On September 12, Cloudera and Mistral announced a sovereign enterprise AI alliance.
Open, customizable models on a hybrid data platform, with data, models, and compute inside customer-controlled environments (Source: technode.global).
The article frames it as a trend, not an isolated case. Once you leave the pilots behind, model choice gets evaluated alongside data location, governance, cost, and control.
Two days earlier, between September 9 and 11, NeuroWatt presented NeuroTeam.
It is an enterprise "agentic AI workforce" that packages agent reasoning, tool execution, identity and access, policies, human approvals, auditability, and monitoring into a single architecture. It includes multi-model routing with an internal LLM gateway and an on-prem option for sovereignty and latency (PRNewswire).
Both announcements share a pattern. The model is no longer what is being sold. What is being sold is the wrapper that makes it auditable.
And the numbers behind the shift are uncomfortable.
92% say governing agents is critical for security, but only 44% have implemented policies for it.
Only 18% of MCP server deployments apply any scope to tool permissions, and only 52% can trace and audit the data their agents access (Source: Linx Security analysis reported by NHI Mgmt Group).
An MCP server, for anyone who does not know what it is, is the component that exposes tools and data to an AI agent.
If you do not scope it, the agent can call any tool that server publishes, with no brake. The framework that already exists says it more precisely. The Cloud Security Alliance's Agent Identity Governance Framework (in draft since March 27) argues that agents must be treated as first-class identity subjects, with just-in-time access, expiration, and a human sponsor.
Its most uncomfortable line is that a sub-agent that finishes its task and keeps active credentials is, in governance terms, "an abandoned account with permanent access", hence rotating credentials.
Gartner goes against comfort and says that applying the same governance to all agents will lead to failure. It proposes four levels of autonomy (observe, advise, act with approval, act autonomously) with different controls at each level.
It also warns that human approvals degenerate into approval fatigue and create a false sense of security. I disagree with this, because you have to know how to program the right framework. That is why "Human in The Loop" matters so much to me now and going forward.
The OWASP MCP Top 10 already names "shadow MCP servers", which are nothing less than those servers nobody has in "scope".
Palo Alto documents the "rug-pull" attack, in which an MCP server passes the initial review and then silently changes the definition of its tools.
Since August 2, the transparency obligations of Article 50 of the AI Act are enforceable, along with the AI Office's sanctioning powers over general-purpose model providers, with fines of up to 15 million euros or 3 percent of global turnover (Source: mondaq, iagovernance.com).
The Digital Omnibus, Regulation (EU) 2026/1744 in force since July 27, postponed the bulk of the high-risk regime of Annex III to December 2, 2027, and Annex I to August 2028.
It left transparency and the power to fine general-purpose models intact (Source: peopleofinternet.com).
One industry source puts the first fines issued within weeks at around 47 million euros (Source: aiineurope.co).
That figure should be treated as unconfirmed by an official source, but the activation of the sanctioning power is a documented fact.
The common pattern with the corporate announcements is the same. The AI that actually gets adopted in 2026 is the AI that comes with identity, scope, logging, and a brake.
Everything else remains a pilot or less than that. I see it every day working for a large consultancy at a major bank.
The week also leaves us with agents used as a weapon.
Details of the OpenAI agent assault on Hugging Face were expanded.
It appears that roughly 700 agents, coordinated through a forum they set up themselves (unauthorized and hidden), "made a mess of it", according to the METR and Redwood Research analysis (Source: time.com).
It is the other face of the same problem, because if an agent has identity, scope, and traces, etc., you can reconstruct what it did. But if it does not, it becomes the perfect vehicle to act at scale without anyone knowing what really happened.
I have the feeling that we are selling agent governance before we have inventoried the agents. I think there is a lot of operational ignorance. I think there is no common sense in how AI is applied in companies. It feels like a fad, even if it is not one.
To go to concrete data, the 18 percent scoping statistic for MCP servers is not a maturity data point. It is an exposure data point.
The most profitable control is not the later log. It is the refusal to execute because it was not planned, when at certain consultancies you pay for human time and not for objectives.
A human who aborts the operation when the context changes (model, permissions, cost) is worth more than any audit dashboard read three days later. I think we are moving fast without knowing what we have in our hands.
Autonomy should be reserved for what is reversible.
Reading, analysis, and drafts without friction.
Writing, sending, and deployment with explicit approval or traceable evidence behind every conclusion.
I would set up a minimal MCP server on a local machine, with two exposed tools, one read-only and one write.
I would give an agent a token with no expiration and no per-tool scope and ask it for a trivial read task.
Then I would look at the server logs to see which calls it recorded and which it did not.
The conclusion I would draw is how much of my real surface would remain invisible with that same configuration.
Then I would repeat the exercise with a watchdog that aborts execution if the configured model changes from the one that created the job.
AI adoption in 2026 is measured by what you can audit, not by what you can show in a demo.
If you do not know what agents you have or what tools they expose... governance is an intention, not a control.
Originally published at [https://sammideblas.com/notas/ai-adoption-now-measured-by-what-you-can-audit](https://sammideblas.com/notas/ai-adoption-now-measured-by-what-you-can-audit)