Your Agents Don't Need Another Orchestrator. They Need an Auditor.

There is a plateau forming in enterprise AI, and everyone standing on it can describe it better than they can name it.

Roughly a third of large companies now run agentic AI somewhere in the building. Most of the rest plan to within two years. Almost all of them are stuck in the same place: the pilot works, production doesn't. Onstage at industry conferences, executives report thousands of daily active users of internal AI tools in one sentence and admit, in the next, that no measurable value has arrived. Individual developers get faster by half. Teams get faster by a tenth. Organizations barely move.

The pattern has a mundane explanation. Pilots succeed because a small team hand-carries them — adapting inputs, catching errors, absorbing ambiguity with human judgment. Production removes the hands. What's exposed is a governance vacuum, runaway inference costs, and the absence of any shared semantic layer across systems. Surveys suggest the large majority of enterprises have not redesigned a single workflow around AI. They bought engines and bolted them onto carriages.

Vendors have noticed. At industrial trade shows this year, you could hear nearly identical pitches for “agent orchestration and governance” delivered to manufacturing and logistics buyers. A category is being born. It is discussed, funded, and pitched — but not yet named.

Here is the uncomfortable news for everyone racing to name it: the category already has a name. Accounting gave it one about a century ago. It is called internal control.

The oldest problem in the building

Strip the demos away and the enterprise agent problem is this: how does a principal trust work done by an agent it cannot continuously watch?

That is not a new question. It is the founding question of an entire discipline. Economists formalized it in 1976 as agency theory. Accountants had been engineering answers to it since before the telephone: segregation of duties, authorization hierarchies, audit trails, independent verification. The modern canon — the COSO framework (1992), Sarbanes-Oxley (2002) — exists because corporations grew past the scale at which an owner could personally watch the clerks.

For fifty years, “agent” in agency theory was a metaphor. Large language models made it literal. An LLM agent is a clerk who works at machine speed, never tires, occasionally fabricates records with total confidence, and feels no shame. Accounting has been governing precisely this employee profile for a hundred years. The only new variable is the speed.

The industry is currently reinventing auditing from scratch, in Python, badly.

The mapping

Take COSO's five components of internal control and hold them against what a production agent deployment actually needs. The fit is not approximate. It is one-to-one.

1. Control environment → the charter. Before tooling, a written constitution: which roles exist, what each may touch, which values bind all of them. Not a system prompt — organizational law. Most enterprises have nothing like this for their agents. Their control environment is a Slack thread.

2. Risk assessment → classify by irreversibility. The single most useful distinction in agent operations is not “high risk / low risk.” It is reversible versus irreversible. Drafts, analyses, internal artifacts: let agents run. Publishing, paying, deploying, deleting, sending anything outside the walls: these cross a one-way door. Enumerate the doors first. Everything else in the control system hangs off this list.

3. Control activities → segregation of duties, authorization gates, and hard enforcement. The agent that writes should not approve. The agent that executes should not audit itself. Every irreversible act requires a named human's explicit authorization — a click, not a vibe. And the critical engineering lesson: rules that live in documents are suggestions; rules that live in hooks are laws. A pre-commit hook that hard-rejects any change lacking a link to its audit record does not care how persuasive the model is. Compliance you have to remember decays in weeks. Compliance that is mechanically enforced does not decay.

4. Information and communication → every action leaves a receipt. Structured run records: who acted, what changed, on whose authorization, with links to evidence. And the first commandment of agent operations: never accept an agent's self-report as evidence. An agent claiming “deployed successfully” is testimony, not proof. Verify through an independent channel — query the live system, read the log, curl the endpoint. In internal-control language: trusting the agent's own account is a control deficiency, not a time-saver.

5. Monitoring → design for discoverable death. Liveness checks, periodic audits, and one non-negotiable design rule: every automated mechanism must be built so that its failure is noticed. A monitor that dies silently is worse than no monitor — it manufactures confidence instead of coverage. If you cannot state how you would find out that a control has stopped working, you do not have a control. You have a decoration.

Why pilots pass and production fails

Every successful pilot contains a hidden component that never appears on the architecture diagram: a sovereign. One person with complete context, unified intent, and final authority — usually the champion engineer who built the thing. Ask why the pilot worked and you will eventually find that person, quietly absorbing every ambiguity the system could not.

Production has no sovereign. Intent fragments across departments; context lives in silos; final authority dissolves into committees. The pilot-to-production gap is not primarily a technology gap. It is the difference between a system governed by a person and a system that must be governed by structure.

Internal control is, precisely, the technology civilization developed for replacing the sovereign with structure. Trust scales through three forms. At N=1, trust is identity: the founder is the law. At N=20, trust must become enforcement: hooks, gates, and separated duties, because discipline does not survive headcount. At N=10,000, trust must become statistics: sampling audits, anomaly detection, and delegated authorization matrices, because no human can review the volume. Enterprises deploying agent fleets are discovering what railroads discovered about clerks: you do not scale trust by trusting harder. You scale it by structuring it.

A one-person case study

I run a one-person company with a working fleet of AI agents — multiple models, concurrent sessions, real production surfaces: storefronts, deployed websites, financial records. For over a year it has operated under a full internal-control stack: a written charter; a segregation-of-duties matrix; human-click authorization for every push, deployment, and publication; an audit row for every shipped change, linked from the commit itself and enforced by a pre-push hook that hard-rejects anything without one; a multi-point pre-ship audit covering privacy, legal exposure, and factual claims; and monitors designed so that their death is discoverable.

Three findings from running this in earnest:

1. Every incident traced to a control gap, not a model gap. When something shipped wrong, the post-mortem never ended at “the model hallucinated.” It ended at “the fact-check gate didn't exist yet” or “the rule lived in a document instead of a hook.”
2. Paper rules decay; mechanical rules don't. Every control that depended on remembering eroded within weeks. Every control embedded in enforcement is still standing.
3. The economics of honesty are designable. The expensive part is not catching agents in errors or fabrications. It is designing the system so that fabrication doesn't pay — independent verification as default, self-reports as testimony only.

None of this required a platform. It required a constitution and a hook.

What happens next

Predictions, falsifiable and dated:

• Orchestration vendors will add “governance” tabs within a year. Checkbox governance will underperform, because governance is an operating model, not a feature.
• Hyperscalers will bundle agent governance into their platforms, and the standalone orchestration layer will compress — the container-orchestration story, rerun at higher stakes.
• At some point the Big Four will notice that their own textbook covers this, and “agent assurance” will become a service line. The talent best prepared for this market is not ML engineers. It is auditors.

If you are building in this space: the wedge is not a platform. It is an audit — pick a regulated industry and sell the trail that regulators already demand. If you are buying: before purchasing any orchestration product, ask a cheaper question first. For your most recent agent action, can you produce the record of who authorized it, on what basis, with what evidence? If not, no platform will save you. You have a control-environment problem, and that is fixed with a constitution, not a subscription.

Hardware standardization without governance software is an old story. The first empire in history to unify the roads and the script — but never install an operating system for organizing people at the new scale — lasted fifteen years. The successor dynasty kept the hardware, wrote the software, and ran for four centuries.

Your agents don't need another orchestrator. They need an auditor.

Pollyanna runs a one-person company operated jointly with a fleet of AI agents, governed by the internal-control framework described above. This essay is part of an ongoing series on AI operations at nbidea.ai.