Editor's note — September 12, 2026: Withdrew the untraceable 80%/11% comparison and automatic board-liability claims; corrected the deployment-versus-mandate distinction and the outcasting typo.
The take
A deployment mandate is not evidence that agents are in production, and deployment is not evidence that they are governed. Those are three different states that management should report separately.
Make the inventory useful
For each agent, record its owner, business purpose, environment, systems and data access, permitted actions, logging and intervention procedure. Connect these records to the approval process rather than maintaining a disconnected spreadsheet.
My recommendation is to make the approved path practical for business teams while investigating unapproved use. Restrictions can be necessary, but they should be paired with clear alternatives and a risk-based exception process.
Where an agent cannot explain its action through usable records, investigate the control gap. Do not assume that every missing log has the same legal consequence.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.