Chapter 21: Agent Governance, Evals & FinOps

Agents Are Outrunning Governance

The 2026 reality: agentic AI is scaling faster than governance. The next failure mode is not a bad prompt - it is thousands of autonomous workflows with unclear ownership, loose permissions, weak measurement, and no shared operating model. Deploying agents without governance is not a strategy; it is a liability. Governance is not a barrier to adoption - it is the foundation that makes sustainable adoption possible.

Four pillars hold it up:

Agent Governance. Inventory active agents, assign owners, define permissions, and document lifecycle rules before agent sprawl becomes invisible infrastructure.

Security and Risk. Design access boundaries, approval gates, audit trails, data-exposure controls, reversibility, and incident-ready workflows around every meaningful agent action. Treat prompt injection and over-broad tool permissions as first-class threats.

Measurable ROI. Move beyond output quality. Establish baselines, evals, quality thresholds, throughput metrics, adoption signals, and business-impact reporting.

Agent Economics (FinOps). Track cost-per-workflow and cost-per-outcome, set budget guardrails, and report ROI per automation. Agent spend becomes visible OpEx tied to outcomes - not invisible token burn buried in the cloud bill.

Budget on unit economics, not on a vendor's current allowance. Through 2026 the major tools converted flat seats into metered credits, promotional allowances lapsed and cut included usage sharply, and frontier model prices moved in both directions - one flagship got a temporary discount while other tiers held. A plan built on this quarter's included credits is a plan with an expiry date you did not choose. Track cost per merged PR or per resolved ticket, because that number survives repricing and lets you compare vendors on the same footing when the bill changes. The tooling has caught up on the controls: per-project budget caps, pooled quotas that flex across teams, and spend dashboards are now table stakes on the enterprise tiers. Turn them on before you need them, and set the alert below the cap rather than at it.

Evals Are Not Model Benchmarks

This is the most important distinction in production AI. Evals do not measure how smart a model is on a public leaderboard. They measure whether an agent achieved its declared intent: outcome attainment, constraint adherence, escalation correctness, and cost-per-outcome - tracked the same way services track SLOs. A model that wins on a public benchmark but fails its intent evals is not shipping. Evals run as CI gates, so an agent's work is checked by independent measurement, not by the agent's own self-report.

# evals/migrate-page.eval.yaml
target: migrate-legacy-page.intent.yaml
checks:
  - name: visual_diff
    assert: pixel_delta <= 0.02
  - name: links_resolve
    assert: broken_links == 0
  - name: performance
    assert: lighthouse_mobile >= 95
  - name: constraint_cost
    assert: cost_usd <= 4.00
  - name: escalation_correctness
    assert: escalated_when_form_present == true
gate: block_merge_on_failure

Agent Reliability SLOs

Production agents need the same reliability standards as production microservices:

* Uptime SLOs - availability targets with error budgets and alerting on failures or malformed output
* Accuracy SLOs - task completion rate without human correction
* Latency SLOs - response-time targets for the workflows agents are embedded in
* Escalation-Rate SLOs - how often agents hand off to humans, with alerts when it drifts

Human-in-the-Loop Policy

Define what agents may do autonomously (low-risk, high-frequency, reversible work like PR triage, dependency updates, and doc generation), what requires a human approval gate (production deploys, access changes, financial transactions, patient-facing decisions), and how escalation routes ambiguity to the right reviewer with full context preserved. In regulated environments - HIPAA, SOC 2, PCI - every agent action is logged with full context: what task ran, which tools were called, what data was accessed, what decision was made, and why. That audit trail is what makes agentic workflows defensible.