One board view of AI-agent governance — posture, spend, and what's at risk.

The single surface to take to a board or leadership review: are we governing our AI agents, is it improving, and how much spend is exposed? Packages signals scattered across the operator views into one trended, exportable read.

Bottom line

Governance index 76/100 (target 80), up 2 this period. 63% of agents are governed and $290.50 (42%) of spend flows through risky or ungoverned agents — concentrated in support-copilot.

Do nextGovern 3 unbound agents →Review $290.50 at risk →Export board report

Reporting period

Governance index

of 100 · target ≥ 80 · ▲ 2 vs last period

Governed agents

63%

5 of 8 agents policy-bound

Spend at risk

$290.50

42% of $684.50 flows through risky / ungoverned agents

open high findings

across the fleet

critical agents

posture < 50

88%

instrumentation coverage

1 shadow agent

$684.50

total AI spend

54% from cache

Governance index — 6-week trend

posture history (projected)

Up 2 pts this period. At the recent pace, the fleet reaches the 80 target in ~2 weeks.

−6w— — target 80now: 76

Spend — daily

$684.50 total

2026-05-282026-06-03

What's driving the risk & spend

agents below the posture target, ranked by spend

AgentOwnerPostureSpendTop risk factor

support-copilotsvc-support@qpoint.io65$168.40Running as root Codex CLIungoverneddev-7f3@duck.com70$78.00Sandbox disabled marketing-gptungovernedroot25$44.10Approvals & sandbox bypassed (yolo)Zed Agentungovernedjane60$0.00No tool-approval policy

Open high & medium findings

all findings →

Approvals & sandbox bypassed (--yolo)marketing-gpt · OWASP LLM06 Excessive Agency · OWASP Agentic · Insecure tool usehigh

Agent running as rootmarketing-gpt · MITRE ATLAS · Privilege Escalation · OWASP LLM06high

Static API key on consumer-aliased identityCodex CLI · MITRE ATLAS · Credential Access · OWASP LLM (Non-Human Identity)medium

Sensitive files read into agent contextClaude Code · OWASP LLM02 Sensitive Information Disclosure · NIST AI RMF · MEASUREmedium

Unbounded token consumption — no spend ceilingdata-pipeline-agent · OWASP LLM10 Unbounded Consumption · NIST AI RMF · MANAGEmedium

Fields: fleetPostureScore · governed · cost · costs.series · findings(severity) — from app/data/c16-fleet.ts. Posture history is projected (qcontrol stores current state only).