Here is a number worth sitting with. IBM’s enterprise research suggests that by the end of 2026 a typical large organisation will be running a digital workforce of more than 1,600 AI agents. Gartner expects the average large enterprise to reach six figures of agents by 2028, from almost none in 2025.

That is not a software rollout. It is a hiring wave. And the uncomfortable finding underneath the headline is that most organisations cannot manage the agents they already have. In the same research, only around one in five keeps a complete, current inventory of the agents running inside the business; only about one in eight has a single platform to manage them; and roughly seven in ten executives say their governance is now slowing their AI programme down rather than enabling it.

So, the question has been building toward is not “which agents should we build?” It is “who manages the workforce once we have one?”

A tool you install. A workforce you manage.

The category error is to treat agents like the software that came before them. You install a tool once and it sits there. An agent acts. It holds credentials, reaches into live systems, makes decisions and takes steps on its own.

That difference changes what “managing” means. A spreadsheet macro that misfires ruin a spreadsheet. An agent with live credentials that misfires can move money, change records or take a system offline before anyone notices. Agents that behave perfectly in a sandbox break in production, because production is where the real credentials, real data and real consequences live.

You are not rolling out a tool. You are standing up a workforce - and a workforce nobody manages is not an asset. It is a liability.

What every agent needs, the same as every employee

The most useful way to think about it is the one the metaphor suggests. An agent needs what you would give any new member of staff.

• An identity of its own. A unique, verifiable credential - not a shared human login or a generic service account. Regulators and standards bodies are converging on this fast; an agent without its own identity cannot be traced, and cannot be trusted.

• A job, and the access to do it. A defined role, with permission to reach only the systems and data that role requires - least privilege, not the keys to everything.

• A named manager. A human owner accountable for what the agent does. No unowned autonomy: if no one owns it, no one can answer for it.

• Supervision and a record. Continuous logging and monitoring, so you can always answer the simplest and most important question - what did it do, and why?

• A lifecycle. Agents are onboarded, reviewed and, crucially, retired. An agent nobody remembers creating is exactly how sprawl begins.

None of this is exotic. It is what every organisation already does with people. The shift is applying the same discipline to software that now behaves like staff.

Sprawl is what happens when you don’t

Skip the management and you get the failure mode already being reported across the market: agent sprawl. Household-name companies in ride-hailing, healthcare and software have publicly described wrestling with too many agents - duplicated work, conflicting outputs, rising compute bills, and security teams unable to say what an agent did or on whose authority.

The security dimension is the sharpest. When agents share human credentials or run as anonymous service accounts, they can impersonate one another and quietly acquire access they were never meant to have. A workforce you cannot see is a workforce you cannot secure.

The control plane is the org chart

The practical answer is a management layer - an orchestration or control plane that sits across your agents and does for them what an HR system and an org chart do for people: it registers every agent and its owner, enforces guardrails and access centrally, keeps the audit log, and gives real-time oversight of what the whole workforce is doing.

This is where the effort actually goes. Building an agent is a small share of the work; the rest is testing, deploying, supervising and governing it in production. And it does not require a single vendor: the platforms large businesses already run - SAP and Google Cloud - both now offer agent registries and orchestration, and both speak the open protocols (Model Context Protocol and agent-to-agent) that let a control plane span systems rather than lock you in. As ever, confirm which capabilities are generally available and which are still in preview.

Humans don’t leave the building

Managing a digital workforce does not mean stepping back from it. Every function article in this series kept a person on the decisions that matter, and this is the mechanism: human-in-the-loop checkpoints at defined thresholds, so an agent must get sign-off before it touches sensitive data, changes a system or moves money.

This is also where the law now points. Under the EU AI Act, the duty of human oversight for high-risk uses falls on the organisation deploying the agent, not the vendor that built it. Accountability does not transfer to the software. Someone is always answerable - which is the whole reason the named manager is not optional.

The advantage is in the management, not the models

It is tempting to assume the winners will be whoever has the cleverest agents. The evidence points the other way. The same research that produced the 1,600-agent figure found that organisations investing in orchestration and governance scaled far faster, lost markedly less to errors and irregularities, and earned more return on their AI spend - while the majority of pilots that skip this never reach production at all.

The models are becoming a commodity. The operational discipline - identity, ownership, supervision, a clear line no agent crosses - is not. That is where the advantage sits.

The through-line of this series

We have gone function by function - operations, commercial, finance, HR - and the pattern has been the same each time: agents take the connective tissue, people keep the judgement, and governance is built in rather than bolted on. Managing that at scale, as a workforce with identity, owners, oversight and a lifecycle, is what turns a drawer full of promising pilots into a business that runs differently and can still answer for itself.

That management layer - the org chart for your digital workforce - is where we would start. If you are beginning to feel the sprawl or want to stand up the governance before you feel it, that is the conversation we would have. Visit us for more.