FAQ

What is a guardian agent?

In Collibra's definition: Supervisory agents that continuously check the runtime behavior of other agents against their contracts, and intervene proportionately when boundaries are crossed, by flagging, escalating, redirecting or blocking. The term was coined by Gartner, and analyst projections put guardian agent technologies at 10-15% or more of the agentic AI market by 2030.18

What is an agent contract?

A machine readable translation of governance requirements: What data and tools an agent may use, what actions it may take, under which conditions. Contracts capture structured rules plus intent, layer from a global baseline to specialized rules by function, risk and context and remain independent of any runtime.

How is agent governance different from AI governance?

AI governance historically reviewed models before deployment. Agent governance extends the same discipline to systems that act: Continuous discovery, per agent identity and ownership, risk tiered rules and runtime enforcement. An agent's risk lives in what it does, not just in how it was built.

Why isn't observability enough to govern AI agents?

Observability tells you what happened after it happened. Agents act in milliseconds, and a sequence of individually authorized actions can add up to an outcome nobody authorized. Governing agents means evaluating behavior against contracts as it occurs, with the ability to intervene before harm.

Do AI agents need human oversight for every action?

No, and the data shows why that doesn't scale: 87% of teams already burn hours re-verifying agent context by hand.6 Exception based oversight is the scaling answer: Humans review violations, exceptions and drift, routed to accountable owners with context. This reconciles EU AI Act Article 14 human oversight duties with a fleet of thousands of agents.16

How should governance change with an agent's autonomy level?

Proportionally. Each autonomy level is a distinct trust boundary: observe, advise, act with approval, act autonomously. Combine autonomy with data sensitivity to tier risk, and let the tier determine the controls, from logging only to human approval to block mode.

What is AIUC-1?

An emerging industry standard for AI agent security, safety and reliability, often called “a SOC 2 for AI agents.” It spans data and privacy, security, safety, reliability, accountability and society, with third-party audits and crosswalks to the EU AI Act, ISO 42001 and NIST AI RMF.20 Collibra is the first Data and AI governance platform to be AIUC-1 certified.²¹

References

Stanford HAI, AI Index Report 2026, agent performance on the OSWorld benchmark
McKinsey, The State of AI (2025 survey): agent experimentation and scaling by function
The Hacker News, April 2026: breach tied to a single OAuth grant to an AI agent exposing internal systems and customer credentials
Fortune, July 23, 2025: AI coding agent deletes live production database during a code freeze
PYMNTS and Cooley LLP, August 2026: Ninth Circuit ruling in Amazon v. Perplexity, AI agent held “a tool, not a person”
Collibra and The Harris Poll, The 2026 Hallucination Tax Report, September 2026: survey of 306 US data, privacy and AI decision makers (collibra.com)
EY, Responsible AI Pulse survey, October 2025: 975 C-suite leaders; 99% reported AI related financial losses, 64% above $1 million, average $4.4 million
EY US, agentic AI governance survey, September 2026: 36% report a materially negative AI incident, 89% encountered AI risks, 46% cite shadow AI
MIT Project NANDA, The GenAI Divide: State of AI in Business 2025: 95% of organizations report zero measurable P&L return from generative AI
Forrester, Predictions 2025 and The State of Agentic AI in 2026: three of four self-built agentic architectures will fail; control plane defined outside the agent's execution loop
Deloitte, State of AI in the Enterprise 2026: 42% testing or deploying agents, 21% with mature agentic governance, 15% scaled multi agent, 74% expect moderate agent use by 2027
IDC FutureScape 2026: up to 20% of G1000 organizations facing lawsuits, fines and CIO dismissals by 2030 over inadequate AI agent controls
SailPoint, May 2025: 80% of organizations report risky AI agent behaviors
Okta, Global CISO Insights 2026, and Cloud Security Alliance nonhuman identity research: 91% agent adoption, 10% mature NHI strategy, 45:1 NHI ratio
McKinsey, Building the foundations for agentic AI at scale, April 2026: agent registry blueprint; eight in 10 cite data limitations
EU AI Act, Article 14 (human oversight), applicable to high risk systems since August 2, 2026
Gartner press release, May 26, 2026: uniform governance across AI agents leads to failure; four autonomy levels
Gartner press release, June 2025: guardian agent technologies at least 10-15% of the agentic AI market by 2030
EchoLeak, CVE-2025-32711 (June 2025, CVSS 9.3, M365 Copilot); Brave Software disclosure of Comet browser prompt injection (2025)
AIUC-1 standard: aiuc-1.com, domains, crosswalks and certification model
Collibra: AIUC-1 certification announcement; AIUC-1 out-of-the-box assessment template (collibra.com)
McKinsey, Superagency in the workplace: 1% of leaders describe their company's AI deployment as mature
IDC, Future Enterprise Resiliency and Spending survey, January 2026: AI security and governance at 16.7% of planned AI investment