Ask any CIO who gets paged when a production server goes down at 2 a.m. You’ll get a name in under a second.
Now ask who gets paged when an AI agent does something wrong at 2 a.m. Watch the pause.
That pause is the biggest gap in AI adoption right now, and it widens every week. The industry has moved from AI that answers questions to AI that operates the business. Almost nobody has built AI agent operations to match, and that job has less to do with models than with the discipline IT teams have run for decades.
From Answers to Actions
For two years, the pattern was simple. An employee asked a question, the AI answered, and the employee decided what to do. The human stayed in the loop because the human was the loop.
Agents break that pattern. An agent takes an objective, pulls context, calls tools, makes decisions, executes the work, checks the result, and escalates when it’s stuck. On September 10, OpenAI released its Agents API in public beta, built for agents that coordinate subagents and keep running for days. Every major enterprise platform vendor is building the same capability into its stack.
The moment software can act on your behalf, you no longer have an AI question. You have an operations question.
I spent 20 years at IBM and Kyndryl on the operations side of that line, and I recognize this moment. We’ve been here every time a new kind of system showed up faster than the processes built to run it.
The Numbers Say Nobody Owns This
IBM’s research, presented at Think 2026, found that most large enterprises will run more than 1,600 AI agents by the end of this year. The same research found only 18% of organizations maintain a current, complete inventory of their AI.
Ownership looks worse than inventory. Gravitee’s 2026 State of AI Agent Security report found just 7.2% of organizations have a named individual formally accountable for agent behavior. Most described accountability as unclear, shared but undefined, or never discussed.
Read those numbers together. Most companies can’t list their agents, and fewer than one in thirteen can name who answers for them.
This Isn’t Only an Enterprise Problem
If you run a 60-person company, you’re not running 1,600 agents. You might be running six: a scheduling assistant with calendar access, an agent in your help desk, a Copilot flow touching SharePoint, a feature your ERP vendor switched on last quarter.
The question is identical at that scale. The difference is that nobody on your team has agent operations in their job description, because you don’t have that team. The agents arrived anyway.
This Is ITSM With a New Kind of Worker
In every transition program I ran at IBM and Kyndryl, nothing reached steady-state operations without the same handful of things: a named owner, a record in the configuration database, monitoring, a runbook, and an escalation path. With 200+ engineers across global teams, that gate wasn’t bureaucracy. It was the price of being allowed to touch a client’s production environment.
AI agents are walking around that gate. They show up through a business unit’s SaaS subscription, a developer’s API key, or a vendor’s feature toggle. None of those paths runs through service transition, so the agent lands in production with more access than a new hire and less oversight than a printer.
The good news is that you don’t need to invent a new discipline. You need to extend the one you already have.
The Agent Operating Model: Eight Questions Before Go-Live
These are the questions I want answered in writing before any agent touches a production system. Each one maps to an operations practice most companies already run for servers and applications.
1. Who owns it?
A name, not a team. Every agent needs a business owner who wanted the outcome and a technical owner who answers the page. If both answers are “the AI team,” neither owner exists.
2. Where is it recorded?
Every agent belongs in a registry: its purpose, the model it runs on, the systems it touches, the data it can see, its owner, and its go-live date. Think of it as a configuration database for agents. If an agent isn’t in the registry, it doesn’t run.
3. What identity does it use?
An agent should have its own identity. Never a borrowed human login, and never a shared API key buried in a config file.
On September 18, Google disclosed that Gemini got into three outside systems during a May test by guessing logins or using credentials it found in a public repository. Credentials are the attack surface. It’s no accident that Oracle’s new MCP gateway is built around identity, policy, credentials, and observability.
4. What can it touch?
Scope the agent to the smallest set of tools and data the job requires. Start read-only, and expand only after you’ve watched it work. I wrote in August about why written instructions aren’t a control. Permissions are.
5. When does a human decide?
Sort every action into three classes: the agent acts alone, the agent acts and notifies, or the agent proposes and waits. Anything irreversible, customer-facing, or above a dollar threshold belongs in the third class. This is change management, rewritten for a worker that never sleeps.
6. How would you know something went wrong?
Log every tool call and alert on the unusual ones. Google didn’t learn about the Gemini intrusions until July, roughly two months later, when the testing firm reviewed its own work. If Google can go two months without knowing, assume you’d go longer.
On a Fortune 500 account at Kyndryl, we improved incident detection by 38% and documented more than $2 million in savings. We didn’t get meaningfully better at fixing things. We got better at seeing them. Agents need that instrumentation before they get autonomy.
7. What happens when it fails?
Agent failures belong in your existing incident process: severity levels, rollback steps, root cause analysis. Someone also needs the authority, and the button, to shut an agent down in minutes rather than days. And when the agent’s job ends, somebody has to offboard it.
8. What does it cost, and is it worth it?
Attribute spend to each agent and measure it against the outcome it was deployed to produce. Token prices keep falling, but total bills don’t. An agent nobody measures is an agent nobody can defend at budget time.
Start With the List
You don’t need a new AI governance committee. You need your existing ownership, identity, change, incident, and monitoring practices to treat agents as something they’re responsible for.
So start this week with one task: build the list. Every agent running in your business, who owns it, and what it can touch. For most companies that list takes longer than expected, and that is the finding. If you can’t finish it, you’ve found your first project.
The industry spent two years asking what AI can do. The next two years belong to the companies that can answer a simpler question: who’s running it?
Not sure how many agents are already running in your business? An AI Infrastructure Assessment starts with exactly that inventory. Start the conversation here.
Ready to put agents into production with an operating model behind them? See how our strategy, implementation, and adoption services fit together.
Want the deeper dive on agent lifecycle? Read Nobody Offboards an AI Agent on the Summit AI blog.
Russell Love is the Founder & CEO of Summit AI Business Solutions, based in Browns Summit, NC. With 20+ years of enterprise transformation experience at IBM and Kyndryl, Russell helps businesses build the foundations that make AI actually work.