You don’t deploy your whole book on day one. You take a small position, mark it, and add size only where the exposure justifies it.
Why AI Governance Projects Stall Before They Start
The single most common reason an AI governance initiative dies in IT is not budget and not politics. It is the first line of the implementation plan: deploy an endpoint agent to every managed device. That sentence triggers a change-management gauntlet — packaging, ring testing, kernel-driver review, help-desk readiness, an EDR-compatibility bake-off — that can run a quarter or two before a single unit of value is realized. The project is under-water on day one, and it stays there long enough for the sponsor to lose the room.
Meanwhile the exposure is compounding. Gartner’s CIO survey puts agent deployment at 17% already live and 42% within a year; Ospiri’s own fleet research finds AI agents already active on endpoints in 88% of enterprises. The book is growing whether or not the risk desk has opened a position. Sequencing the control behind a two-quarter software rollout is the governance equivalent of waiting for the perfect execution venue while the market moves against you.
| Signal | Figure | Source |
|---|---|---|
| Enterprises with AI agents already active on endpoints | 88% | Ospiri research |
| CIOs with agents deployed / within one year | 17% / 42% | Gartner CIO survey |
| Incremental cost of an ungoverned agent incident | +$670K | Ospiri research |
| Typical build-to-value lag for endpoint-first rollout | 12–18 months | Ospiri research |
The reframe is simple: governance maturity is a ladder, not a light switch. You climb it in order of ascending cost and descending reversibility, and you never spend the expensive control where a cheap one clears the risk.
The Maturity Ladder
Think of it as three rungs — See, Contain, Enforce — each a larger commitment of capital and change-management surface than the last. The discipline is refusing to skip to the top rung out of vendor enthusiasm.
| Rung | What it delivers | Deploy cost | Reversibility | Time to value |
|---|---|---|---|---|
| See | Zero-install inventory of every AI tool, skill, and MCP server via identity, proxy, and GitHub | Near-zero — no fleet touch | Fully reversible (read-only) | ~1 hour |
| Contain | Interdiction through controls you already run — revoke, block, restrict | Low — no new agent | Reversible per-action | Days |
| Enforce | Kernel-level policy: copy-on-write, process and egress blocking with evidence | Endpoint agent, ring-tested | Designed reversible (sandbox, not delete) | Weeks, scoped |
Most vendors sell you the top rung first because it carries the highest ACV. The buyer’s interest runs the other way. You want the cheapest rung that prices the risk, and you want to measure before you commit the fleet to an install.
Where Rollouts Actually Die
The failure pattern is consistent enough to number:
- Step one is a fleet install. The plan opens with “deploy to every endpoint,” which routes the project straight into the change-advisory board before any inventory exists to justify it.
- The justification is theoretical. Without a See-rung inventory, the sponsor is asking for kernel-level deployment against a risk nobody has yet quantified. The board asks for evidence; there is none yet.
- The compatibility bake-off swallows the quarter. Endpoint-agent coexistence testing against the incumbent EDR becomes the critical path, and it is nobody’s full-time job.
- Momentum decays. Two quarters in, with zero fielded value, the initiative competes for renewal attention against projects that shipped. It loses.
- Shadow adoption keeps compounding. The agents the project was meant to govern kept multiplying the entire time, so the eventual go-live faces a larger, messier estate than the one that was scoped.
So, what’s the moral? The defect isn’t the enforcement technology. It’s starting with the most expensive rung before the cheap ones have earned their keep.
Sizing the Rung to the Exposure
Governance attention is risk capital. Allocate it where blast radius and irreversibility are highest, not uniformly across the estate.
Rung = (Data Sensitivity × Blast Radius) ÷ Reversibility of the Action
| Factor | Low → cheap rung | High → expensive rung |
|---|---|---|
| Data sensitivity | Public repos, scratch dirs | Labeled-sensitive files, NPI, source of record |
| Blast radius | One user, one device | Shared drives, production systems, customer data |
| Reversibility | Read-only, easily undone | Destructive, exfiltrating, mid-action |
A citizen-built flow reading public data on one laptop clears at the See rung — inventory it, move on. An unsanctioned agent with write access to a labeled-sensitive directory is where you spend Enforce-grade capital. This is position-limit thinking applied to endpoints: you don’t post the same margin against a Treasury bill and an illiquid single-name, and you don’t deploy kernel enforcement uniformly against a portfolio with wildly different tail risk.
What Each Rung Actually Requires
The rungs are cumulative — each assumes the one below it — but they draw on different control planes, which is exactly why you can climb them without waiting for a fleet install.
| Rung | Control plane | Representative action | Prerequisite |
|---|---|---|---|
| See | Identity, egress proxy, source control | Connect Entra, the proxy, and GitHub; produce a ranked inventory with owners and data exposure — the basis of an agent risk score | API grants only |
| Contain | Systems you already operate | Revoke the OAuth grant in Entra, block the domain at the proxy, push the MDM restriction | No new software |
| Enforce | Kernel | Copy-on-write redirect on a labeled file open; block the process or the egress in-line, with process-file-label-action-verdict evidence | Ring-tested endpoint agent |
The important distinction is contain versus enforce. Containment reaches for stack you already run — an OAuth revoke or a proxy block is reversible, ships in days, and needs no change-advisory review. Enforcement is the kernel-level stop-loss for the actions containment can’t reach: a local agent opening a sensitive file from disk generates no proxy traffic and no cloud log, so only a control that lives below the app layer can interdict it. You graduate to it deliberately, scoped to the exposure the See rung surfaced — see the operating model at /agent-governance/.
What CISOs Should Do This Quarter
| Step | Action | Output | Effort |
|---|---|---|---|
| 1 | Run the See rung: connect identity, proxy, and GitHub; inventory every AI tool, skill, and MCP server | A ranked estate map with owners and data exposure | ~1 hour |
| 2 | Score the inventory on data sensitivity × blast radius ÷ reversibility | A shortlist of the exposures that actually warrant enforcement | 1 week |
| 3 | Contain the top exposures with controls you already run — revoke, block, restrict | Risk reduction with zero fleet install | Days |
| 4 | Pilot kernel Enforce on the highest-risk segment only, sized to the score | Measured interdiction with evidence, scoped by exposure | 2–3 weeks |
The Bottom Line
AI governance stalls when the plan opens with the most expensive, least reversible control — a fleet-wide install — before anyone has measured what the estate actually holds. The See-Contain-Enforce ladder inverts that: inventory in an hour with zero install, interdict the top exposures with stack you already run, and spend kernel-grade enforcement only where data sensitivity and blast radius justify it. Sequence by exposure, not by vendor convenience, and the project ships value in week one instead of month five — which is also the difference between a renewal and a post-mortem. If your team is scoping AI governance for this quarter, request a working session. We will run the zero-install inventory against your environment, score your top exposures on the sensitivity-and-blast-radius frame, and map which rung each one belongs on. One hour to the inventory, and you leave with the ladder drawn against your own estate.