentic AI risk management is the discipline of preventing that event by governing autonomous systems across their whole lifecycle, not just at the model call.
Five controls that stop sprawl before it starts
1. One declarative manifest, one inventory
Every agent — regardless of the team that built it — is described by the same manifest schema. The manifest is the inventory. If it isn't in the registry, it isn't running.
2. Policy-as-code at the promotion gate
Controls belong in the deployment path, not in a policy PDF. Every manifest is evaluated against OPA rules before it can ship: allowed tools, allowed data classes, budget ceilings, required human-in-the-loop approvals. Non-conforming agents cannot be promoted.
3. Identity and scoped credentials, not shared tokens
Each agent gets its own identity in the same IdP that governs humans and services. Tool access is scoped and time-bound. Personal tokens embedded in a Jupyter notebook are how sprawl metastasises — kill them at the platform layer.
4. Budget and kill-switches per agent
Cost is a control, not a report. Every agent has a spend ceiling and a runtime kill-switch enforceable by risk, not just by the team that owns it.
5. Tamper-evident audit as the source of truth
OpenTelemetry traces with token-level cost attribution and a hash-chained audit log. When an examiner asks "what did this agent do on the 14th?", the answer takes minutes, not weeks.
How Udal maps to this
Udal is the governed platform for building and running AI agents inside your own environment. The five-stage lifecycle — Author, Check, Promote, Govern, Observe — is the paved road that makes the controls above the default path, not the difficult one. Sprawl doesn't start because there is nowhere else for a new agent to go.
- Author — one manifest schema (udal.io/v1alpha1) and a Python SDK, so every agent is described the same way.
- Check — structural validation and CI/CD eval gates before anything ships.
- Promote — GitOps to Kubernetes on ground your organisation already holds.
- Govern — OPA policy, RBAC, budget kill-switches, human-in-the-loop.
- Observe — OpenTelemetry traces and token-level cost attribution, wired to a tamper-evident log.