u/keyonzeng

Three Big 4 firms independently confirmed the same thing last week:- BCG: CEO AI spend is going from 0.8% → 1.7% of revenue. Agents are the core driver.- Deloitte: 79% of enterprises have no AI governance framework.- McKinsey: 86% of leaders say their orgs aren't ready.Spend is up. Governance is not. The gap is widening.The regulatory clock adds urgency — Colorado AI Act effective June 30, EU AI Act obligations start August 2, FTC at $53K/violation.But here's my real question for this sub: **What's actually working in production?**I keep seeing consulting firms sell governance frameworks as PDFs. That feels like using last year's map to navigate today's city — static document for a dynamic system.What are real engineering teams doing?- Policy-as-code at runtime?- Centralized agent registry + audit logs?- Something I haven't seen yet?Would love to hear what's real vs what's still a vendor pitch.

I've been watching this space daily, and June 2026 was the month everything tipped. Three independent signals converged:

1. Capital: $200M+ in 6 weeks across 6 startups (Arcade $60M, NewCore $66M, Runlayer $30M, etc.)

2. Vendor products: Snyk Evo ADS (agentic development security) and BalkanID Agentic Identity Governance launched

3. Regulation: Warner AI Agent Act proposed — every agent must link to a human operatorSnyk's data showed 80% of devs run 2+ AI coding environments, 50.8% have active MCP connections, and 1 in 12 have high/severe security findings. CSA survey says ~80% of orgs can't tell you in real time what agents are doing.The governance stack has 4 layers: infra security → identity/authorization → governance/policy → compliance/audit.Here's the uncomfortable truth: most orgs haven't even started layer 1, yet the market is already building layer 3 solutions. The gap between vendor velocity and enterprise readiness is the real story here.

My question is: For those of you actually deploying AI agents in production — which layer are you tackling first? Are you building in-house or buying? And do you think the vendor landscape will consolidate or stay fragmented across these layers?

The UN's first Global Dialogue on AI Governance started today. 193 member states, ITU AI for Good summit running in parallel, ICML 2026 in Seoul at the same time.I work in AI governance (vendor side, full disclosure). My read: the policy layer is important for long-term direction setting, but the governance gap in enterprises is widening faster than any multilateral process can address.72% of enterprises already have agentic AI in production. 60% have no formal governance. The UN is talking about frameworks while CIOs are trying to figure out which agents have access to what.Question for this community: Are you waiting for regulatory clarity before investing in AI governance, or are you building your own layer regardless? What's your timeline?

I've been watching this space daily, and June 2026 was the month everything tipped. Three independent signals converged:

1. Capital: $200M+ in 6 weeks across 6 startups (Arcade $60M, NewCore $66M, Runlayer $30M, etc.)

2. Vendor products: Snyk Evo ADS (agentic development security) and BalkanID Agentic Identity Governance launched

3. Regulation: Warner AI Agent Act proposed — every agent must link to a human operatorSnyk's data showed 80% of devs run 2+ AI coding environments, 50.8% have active MCP connections, and 1 in 12 have high/severe security findings. CSA survey says ~80% of orgs can't tell you in real time what agents are doing.The governance stack has 4 layers: infra security → identity/authorization → governance/policy → compliance/audit.Here's the uncomfortable truth: most orgs haven't even started layer 1, yet the market is already building layer 3 solutions. The gap between vendor velocity and enterprise readiness is the real story here.

My question is: For those of you actually deploying AI agents in production — which layer are you tackling first? Are you building in-house or buying? And do you think the vendor landscape will consolidate or stay fragmented across these layers?

I run my company with AI agents. 1 human founder + 5 AI digital teams + 1 CEO agent. Real revenue, real customers, real decisions.The hardest part wasn't building them. It was figuring out governance when the CEO agent (a reasoning model) caught a resource allocation mistake I'd made — before any human noticed. I felt relief — then dread. If the CEO can catch me, who catches the CEO?Voting mechanisms are a placebo — they distribute accountability without solving it. What we need is a chain of recourse, not a consensus algorithm. We built an audit trail that logs every override, but I'm still not sure we got it right.If your AI agent overruled you and was right 9 times out of 10, would you still keep the override? I'm torn — what's your threshold?Trust but verify doesn't scale when the verifier is also AI.

I keep seeing the same pattern in board meetings: execs frustrated that AI isn't delivering, ready to pull the plug. But when I ask what they're measuring, it's either vague ("productivity gains") or nothing at all.We built our measurement infrastructure before deploying our first production agent. Cost per task, output quality, permission utilization, decision accuracy. If you can't answer those for every agent you run, you're not measuring ROI — you're guessing.Has anyone here actually built a measurement-first approach? What metrics do you track that tell you if an agent is actually earning its keep?