Tackling agent sprawl across the enterprise

How to securely scale AI agents from individual to org-wide use without introducing unnecessary complexity.

While AI is projected to unlock $2.6 trillion to $4.4 trillion annually across more than 60 generative AI use cases (McKinsey), individual productivity gains don’t automatically translate into organizational outcomes. As teams rapidly deploy agents across product, customer support, and broader business operations without shared context, clear ownership, and coordinated oversight, those isolated efficiencies can quickly turn into agent sprawl.

Unlike shadow IT, which involves unapproved tools that hold data and can often be detected through reports of foreign traffic from unfamiliar vendors, agent sprawl involves unapproved actors using your data and permissions to take actions on your behalf, making them hard to detect. Such unmanaged agents can operate like sanctioned users on sanctioned infrastructure with sanctioned credentials, but at a speed and scale that can rapidly spread across the organization.

Agent sprawl obscures basic operational answers like which agents are active, who owns them, what data they access, what actions they take, and what happens when things go wrong. Without visibility into those answers, you are left with five leadership-level consequences:

• Data exposure: agents may surface or move confidential information in ways teams did not anticipate

• Identity and access risk: an agent can inherit overly broad permissions or connect to systems without appropriate controls
• Operational ambiguity: Teams don’t know who owns an agent, how it makes decisions, or how to stop it
• Unplanned cost and complexity: IT can’t manage capacity, vendor exposure, usage, or measure ROI when agent activity is fragmented
• Inaccurate outputs and weaker outcomes: Disconnected agents lack shared context, leading to conflicting answers and actions misaligned with team goals

Teams don’t need more disconnected agents; they need agents connected to shared knowledge, priorities, and ownership. As of now, OutSystems research finds that 94% of organizations are concerned that AI sprawl is increasing complexity, technical debt, and security risks.

So what’s the solution? How do we separate productive AI adoption from agent sprawl?

How to govern AI, not block AI, for better outcomes

Without intentional guardrails, restricting AI limits its value, slows adoption, and can push experimentation into unsanctioned tools where sensitive company context is pasted beyond IT’s oversight.

The first step is defining the right level of agent autonomy: which actions are allowed, on which data, for whom, and with what review. Full autonomy with broad access and unrestricted execution is risky; locking down every action creates workflows bogged down by constant “Shall I do this?” confirmations. Both extremes slow value, create approval fatigue, and stall innovation.

Separate actions that are safe to automate from those that require human oversight. This will create a balance of appropriate autonomous actions you can trust and mitigate constant disruptive asks for permission.

Examples of low-risk actions:	Examples of high-risk actions:
• Searching for content • Read specific pages/issues • Content generation	• Deleting content • Changing permissions • Touches regulated, personal, or financial data

However, overly granular centralized policies – dictating what can be done and by whom – can limit teams’ use of the tool.

Centralized policies that don’t restrict flexible ways of working

Effective AI governance provides teams with clear guardrails for using agents safely, enabling them to move faster without creating unmanaged risk.

The first question any IT leader asks about an AI platform is whether it honors the permissions already governing the underlying data. With Atlassian, admins can control who is authorized to build agents and which tools those agents can access.

From there, teams can create and manage agents within the boundaries set by admins. They can own which agents to build and for what workflows and experiment with prompt design, tone, iteration, speed, and retirement.

Permission inheritance remains the baseline.

Agents only surface or reference content that the invoking user is allowed to see. For more mature governance, admins can also apply agent-specific, role-scoped controls so access is intentionally defined rather than relying on a person’s accumulated permissions.

But to go even deeper, agent-level controls can be configured per agent.

Agent-level control

Per-agent configuration lets authors and admins narrow which sources or spaces an agent can draw from, which tools it can invoke, and how it should apply those permission boundaries in practice.

This accountability extends to our apps, too. In Confluence page view history, for example, you can already see when content was accessed via an AI agent. Agents appear as contributors on content they helped create or update. So an agent acting on someone’s behalf shows up next to the person who invoked it, not as the person themselves.

Once you’ve defined who can create and manage AI agents, and what those agents can access, the next natural question is: “How many agents exist, and how many are my teams using?”

But answering it requires clear visibility for administrators.

Agent Insights in Studio

Visibility is the primary signal in agentic governance. A strong platform should help administrators move from a high-level inventory to the operational details needed to manage risk, usage, and cleanup.

At Atlassian, Agent Insights provides administrators with visibility into agent counts, invocation frequency, and usage patterns, enabling them to identify agents that should be cleaned up, consolidated, or scoped down.

How governance drives faster, responsible adoption at scale

Once you’ve set the guardrails and created visibility, you’re ready to start enabling teams to leverage agents. But are your agents ready to start working? In a recent Pulse survey of 1,000+ knowledge workers, only 12% say their AI understands the company better than its most junior employees do. In other words, most believe their AI’s level of understanding is closer to that of a new hire.

An ungoverned agent with rich context is risky, but a governed agent with no context is useless.

An agent is only as effective as the context it has. According to the State of Teams 2026, teams with more optimized foundations are 7.3x more likely to report higher AI ROI.

That value compounds when the systems where work happens are connected and governed, giving agents the shared context they need to produce useful, aligned outputs.

Atlassian’s Teamwork Collection brings together Jira, Confluence, Loom, Rovo, and platform apps on Teamwork Graph, which connects teams, knowledge, and tools while providing built-in context and governance.

Context graphs drive higher quality AI outputs while using fewer tokens. With the Teamwork Graph, output is up to 44% more accurate and uses up to 48% fewer AI tokens. For leaders struggling to prove and measure AI ROI, unifying work on a context-graph-based system is a strong solution.

Turning foundation into measurable value

The two agents below break down where value is created and how we can track progress over time, turning the foundation into clear signals of adoption, efficiency, and business impact.

Jira Ticket Quality Reviewer

With the foundation in place, teams can move from governance to practical adoption by starting with repetitive, process-oriented work where agent boundaries are easy to define and value is easy to measure. The Jira Ticket Quality Reviewer from the Agent Use Case Inventory is a strong example: it reviews incoming issues, scores whether they include enough detail, and posts actionable feedback when a ticket changes status. Instead of relying on manual triage, teams can improve ticket quality earlier while keeping the agent focused on a clearly scoped workflow.

Onboarding and Knowledge Transfer Assistant

From there, the same governed approach can scale to broader workflows, such as employee onboarding. The Onboarding and Knowledge Transfer Assistant shows how an agent can help new hires ramp faster by gathering relevant documentation, surfacing team norms, and guiding employees through required steps without exposing information they are not permitted to access. The point is not to create more disconnected agents; it is to turn well-governed, context-rich agents into repeatable workflows that save time and improve consistency.

A human-directed, AI-enabled future.

At the end of the day, leaders want their teams to get the most value out of AI without losing control. The organizations that govern AI well can answer the questions that matter most: what exists, who owns it, how it is used, what it costs, and whether agents have the necessary context to produce useful results.

Governance preserves human judgment where it matters most. AI can gather information, interpret broad organizational context, and synthesize it quickly, while people remain accountable for decisions that require nuance, expertise, and review.

Governed AI allows organizations to scale with confidence when it is built into the systems teams already use. By connecting AI to organizational context and clear accountability, teams can automate real work while IT preserves the visibility needed to manage risk and measure value.

Ready to tackle agent sprawl?

See how Atlassian’s Teamwork Collection helps organizations like yours scale AI guardrails without stalling AI outcomes. Bring teams, workflows, and AI-powered work together into a single, connected approach so you can move faster with greater confidence, consistency, and control.