---
title: "Agent-Ready Means Governed, Not Just Reachable"
description: "Two large October 2026 surveys found that most enterprises already run AI agents but few can trace, see or stop them, and a third have found MCP servers nobody approved. Readiness has a second half: agents that can be identified, scoped and stopped. Here is what of that a site can show from the outside, and what it can't."
author: "Victor Okolie"
publishedAt: "2026-10-23"
category: "AI Readiness"
tags: ["Agent Governance", "MCP", "Agent Security", "Agent Readiness Score", "Enterprise AI"]
canonical: https://glintbase.dev/blog/agent-ready-means-governed
---

# Agent-Ready Means Governed, Not Just Reachable

> Two large October 2026 surveys found that most enterprises already run AI agents but few can trace, see or stop them, and a third have found MCP servers nobody approved. Readiness has a second half: agents that can be identified, scoped and stopped. Here is what of that a site can show from the outside, and what it can't.

Published 2026-10-23 by Victor Okolie · AI Readiness · HTML version: https://glintbase.dev/blog/agent-ready-means-governed

Most agent-readiness talk, ours included, is about the front door: can an agent find your docs, read your pages, call your API or MCP server? That's half the question. The other half is the one enterprise buyers keep asking: when agents do get in, can you tell which agent did what, limit what it can do, and stop it?

Two surveys published in October 2026 put numbers on that gap.

> **Insight:**
>
> Being reachable by agents is the easy half. The harder half is being reachable by the right agents, with each action attributable and each agent containable. Most organisations already run agents but can't yet do that.

## What the Surveys Found

**Salt Security**, *State of Agentic AI and API Security 2H 2026* (13 October; 380+ security and technology professionals, plus Salt's own customer telemetry):

- 86.4% have at least one AI agent operating in their organisation.
- Only 12.5% can consistently trace a complete agent path across all their agents.
- Only 17.5% can automatically stop an agent that starts behaving unexpectedly in production.
- 32.9% have found an unauthorized, shadow or misconfigured MCP server.
- 49.8% confirmed or suspect an agent took an action they didn't intend or authorize.
- In Salt's telemetry, MCP infrastructure showed up in 21.6% of customer environments in August 2026, up from 16.7% in January.

**ServiceNow with Phronesis Partners**, *Deployed but ungoverned: the state of agentic security* (20 October; 3,700+ senior security and technology leaders in 20 countries, 97% at companies with $250M+ revenue):

- 90% experienced an agentic AI security incident in the past year, and only 36% of those contained it within 24 hours.
- 29% found agents running in production that had never been registered.
- 76% say they keep a complete, current map of every agent's access, but only 19% can see more than 90% of their agents in real time.
- 66% can't act automatically when an agent behaves anomalously.

Both are vendor surveys: Salt and ServiceNow sell agent security, so read the numbers as the vendors' own. But they agree on the shape. Adoption has run ahead of control. The gap isn't whether agents can get in. It's whether anyone can see, attribute and stop them.

## The Market Is Already Selling "Agent-Ready" as Governed

On 13 October, Workday made its HR and finance system available to outside agents through MCP tools, which it calls Agent-Ready Tools. Agents work "under the same Workday permissions, approvals, and audit trails" as the person they act for. The same day, Workday announced a definitive agreement to acquire C1.ai, an identity platform for people and agents that limits their access, enforces policy and logs actions. The deal is expected to close by the end of January 2027.

When a Fortune 500 vendor sells agent access, the selling point is the controls around it, not the access alone.

## What a Site Can Show From the Outside

Most governance happens inside a company: an inventory of agents, logs of who called what, the ability to revoke. A scanner can't see any of that. But several public signals show whether a service is *built* to be governed, and the Agent Readiness Score checks them:

| Signal | What it shows | ARS check |
|---|---|---|
| A standard auth challenge with RFC 9728 metadata | An agent can find out how to authenticate, instead of a person sharing a key | `agent-auth-www-authenticate`, `oauth-rfc9728-prm` |
| The challenge names a scope (SEP-835) | Access can be asked for narrowly and stepped up when needed | `mcp-auth-scope-challenge` (new in ARS 3.3) |
| Scoped permissions in the auth metadata | Tokens can be limited to what a task needs | `auth-scoped-permissions` |
| `readOnlyHint` / `destructiveHint` on MCP tools | An agent or its supervisor can tell a lookup from a delete before calling it | `mcp-tools-readonly-hint`, `mcp-tools-destructive-hint` |
| A Server Card in the AI Catalog | The server says who runs it and where its endpoints are, so it can be inventoried | `mcp-server-card` (new in ARS 3.3) |

On the safety annotations, the public picture is mixed. In our [study of 3,000 remote MCP servers](https://glintbase.dev/blog/what-3000-mcp-servers-told-us), 56.7% declared `readOnlyHint` on at least one tool and 50.5% declared `destructiveHint`. On the other hand, 82.7% of servers that required auth gave a challenge an agent could follow.

## What a Site Can't Show

Some of the most important controls are invisible from outside:

- **Whether the server checks a token's audience.** In both official MCP SDKs the fix for accepting tokens issued for another service ships turned off. See [the MCP auth fix that ships turned off](https://glintbase.dev/blog/mcp-auth-fix-ships-turned-off).
- **Whether agent calls are attributed.** Logs that record which agent, acting for whom, called which tool.
- **Whether an agent can be stopped quickly.** Revocation and kill switches.
- **Whether unregistered MCP servers are running.** The 29% and 32.9% figures above are about servers nobody inventoried.

These need a review from the inside: configuration, logs and an inventory of agents and MCP servers. A public score that claimed to measure them would be guessing, and ARS doesn't.

## What to Do

1. **Make the visible signals right.** Standard auth challenges with RFC 9728 metadata, scopes in the challenge, safety annotations on every tool, and a Server Card listed in `/.well-known/ai-catalog.json`.
2. **Turn on audience validation** if you use the MCP SDKs' bearer auth. Upgrading alone doesn't do it.
3. **Inventory your MCP servers and agents,** including ones teams set up themselves.
4. **Log calls with attribution:** which agent, on whose behalf, which tool, with what result.
5. **Make sure you can stop an agent:** revoke its tokens or block its client without taking the service down.

*Sources: Salt Security press release (13 October 2026), ServiceNow press release (20 October 2026), Workday press releases (13 October 2026), all read on 23 October 2026. Disclosure: Glintbase sells agent-readiness scoring.*

> Check your own site's Agent Readiness Score for free at https://scan.glintbase.dev