Most AI agent governance advice quietly assumes you are one company, in one tenant, under one policy. A lot of enterprises are not. They are a parent with three subsidiaries, an acquisition still running its own directory, a joint venture with shared IP and separate books, and a portfolio company that will be sold in eighteen months. Agents are already running in all of them. Almost none of the controls cross the boundary.
August 2026 was the month the major platforms admitted that agent administration is a cross-tenant problem, not a single-directory problem.
Microsoft's August 2026 Partner Center announcements introduced multi-tenant agent management in the Microsoft 365 admin center in public preview. Administrators get a consolidated agent inventory across the tenants they govern, can install or block agents across eligible tenants, review tenant-specific risk and activity insights, and switch into a governed tenant without a separate administrator account per entity. Notably, actions stay scoped to the administrator's delegated role in each tenant: the console is consolidated, the authority is not.
Google's Gemini Enterprise Agent Platform moved the same problem into the identity layer. Its Agent Identity model gives each agent a first-class IAM identity rather than a shared service account, binds access to the agent runtime to limit the value of a stolen token, issues short-lived credentials that rotate automatically instead of developer-generated long-lived keys, and produces non-repudiable records of what each agent did. Alongside it sit an Agent Gateway as a central enforcement point and an Agent Registry as a catalog intended, in Google's framing, to reduce duplication.
SAP's own analysis, published on the SAP News Center in August 2026, put the question at the board table. SAP's definition of agent sprawl turns on a rate mismatch: agents appear faster than the organization can name an owner, scope permissions, watch behavior, or retire them. Its LeanIX agentic AI survey found 98% of companies have deployed AI agents or plan to, while fewer than half have visibility into an inventory of those agents. SAP also cites Gartner's estimate that by 2028 the average global Fortune 500 enterprise will run more than 150,000 agents, with only 13% of organizations believing they have the right governance in place.
When an enterprise spans several tenants or legal entities, agent governance fails in seven predictable places: identity boundaries, cross-tenant data movement, duplicate agents doing the same job in each entity, inconsistent policy, no consolidated inventory, fragmented audit evidence, and split licensing and cost. The fix is an operating model with one control plane for visibility and standards, per-entity identity and enforcement, a shared agent catalog that entities configure locally, explicit cross-tenant data rules, and a single consolidated audit and cost view. Authority stays local. Visibility becomes global.
The failures are specific and they repeat. If you run more than one tenant, you will recognize most of them.
Consolidation belongs to visibility and standards. Enforcement and authority stay inside the entity. Microsoft's design illustrates the split: one console, actions still scoped to the delegated role in each tenant. Build your model the same way.
Stand up a single place where every agent across every entity is registered before it reaches production: name, owner, business purpose, entity of record, systems it touches, data classes it can read, autonomy level, approval thresholds, and retirement date. This is a registry, not a runtime. It does not need to broker traffic to be useful. Start there. It is the artifact your board, your auditors, and your insurers will ask for.
Every agent gets its own identity, issued in the tenant where it operates, with least privilege scoped to that tenant's data. Cross-tenant access is brokered explicitly and time-bound, not granted by parking a shared account in both directories. Google's Agent Identity model is a useful reference architecture even if you never buy it: an identity tied to the agent resource itself, with short-lived certificates kept current by the platform, so no long-lived keys are left behind. Our treatment of AI agent identity and access covers the mechanics, and this discipline belongs inside your broader AI security and governance program, not a separate AI silo.
Build the agent once at the group level. Let each entity configure it: its own connectors, approval thresholds, tone and language, and escalation contacts. This is ordinary platform engineering applied to agents, and it is where duplication cost disappears. A policy change to the invoice agent ships once and reaches five entities. Treat catalog agents as versioned products with owners and release notes, which is why agent delivery looks more like AI DevOps than like configuration. Our custom AI agent work is built around that shape from the start.
Produce a short matrix: which entity's data may be read by agents operating in which other entity, for what purpose, with what retention, and who approves an exception. Keep it to one page. Then enforce it in the retrieval layer, not in a policy PDF, by scoping each agent's knowledge base, connectors, and tools to the entities it is permitted to see. Where a joint venture or transition services agreement is involved, have legal sign the matrix. It takes an afternoon and prevents an expensive category of incident.
Normalize agent logs from every tenant into a single store with a common schema and a retention period matching your longest regulatory obligation, not your shortest tenant default. The test is simple: can you answer "what did this agent do, in which entity, on whose authority, using whose data" in an afternoon rather than a quarter? Our note on agent audit evidence and logging covers what to capture. Do the same with spend. A group-level view of agent consumption is usually the largest source of negotiating leverage a CIO has in 2026, and it is what makes automation business cases defensible rather than anecdotal.
At acquisition, you inherit an unknown agent estate. Add agent discovery to technical due diligence alongside the usual identity, endpoint, and licensing review: what agents exist, what they can reach, what data they have already moved, whose credentials they run under, and what happens the day directories merge. Sponsors running multiple portfolio companies face this on a repeating cycle, which is why we treat it as a standing workstream in our private equity and portfolio company practice rather than a one-time integration task.
At divestiture the questions invert. Which agents leave with the entity, which stay, and which must be rebuilt because they were only licensed under the parent's agreement? What happens to prompts and evaluation sets tuned on data the buyer will not own? Which credentials are revoked on close day, and which cross-tenant grants survive into the transition services period by design? Answer these before the deal. Agent access is the kind of residual entitlement that quietly outlives a separation by years.
Sequencing matters more than tooling. Most organizations try to buy a platform first and discover afterward that they cannot describe what they own. Inventory and ownership are cheap, unglamorous, and they make every later decision easier. Having an outside team run the first pass is much of what our AI consulting engagements consist of. Infonaligy is based in Dallas–Fort Worth and delivers this work remotely nationwide, which is usually how it goes: multi-entity groups rarely have their entities in one place either.
The vendors moved in August 2026 because their largest customers are not single tenants. Microsoft consolidated the administrative view while keeping authority delegated per tenant. Google made agent identity a first-class, least-privilege, per-agent construct with an audit trail attached. SAP framed the category as a board-level governance question, backed by its own finding that fewer than half of enterprises can see an inventory of the agents they already run.
The lesson is not to pick one of those products. It is to adopt the shape they all converged on. Centralize visibility, standards, catalog, audit, and cost. Keep identity, enforcement, and authority local to each entity. Write the cross-tenant data rules down before an agent writes them for you by accident. Treat acquisition and divestiture as agent events, because that is what they now are.
If your company is five companies on paper, your agent governance has to be one thing with five enforcement points. Anything else is five programs pretending to be one, and the gap between them is where the incident starts.
Infonaligy is an AI-native managed intelligence provider based in Dallas–Fort Worth, working with multi-entity groups, acquirers, and portfolio companies across Texas, Oklahoma, and remotely nationwide.
We inventory agents across your tenants, fix shared credentials and cross-tenant access, and stand up a single control plane with consolidated audit and cost. Built for groups with subsidiaries, acquisitions, and portfolio companies.
Infonaligy