Agent sprawl is a known, approved population of AI agents that has grown past the point where anyone can manage it agent by agent. That distinction matters: it is a different failure mode from shadow AI, and it needs a different fix. Gartner's own numbers on this are stark — an average Fortune 500 enterprise is projected to run more than 150,000 agents by 2028, up from fewer than 15 in 2025 — and the framework it published to manage that growth treats the problem as one of population-scale governance, not per-agent oversight.
Sprawl is not shadow AI
The core distinction: shadow AI is about agents you don't know exist; sprawl is about agents you do know exist, in numbers too large to govern individually. The rise of shadow AI covers the visibility gap — unauthorized agents and MCP connections deployed outside any central oversight, where the first problem is finding them at all. Sprawl assumes you've solved that problem, or are solving it, and hits you with the next one: even a fully inventoried, fully authorized population of agents becomes unmanageable once its size outpaces the tooling and process built for a much smaller count.
This is a scale problem more than a discovery problem. A registry with 200 well-documented agents and clear ownership is a governance win. A registry with 150,000 entries, most created by other agents provisioning sub-agents to handle sub-tasks, is a different kind of system entirely — one where "review each entry" stops being a viable control and something closer to policy-as-code, automated lifecycle rules, and exception-based human review has to take over.
The projection: under 15 to 150,000+
Gartner projects that the average Fortune 500 enterprise will have 150,000 or more agents in active use by 2028, up from fewer than 15 in 2025. Read that as a forecast for 2028, not a current headcount — as of August 2026, most organizations are somewhere on the ramp between those two numbers, and where any given enterprise sits on that curve depends heavily on how aggressively it has adopted agent-building platforms that let non-engineers spin up new agents without a central request process.
The growth curve itself is the governance problem, independent of the exact endpoint. Going from under 15 to over 100,000 in roughly three years is not a linear scaling of existing practice — it's an order-of-magnitude jump that breaks assumptions baked into most current agent-management processes, most of which were designed for populations in the dozens or low hundreds. A control that works at 15 agents (a spreadsheet, a manual quarterly review, a Slack channel for provisioning requests) does not survive contact with four orders of magnitude more agents, and organizations that don't rebuild for the target scale in advance find that out during the transition, not before it.
Gartner's six-step framing
Gartner published a six-step framework for managing AI agent sprawl on 28 April 2026 — the clearest signal yet that the analyst firm treats this as a distinct, named governance discipline rather than a subset of general AI governance. The framework's headline contribution isn't any single control; it's the reframing itself: sprawl management is described across six operational steps rather than one fix. No single control — not inventory, not access policy, not cost monitoring alone — closes the gap at population scale on its own.
Whatever the individual steps prescribe, any framework at this scale has to cover: knowing what exists and staying current as the population changes, assigning and enforcing ownership so every agent has an accountable human or team, governing access and permissions at the same pace agents are created rather than in a periodic review cycle, attributing cost per agent so spend growth is traceable to a decision rather than absorbed into a platform line item, managing lifecycle state so agents move predictably from provisioned to active to retired, and decommissioning on a schedule instead of leaving inactive agents live indefinitely. The through-line across all of these areas is automation: at 150,000 agents, any step that still depends on a human reviewing each entry individually has already failed.
Why sprawl became a board-level issue
SAP framed agent sprawl as a board-level governance issue in its August 2026 coverage — and the reason a scaling problem escalates to the board is the same reason cloud sprawl and shadow IT did before it: unmanaged growth eventually shows up as an unexplained cost line, an audit finding nobody can trace to an owner, or an incident involving an agent nobody remembers provisioning. Those are board-level conversations regardless of the underlying technology, because they're really conversations about whether management has control of its own operating environment.
What makes agent sprawl a sharper version of that pattern than prior infrastructure sprawl waves is the compounding effect: agents can provision other agents. A single approved use case can spawn a chain of sub-agents handling narrower slices of the task, each one technically "known" in the sense that it descends from an authorized parent, but none of them individually reviewed or budgeted the way the parent was. That compounding is the kind of dynamic that turns "fewer than 15" into "150,000+", and it's exactly what a population-scale framework, rather than a per-agent checklist, has to be designed to catch.
Regulatory and audit expectations reinforce the same pressure from a different direction. As agent populations start showing up in third-party risk assessments, security questionnaires, and AI-governance documentation requirements, a board that cannot answer "how many agents do we run, who owns each one, and what can each one reach" is exposed the same way a board that couldn't answer the equivalent question about vendor relationships or unmanaged cloud accounts was exposed a decade earlier. Agent sprawl reaching the boardroom isn't fundamentally about the headcount of agents — it's about whether management can answer a basic question about its own operating environment on demand, rather than after a multi-week reconstruction effort triggered by an audit or an incident.
What breaks first at that scale
Three things fail before anything else, once a population crosses from "large" to "unmanageable":
Ownership. Every agent needs a named accountable owner at creation time, or ownership decays to "whoever's team the API key happens to be under" — which is functionally no ownership at all once the original requester changes roles or leaves. At population scale, ownership has to be enforced at provisioning, not reconstructed after the fact during an audit.
Offboarding. Agents that outlive their purpose don't remove themselves. Without automated, policy-driven decommissioning, a growing population accumulates dead weight — credentialed, connected agents doing nothing useful but still representing live attack surface and live spend. Secure agent offboarding and deprovisioning is the control that has to run continuously, not annually, once population size makes manual review impossible.
Cost attribution. At 15 agents, tracing spend to a decision is a five-minute exercise. At 150,000, without attribution built into provisioning, cost becomes a platform-level number with no path back to the business decision that generated it — which is exactly the "escalating cost" failure mode that gets agent programs canceled before they ever reach sprawl scale in the first place.
None of these three break because the technology stopped working. They break because the process built for a population fifty to five thousand times smaller was never redesigned for the one it's actually managing now. Two adjacent posts are useful once you're building the actual controls rather than reasoning about the scale problem: building an AI agent inventory covers the discovery-and-registration mechanics that ownership and offboarding both depend on, and the 2026 NHI-to-human identity ratio data quantifies how far non-human identity counts have already outpaced human headcount across separately measured populations — context for how much of this curve has already happened elsewhere in the identity estate before agents made it worse. Praesidia's governance layer is built around exactly this population-scale premise: ownership, access, and cost enforced at provisioning rather than reconstructed at audit time.
Common questions
Is agent sprawl the same problem as shadow AI? No. Shadow AI is about agents the organization doesn't know exist — a visibility gap. Sprawl is about agents the organization does know about and approved, in a population too large to govern one at a time — a scale gap. They compound each other but need different fixes.
Is 150,000 agents per enterprise already happening? No — it's Gartner's projection for 2028, based on a 2025 baseline of fewer than 15. As of August 2026, most organizations sit somewhere on the ramp between those figures, not at the projected endpoint.
What's the single biggest gap sprawl creates? There isn't one — that's the point of Gartner's six-step framing. Ownership, access, and cost attribution all fail simultaneously once population size outpaces manual review, and a framework addressing only one of them leaves the other two exposed. The AI governance guide covers how to structure a program across all of them rather than picking one.
Does solving shadow AI also solve agent sprawl? No. Solving shadow AI gets every agent into a registry, which is a prerequisite for managing sprawl — but a fully visible population of 150,000 agents is still unmanageable without the ownership, lifecycle, and cost-attribution automation sprawl specifically requires. Visibility and manageability are two separate problems, solved in sequence, not the same fix.