One board view of AI-agent governance — posture, spend, and what's at risk.

The single surface to take to a board or leadership review: are we governing our AI agents, is it improving, and how much spend is exposed? Packages signals scattered across the operator views into one trended, exportable read.

Bottom line

Governance index 76/100 (target 80), up 18 over 6 weeks while spend rose 62% — control improving despite growth. 42% of spend ($290.50) is at risk, but top 3 agents carry 100% of it — govern support-copilot, Codex CLI, marketing-gpt and most exposure clears.

Do nextGovern 3 unbound agents →Review $290.50 at risk →Export board report

Reporting period

The headline

Posture up 18 pts while spend rose 62% — control is improving despite growth.

Governance index 58 → 76 (target 80); daily spend $88.20 → $142.60. Faster fleet, more accountability per dollar.

Governance index

of 100 · target ≥ 80 · ▲ 2 vs last period

80 = industry target for governed agent fleets — illustrative

Governed agents

63%

5 of 8 agents policy-bound

Spend at risk

$290.50

42% of $684.50 flows through risky / ungoverned agents

open high findings

clearing in ~3w

critical agents

posture < 50

88%

instrumentation coverage

1 shadow agent

$684.50

total AI spend

54% from cache

Governance index — 6-week trend

posture history (projected)

Up 2 pts this period. At the recent pace, the fleet reaches the 80 target in ~2 weeks.

−6w— — target 80now: 76

Spend — daily

$684.50 total

Up 62% across the window ($88.20 → $142.60/day).

2026-05-282026-06-03

What's driving the risk & spend

agents below the posture target, ranked by spend

Concentrated, not diffuse: top 3 agents = 100% of the $290.50 at-risk spend (support-copilot, Codex CLI, marketing-gpt). Govern these and most of the exposure goes away.

AgentOwnerPostureSpendTop risk factor

support-copilottop-3svc-support@qpoint.io65$168.40Running as root Codex CLItop-3ungoverneddev-7f3@duck.com70$78.00Sandbox disabled marketing-gpttop-3ungovernedroot25$44.10Approvals & sandbox bypassed (yolo)Zed Agentungovernedjane60$0.00No tool-approval policy

Open high & medium findings

all findings →

Backlog trend: closing ~4/wk vs opening ~2/wk — net shrinking by 2/wk. At this pace the 5 open findings clear in ~3 weeks (projected — qcontrol stores current state only).

Approvals & sandbox bypassed (--yolo)marketing-gpt · OWASP LLM06 Excessive Agency · OWASP Agentic · Insecure tool usehigh

Agent running as rootmarketing-gpt · MITRE ATLAS · Privilege Escalation · OWASP LLM06high

Static API key on consumer-aliased identityCodex CLI · MITRE ATLAS · Credential Access · OWASP LLM (Non-Human Identity)medium

Sensitive files read into agent contextClaude Code · OWASP LLM02 Sensitive Information Disclosure · NIST AI RMF · MEASUREmedium

Unbounded token consumption — no spend ceilingdata-pipeline-agent · OWASP LLM10 Unbounded Consumption · NIST AI RMF · MANAGEmedium

Fields: postureIndexTrend · weeksToTarget · governanceTaggedSpend · costs.series · findings(severity) — from app/data/c16-fleet.ts. Posture history, spend slope comparison, and findings flow are projected (qcontrol stores current state only).