One board view of AI-agent governance — posture, spend, and what's at risk.

Packages signals scattered across the operator views (Posture, Cost, Findings, Inventory) into a single trended, exportable surface.

Reporting period

Governance index

of 100 · target ≥ 80 · ▲ 2 vs last period

Governed agents

63%

5 of 8 agents policy-bound

Spend at risk

$290.50

42% of $684.50 flows through risky / ungoverned agents

open high findings

across the fleet

critical agents

posture < 50

88%

instrumentation coverage

1 shadow agent

$684.50

total AI spend

54% from cache

Governance index — 6-week trend

posture history (projected)

−6wnow: 76

Spend — daily

$684.50 total

2026-05-282026-06-03

What's driving the risk & spend

agents below the posture target, ranked by spend

AgentOwnerPostureSpendTop risk factor

support-copilotsvc-support@qpoint.io65$168.40Running as root Codex CLIungoverneddev-7f3@duck.com70$78.00Sandbox disabled marketing-gptungovernedroot25$44.10Approvals & sandbox bypassed (yolo)Zed Agentungovernedjane60$0.00No tool-approval policy

Open high & medium findings

all findings →

Approvals & sandbox bypassed (--yolo)marketing-gpt · OWASP LLM06 Excessive Agency · OWASP Agentic · Insecure tool usehigh

Agent running as rootmarketing-gpt · MITRE ATLAS · Privilege Escalation · OWASP LLM06high

Static API key on consumer-aliased identityCodex CLI · MITRE ATLAS · Credential Access · OWASP LLM (Non-Human Identity)medium

Sensitive files read into agent contextClaude Code · OWASP LLM02 Sensitive Information Disclosure · NIST AI RMF · MEASUREmedium

Unbounded token consumption — no spend ceilingdata-pipeline-agent · OWASP LLM10 Unbounded Consumption · NIST AI RMF · MANAGEmedium

Fields: fleetPostureScore · governed · cost · costs.series · findings(severity) — from app/data/c16-fleet.ts. Posture history is projected (qcontrol stores current state only).