Companies could soon have hundreds of thousands of artificial intelligence (AI) agents working across their operations, creating a management nightmare for executives who may have little idea of what those agents are doing.
Oracle has responded with the announcement of AI Registry and a new AI Governance and Control framework, designed to give businesses an inventory of their agents, track their activities and enforce restrictions on how they operate.
The technology, unveiled at Oracle AI World in Las Vegas this week, forms part of an expansion of Oracle AI Data Platform, which allows businesses to connect their existing information systems and give AI agents a common understanding of how the organisation operates.
The new AI Registry is designed to maintain a central inventory of agents, tools, skills and the servers that connect them to external systems. It records ownership, versions, dependencies, permissions and the status of each component. The planned AI Governance and Control capability will add testing, policy assessment and ongoing monitoring of agent activity, performance and costs.
TK Anand, Oracle executive vice-president for AI Data Platform, told Gadget that the challenge was becoming particularly acute as companies moved beyond limited experiments.
“Tpart about building AI agents on your private enterprise data, that’s not a tough thing. People are doing it already. Everyone’s doing that using Claude and Codex and so forth. The thing is, how do you do it at enterprise scale?
“You need to feed your business context for your organisation consistently to your agents. You can have one agent or five agents as part of a pilot, and you can come up with some decent results. But if you want your organisation to completely transform itself with agents running every part of your business, you’re talking about hundreds of thousands of agents.”
The proliferation of agents has created a phenomenon known as agent sprawl, in which employees and departments create automated systems that operate with varying degrees of independence, often without central oversight.
An agent may be authorised to retrieve customer records, another to approve purchases and another to modify information in financial systems. As these agents begin communicating and carrying out tasks together, companies need to know which systems they can access and who is responsible for their actions.
Anand said the problem was becoming one of the most pressing issues facing corporate technology executives.
“That’s probably the number one concern I hear from CIOs. As the number of agents starts to proliferate across the organisation, how do I govern this? What are the different agents running across the organisation? Who owns them? What tools and data are they allowed to access? What are the guardrails around them?”
Oracle’s proposed governance framework is designed to provide that oversight, including a record of the tools agents use, the information they access and the employees who invoke them.
Anand said the company was collecting detailed information about agents operating within its platform.
“We automatically collect all sorts of information about everything an agent does, all of the tool calls it’s doing, what data it’s accessing, which users are invoking it, and so forth.
“And so we’re able to provide a very rich governance and controls framework on top of that.”
The announcement includes the ability to register agents developed using external platforms, including Salesforce, allowing organisations to maintain a broader view of their AI deployments. However, Anand acknowledged that the level of governance available over external agents would differ from that offered for agents running directly on Oracle’s platform.
The governance capability remains under development, with availability expected in the next few months.
Anand said Oracle was preparing for a world in which employees routinely create their own agents, adding to the complexity of corporate technology management.
“No one’s going to prevent people from the act of building agents. Once you unleash developer productivity across the organisation, people are going to go build agents.
“The question is, what you can do is monitor them, govern them. You can turn them off if they violate certain guardrails.”
The AI Data Platform expansion also introduces an AI Discovery agent, which automatically identifies the relationships between information held in different corporate systems.
These relationships are organised into ontologies, structured descriptions of how information, business rules and processes connect within an organisation.
For example, an AI agent dealing with a delayed shipment must understand which customer placed the order, which warehouse holds alternative stock and which employee has authority to approve a replacement. Those relationships may be distributed across separate systems, with different access permissions and operating rules.
Oracle’s AI Discovery agent analyses existing databases, application documentation and other business information to construct these ontologies. Business specialists can then review and approve them.
Oracle has also announced a Semantic Reasoning Engine, designed to assemble the relevant business information and relationships before passing them to an AI model. It can retrieve information across connected systems and apply governance controls, reducing the need for agents to reconstruct the same context repeatedly.
Another addition, Deep Insight Agents, will use that business context to investigate complex questions, analyse causes and evaluate possible outcomes, with provision for human review and approval.
Anand said AI was helping Oracle accelerate the creation of ontologies, which traditionally demand substantial manual work.
“Ontologies are not a new thing. Ontologies have played a role in pre-modern AI, but they’ve taken on a new role and importance now. And the great thing is, we’re using AI to actually create and maintain ontologies.
“If it’s an Oracle system, then we can create it instantly because we already know the semantics of not just your business objects and your relationships and those sorts of things, but also your policies, workflows, things of that nature, and connect them all together.”
The platform allows companies to access information stored in third-party databases and cloud services. Some information can be queried in its existing location, avoiding the need to copy sensitive records to another system.
The AI Registry will provide access to registered agents through Oracle Agent Hub and supported third-party assistants, including ChatGPT and Claude. Agents can communicate using Model Context Protocol (MCP) and agent-to-agent (A2A) interfaces, which are designed to let different AI systems exchange information and coordinate tasks.
The announcements extend Oracle’s wider strategy of allowing AI to perform increasingly complex business operations while retaining the controls traditionally built into enterprise applications.
But the pace at which employees are creating agents is already outstripping the ability of some organisations to supervise them.
Asked how widespread agent sprawl had become among Oracle’s customers, Anand said: “I wouldn’t say that customers come to me and say, ‘We have agent sprawl. Please help us.’ The way it comes to me is, ‘I have no way to govern my agent estate across my organisation. These things are starting to pop up everywhere, and as a CIO or chief security officer or whatever, I need some tools to be able to do that.’
“That’s really what we’re trying to solve with this governance framework.”
* Arthur Goldstuck is CEO of World Wide Worx, editor-in-chief of Gadget.co.za, editor of GadgetWings, and author of “The Hitchhiker’s Guide to AI – The African Edge”.