AI agent governance
Oversight gives boards and risk committees an auditor-ready picture of every AI agent in the organisation: what it can access, who owns it, and whether you are within policy.
8 agents inventoried2 shadowposture 42/100as at 16 Jun 2026
The register, worked
Sample Financial Services Entity
APRA-regulated, Financial Services
Key performance indicators
AI Posture Score
42/100
+4 vs last quarter
Agents Inventoried
8
Est. 12-15 total
Shadow AI Detected
2
Ungoverned
Audit Readiness
38/100
APRA-aligned
Agents with Owner
75%
6 of 8
MCP Servers Governed
1 of 3
Cursor ungoverned
Agent registry
| Agent / System | Risk |
|---|---|
Microsoft Copilot M365 Microsoft | high |
Claude - Legal Team Anthropic | medium |
Glean Enterprise Search Glean | high |
Zapier AI Agents Zapier | high |
ChatGPT (personal) OpenAI | critical |
Cursor AI (developer machines) Anysphere | critical |
Top findings
Personal ChatGPT accounts uploading business documents
CPS 234 para 20
Cursor MCP has read access to credentials in source repos
CPS 234 para 21(b)
AI inventory incomplete - est. 30-40% of agents unrecorded
APRA April 2026 letter
Copilot M365 over-privileged shared service account
CPS 234 para 21(b)
Your client data, populated by Veyruna advisory
Built for Australian regulatory obligations
APRA CPS 230
Board accountability for operational risk, including AI agents touching critical operations.
Remade, in force 1 Jul 2026
APRA AI Letter
Boards must hold an AI tooling inventory, demonstrate effective challenge, and not rely solely on vendor summaries.
30 Apr 2026
ISO/IEC 42001
A documented AI risk assessment process (Clause 6.1.2), with inventory and human-oversight controls (Annex A) reviewed by management (Clause 9.3).
Cl 6.1.2 + Annex A