{"id":17132,"date":"2026-11-09T16:16:17","date_gmt":"2026-11-09T21:16:17","guid":{"rendered":"https:\/\/blog2workato.wpengine.com\/?p=17132"},"modified":"2026-11-09T16:16:19","modified_gmt":"2026-11-09T21:16:19","slug":"bridging-control-and-execution-in-ai-governance","status":"publish","type":"post","link":"https:\/\/blog2workato.wpengine.com\/bridging-control-and-execution-in-ai-governance\/","title":{"rendered":"Bridging Control and Execution in AI Governance"},"content":{"rendered":"\n

Ask a CISO what keeps them up at night with AI agents, and you\u2019ll hear about control. Ask a CIO, and you\u2019ll hear about results.<\/p>\n\n\n\n

On October 15, Workato CISO Hans Gustavson and CIO Carter Busse sat down with Carly Urmann, Director of Product and Growth Strategy, to argue that those are the same problem.<\/p>\n\n\n\n

The stakes are personal. In a recent Workato and Censuswide survey<\/a> of 1,000+ enterprise IT leaders, 74% said they\u2019d be held accountable if an agent went rogue, no matter who built it.<\/p>\n\n\n\n

Everyone has a policy. Almost no one has enforcement.<\/h2>\n\n\n\n

EY found<\/a> that 98% of large U.S. enterprises have a formal AI governance policy, and 47% admit they\u2019ve skipped it for an urgent deployment. <\/p>\n\n\n\n

When presented with these numbers, Hans wasn\u2019t surprised. At Workato, AI adoption initially outran the company\u2019s ability to see it. Procurement and change-management reviews caught some of it, but blind spots remained. Then citizen developers started building agents and vibe-coded apps with no concept of a software development lifecycle.<\/p>\n\n\n\n

\u201cEnforcement means a control holds up, even if it isn\u2019t followed perfectly, and we have evidence to show it.\u201d – Hans Gustavson, CISO, Workato<\/em><\/p>\n\n\n\n

A rule against sending customer data to unapproved models is just intent. It becomes enforcement when the system blocks the action itself.<\/p>\n\n\n\n

Five questions that size up any agent<\/h2>\n\n\n\n

Not every agent deserves the same scrutiny. Hans\u2019s team sorts agents into risk tiers, then asks five questions every time:<\/p>\n\n\n\n

    \n
  1. What can it touch?<\/strong> Tools, connectors, MCP servers, and anything destructive or irreversible.<\/li>\n\n\n\n
  2. What data can it reach?<\/strong> And how sensitive is it?<\/li>\n\n\n\n
  3. How is it limited?<\/strong> Who can actually use it?<\/li>\n\n\n\n
  4. What did it actually do?<\/strong><\/li>\n\n\n\n
  5. Can I prove it to an auditor?<\/strong><\/li>\n<\/ol>\n\n\n\n

    Tiers set the level of human oversight. Workato\u2019s security operations agents triage thousands of signals, and a playbook pulls in a human only where consequences are high, which Hans put at roughly 20-30% of events. An internal Q&A agent tied to a knowledge base runs with no human in the loop.<\/p>\n\n\n\n

    The rule: humans show up where the consequence is.<\/p>\n\n\n\n

    The door is guarded. The building isn\u2019t.<\/h2>\n\n\n\n

    Gateways and proxies get the attention, and Hans was blunt about where they stop. They were designed around a person at a keyboard. Agents run headless in the cloud, call APIs directly, and connect through OAuth grants and MCP servers, often never touching a managed endpoint.<\/p>\n\n\n\n

    A gateway can authenticate an agent at the door. Downstream, it\u2019s frequently a shared service account, so the trail ends at an account instead of a person. Traffic, credentials and catalogs sit in separate tools with separate owners, and none of them sees what the whole business process did with the result.<\/p>\n\n\n\n

    For third-party MCP servers, Hans\u2019s advice is practical: \u201cyou can\u2019t read a vendor\u2019s code, but you can test how it behaves.\u201d<\/em><\/p>\n\n\n\n