Start with the number that should reset every board conversation this week: a production enterprise ran agent discovery and reduced 100,000 non-human identities to 72 that warranted active governance (SiliconANGLE). The same report describes a firm that found 10,000 agents, many holding standing admin privileges, after it looked. Read that as the default state of any organization moving agents past pilots. Sprawl is not a failure mode, it is what happens when deployment outruns discovery.
Today's signals line up in one direction. Third Moment Research runs 10,000 concurrent agents for 36-plus hours per run (OpenAI). Chow Tai Fook put 400 agents behind 24,000 employees (Technology Record). Hexaware brings 600 pre-built agents and 1,100 certified practitioners into enterprises as a delivery default (ffnews). Amp is pushing agents out of engineering into general operations (OpenAI). Each one expands the Identity Control Surface, and each one does so faster than the governance that should sit underneath it.
Here is the tension the index captures. Organization sits at 72 and nudged up again this week, with Workforce AI Access, Scaling Maturity, and Talent and Upskilling all moving. That is the adoption story principals want to tell. But Dataiku's data says only 24% of CIOs globally report mature ROI measurement (Computer Weekly). The market is scaling deployment faster than it is scaling the ability to tell whether deployment works, or whether it is safe. When a client cites peer adoption as a reason to accelerate, that 24% figure is the counterweight to put on the table.
The practical shift is in where oversight lives. At 10,000 agents running a day and a half, no human touches an individual agent action. Oversight has moved to the orchestration layer. If your access controls still assume agent-by-agent approval, they are governing a world that no longer exists. The audit question for this week is blunt: can you run agent discovery, and do you have a kill switch? Unum stood one up in two weeks. That is the bar, and it is reachable.
Do discovery before the next production rollout, not after the incident. The 100,000-to-72 gap is the risk you are carrying right now whether you have measured it or not.
Watch: Figma's agent operating rules entering open beta. If a platform codifying how agents may act spreads beyond design tooling into other SaaS categories, the rules of agent behavior start getting set by platforms rather than by enterprises. Track whether a second vendor publishes comparable control specifications. That is the moment the Decision Surface moves out of your hands.
WatchFigma's agent operating rules entering open beta signal a design-tooling platform codifying how agents are permitted to act within its environment. If that model extends to enterprise software categories beyond design, it becomes a Decision Surface precedent: platforms, not enterprises, setting the rules of agent behavior. Worth tracking whether other SaaS vendors follow with comparable control specifications.