Out-of-Band Agent Governance: The Four Controls an Agent Cannot Route Around

Out-of-band agent governance in four controls: Census, Chokepoint, Custody, Cutoff. Why agent inventories run 3x short and kill switches fail.

Out-of-band agent governance is the only kind that survives contact with a real agent fleet, and the vendors who shipped this month all agree on why. I work with Fortune-level enterprise clients architecting and building agentic frameworks, and the question that ends the most meetings is the simplest one: how many agents are running right now? Someone always answers. The answer usually comes from a spreadsheet, a wiki page, or an intake form. Then somebody pulls the gateway logs, and the number moves.

That gap is not a hygiene problem. It is the whole governance problem in miniature. Every control we put around agents inherits its accuracy from a list, and the list is built from what the agents and their builders volunteered.

Snyk's 2026 State of Agentic AI Adoption, Volume II put a number on it. Across 500+ assessments, a system-level AI bill of materials surfaced an AI footprint roughly three times larger than model-only counts. Security teams are seeing about a third of what they actually run. The Cloud Security Alliance found in April 2026 that 82% of organizations had unknown AI agents in their environments and 65% had an agent-related security incident in the prior twelve months. SAP's LeanIX Agentic AI Survey 2026 reports 98% of companies have deployed agents or plan to, while fewer than half have visibility into an inventory at all.

Here is the POV those numbers point at, and it is not the one the category is selling. Agent governance is not primarily a policy problem. It is a discovery and enforcement-location problem, and the deciding question for any control is whether it still works when the agent does not cooperate.

Why does in-prompt governance fail?

Redpanda stated the principle more cleanly than anyone this month: if the agent can see the policy, it is not governance. In-prompt rules, guard models, and in-process checks all live inside the agent's address space. They are visible, they are modifiable in principle, and they sit on the same side of the boundary as the thing they are supposed to constrain.

The failure mode is not that agents are malicious. It is that agents are persistent. Airlock Digital, announcing its own agent controls at Black Hat this month, made a point that deserves more attention than the product around it: agents pursue alternative paths rather than stopping when blocked. A control that assumes a blocked agent gives up is modeling a program that does not exist. Agents retry, reroute, and reach for a different tool. That is what the loop is for.

So the useful test is not "do we have a policy." It is:

The Cooperation Test. Does this control still work if the agent actively tries to route around it? If the answer requires the agent's cooperation, it is documentation, not a control.

Four positions pass that test. I have been calling them the Four Cs.

What are the Four Cs of out-of-band agent governance?

1. Census: where does the inventory come from?

If an agent has to be registered to be governed, your inventory is a self-report and it will undercount by roughly the amount Snyk measured. Registries decay the day someone ships an agent without filing a ticket.

The convergent design decision across every vendor that shipped this month is to derive inventory from the call path instead. Redpanda's Agent Network View is built from live traffic and needs no agent cooperation or registry upkeep. Cequence surfaces shadow agents, LLM providers, and MCP servers from existing SIEM logs, including the ones that skipped formal approval. Snyk's AI-BOM works at the system level rather than the model level.

None of them ask the agent. That is the tell.

What I'd actually do: treat your registry as a reconciliation target, not a source. Derive the real list from gateway and egress traffic, then diff it against the registry. The delta is your actual risk report, and it is a number you can trend.

2. Chokepoint: where is policy evaluated?

Enforcement has to sit on the wire, at a boundary the agent must traverse and cannot inspect. In 2026 that boundary is overwhelmingly the MCP tool call.

Redpanda's Out-of-Band Policy Engine enforces server-side at the MCP boundary: masking and dropping fields, clamping arguments, applying attribute-based rules, and rewriting tool schemas so that masking does not break the agent's contract. The policy attaches to the MCP server and is set once by the data owner for every connecting agent, rather than being configured per agent by whoever built it. Drata's MCP Proxy evaluates every tool call inline and stops a violating action before it executes. Snowflake's Cortex AI Gateway does the same across 100+ MCP servers with cost attribution attached.

The architectural point is ownership, not vendor choice. Policy authored by the data owner and attached to the resource survives the arrival of an agent nobody told you about. Policy authored per agent does not.

What I'd actually do: move one high-consequence tool behind a proxy that evaluates arguments, not just identity. Argument clamping catches the class of failure that authentication never will, because the agent is authorized. It is the value that is wrong.

3. Custody: where does the evidence land?

A dashboard owned by the platform you are auditing is not evidence. Governance produces a record whose integrity does not depend on the system under review.

Redpanda streams full-fidelity transcripts to an append-only, Kafka-compatible log deployed in the customer's own cloud, which keeps sensitive transcripts inside the customer account. Drata pairs reduced and masked telemetry with tamper-evidence and maps the output to ISO 42001 and AIUC-1 evidence logic.

This stopped being an architecture preference on 2 August 2026, when the EU AI Act moved into enforcement. The AI Office can now demand technical documentation, run evaluations, and issue fines up to €15M or 3% of worldwide turnover. Your agent trace is a compliance artifact now, which means the question "who could have edited this record" has a legal answer whether or not you have designed one.

What I'd actually do: write down, today, which of your agent logs are append-only and which are mutable by the service that produced them. Most teams have never made that distinction, and it takes twenty minutes to answer.

4. Cutoff: can you stop it without the agent agreeing?

A kill switch that runs through the agent's own loop is a polite request. If stopping an agent requires the agent to read a flag, check a status, or honor a signal, then stopping depends on the loop still working, which is precisely the condition you cannot assume in the incident where you need it.

Revocation belongs at the chokepoint. Cut the credential, cut the tool, cut the route. Redpanda's kill switch is evidence-driven and previewed alongside the transcript log for exactly this reason. Snowflake's identity partners issue short-lived, task-scoped access so that revocation is often just expiry. Cequence brokers credentials through the gateway so agents never hold provider keys directly, which means a revoked key is revoked everywhere at once rather than in however many places it was copied.

What I'd actually do: run the drill. Pick one production agent, revoke it at the chokepoint, and time how long until it stops taking actions. If the answer is "we would have to redeploy," you do not have a cutoff.

Why does this matter now?

Gartner projects the average Fortune 500 enterprise will run more than 150,000 agents by 2028, while only 13% believe they have adequate governance today. That ratio is the actual story. The gap is not going to be closed by better policies, because the constraint is not policy quality. It is that every control we have is downstream of an inventory that is wrong by a factor of three, and every enforcement point we trust sits inside the thing it is supposed to enforce against.

Governance built out-of-band scales with traffic. Governance built on cooperation scales with headcount and paperwork, which is to say it does not scale at all.

Run the Cooperation Test on your own stack this week. Take your four most-cited agent controls and ask, for each one, whether it holds if the agent tries to route around it. My experience is that one or two survive, and the surprise is usually which ones.

Sources: Redpanda, "Agentic AI needs out-of-band governance"; Snyk 2026 State of Agentic AI Adoption Vol. II; SAP LeanIX Agentic AI Survey 2026; Cloud Security Alliance, April 2026; Drata AI Agent Governance; Cequence AI Gateway; Airlock Digital (Black Hat USA 2026); Snowflake Cortex AI Gateway; Help Net Security on EU AI Act enforcement.

This post covers Scale 3, the human-agent team. Part of the enterprise AI agent governance pillar guide, which maps the four scales at which agent governance fails independently.