Executive · Governance & ROI Board

Are we governing our AI agents — and is it improving?

Governance index

target ≥ 80

vs last period

▲ 2 pts

to target

4 pts

The headline

Governance index 76, up 18 pts over 6 weeks while spend rose 62% — control is improving despite growth. 42% of spend ($290.50) is at risk, but the top 3 agents carry 100% of it — govern support-copilot, Codex CLI, marketing-gpt and most of the exposure clears.

Governed agents

63%

5 of 8 agents policy-bound

Spend at risk

at risk

$290.50/ $684.50

42% through risky / ungoverned agents

open high findings

clearing in ~3w

critical agents

posture < 50

88%

instrumentation coverage

1 shadow agent

$684.50

total AI spend

54% from cache

Posture vs spend — are we earning control as we grow?

governance index daily spend target 80

Governance up 2 pts this period. At the recent pace, the fleet reaches the 80 target in ~2 weeks. Spend up 62% ($88.20 → $142.60/day) — the lines diverging the right way is the whole story.

−6w−5w−4w−3w−2wnow

posture window

58 → 76 (+18)

spend window

$684.50 total · 54% cache

reaches target in

~2 weeks at current pace

Are the agents earning their keep?

effectiveness detail →

Governance answers "is it safe"; this answers "is it working." Fleet success 89% across 1,212 tasks — about $0.64 per successful task — but only 63% of agents emit a measured outcome signal (projected where signal ≠ measured).

outcome-signal coverage

5 measured 2 inferred 1 dark

89%

fleet success rate

needed a human

$0.64

spend / successful task

63%

measured coverage

What's driving risk & spend

agents below the 80 posture target, ranked by spend

Concentrated, not diffuse: top 3 agents = 100% of the $290.50 at-risk spend (support-copilot, Codex CLI, marketing-gpt). Govern these and most of the exposure goes away.

58%

27%

15%

support-copilot$168.40Codex CLI$78.00marketing-gpt$44.10

Agent	Owner	Governance	Posture	Spend	Top risk factor
support-copilot top-3	svc-support@qpoint.io	governed	65	$168.40	Running as root
Codex CLI top-3	dev-7f3@duck.com	ungoverned	70	$78.00	Sandbox disabled
marketing-gpt top-3	root	ungoverned	25	$44.10	Approvals & sandbox bypassed (yolo)
Zed Agent	jane	ungoverned	60	$0.00	No tool-approval policy

Open high & medium findings

replay → Activity Log all findings →

Backlog trend: closing ~4/wk vs opening ~2/wk — net shrinking by 2/wk. At this pace the 5 open findings clear in ~3 weeks(projected — qcontrol stores current state only).

Approvals & sandbox bypassed (--yolo)

marketing-gpt · OWASP LLM06 Excessive Agency · OWASP Agentic · Insecure tool use

high

Agent running as root

marketing-gpt · MITRE ATLAS · Privilege Escalation · OWASP LLM06

high

Static API key on consumer-aliased identity

Codex CLI · MITRE ATLAS · Credential Access · OWASP LLM (Non-Human Identity)

medium

Sensitive files read into agent context

Claude Code · OWASP LLM02 Sensitive Information Disclosure · NIST AI RMF · MEASURE

medium

Unbounded token consumption — no spend ceiling

data-pipeline-agent · OWASP LLM10 Unbounded Consumption · NIST AI RMF · MANAGE

medium

projected open-findings burndown

net −2/wk · clears in ~3w

Do next

Fields: postureIndexTrend · weeksToTarget · governanceTaggedSpend · costs.series · fleetEffectiveness · findings(severity) — from app/data/c16-fleet.ts. Posture history, spend slope comparison, and findings burndown are projected (qcontrol stores current state only).