The 87/7 Governance Gap: 87% of Enterprises Use AI, But Only 7% Have Cross-Agent Governance. No-Code Is the Bridge

Here's a number that should make you sit up: 87% of enterprises use AI, but only 7% have any cross-agent governance in place. That's an 80-point gap between how much AI enterprises have deployed and how much of it they can actually control. Most coverage treats those two numbers as a footnote to the AI story. They're not a footnote. They're the whole story.

An 80-point gap is not a rounding error or a lagging indicator. It means that for every organisation running AI at scale, there are roughly twelve running it without a coherent way to control what their agents can access, do, or spend. That's a governance emergency hiding inside an adoption success story.

What's actually in the gap?

The adoption side is easy to find. Gartner puts enterprise AI adoption at 87%, and 80% of enterprise apps now embed agents. The governance side is nearly empty. Depending on the survey, only 7 to 8% of organisations have integrated cross-agent governance, which is the specific, hard thing: a single set of rules that controls every agent across the estate, regardless of which model or vendor it came from. Everything else is a pile of agents, each with its own permissions, its own key, and no common rules.

Cross-agent is the operative word. Teams have plenty of per-agent controls. What they don't have is one layer that sees every agent at once, applies the same policy, and stops the one that misbehaves without taking down the rest.

Why is that dangerous?

Because the industry's own leading signals are screaming about it. DeepMind's 35-page AI Control Roadmap now treats agents as insider threats, which is the security framing nobody wanted but everyone now has. Cloudflare shipped 60-minute self-destruct accounts, a feature whose entire premise is that you might hand an agent credentials you'll regret. And NewCore raised $66 million to give agents employee IDs, because the only way to govern an agent is to treat it like a member of staff you can hire, review, and fire.

Three very different players, one conclusion. When an agent is a thing you can't fully see, can't easily revoke, and can't audit, it's a liability. The fixes are arriving from the security world, the infrastructure world, and the startup world simultaneously, which tells you the gap is real and the people closest to it are treating it as urgent.

The specific nightmare is a single agent with too much access. One agent with a shared credential and no audit trail can read data it shouldn't, spend money nobody's tracking, and act in ways nobody can reconstruct after the fact. The 88% breach rate from last year's data didn't happen because agents were malicious. It happened because agents were ungoverned, which is the same thing in practice.

The other numbers in the gap

The gap shows up in the practical numbers too. Only 6% of teams could switch AI providers without material disruption, per Zapier. Only 29% of developers trust AI code. And 40% of AI spend yields no measurable ROI, per Bain. Those aren't separate problems. They're the same governance gap wearing different costumes. You can't switch providers because nothing abstracts them. You don't trust the code because nothing verifies it. You waste the spend because nothing constrains it.

What happens if the gap doesn't close?

If the gap stays open, the outcome is predictable. More breaches, more wasted spend, more "AI failed" headlines, and eventually a regulatory clampdown that forces the governance on anyway, expensively and after the damage is done. The EU AI Act and its siblings are already moving. The enterprises that build the control layer voluntarily now will be ahead of the ones that get it imposed later.

What does cross-agent governance actually mean?

Let me make it concrete, because it's a phrase people nod at without defining. Cross-agent governance is six things:

• Identity. Every agent has a distinct identity, not a shared human credential.
• Permissions. Each agent can only touch what it's allowed to touch.
• Audit trails. Everything an agent does is logged and attributable.
• Rate limits. No agent can exceed a spend or call threshold.
• Model abstraction. You can swap the model underneath without rebuilding.
• Kill switches. You can stop any agent, instantly, from one place.

That list is not exotic. It's the feature set of a well-run identity platform, applied to non-human actors.

So where does no-code fit?

This is the part the industry keeps missing. Structured no-code platforms already have most of that list built in. Auth, permissions, audit trails, rate limiting, and model abstraction ship with the platform, because they're the same primitives a governed app builder has always needed. The enterprise doesn't need to build a control layer for its agents. It needs to run the agents on a platform where the control layer is already the default.

Concretely: a no-code platform that lets an AI agent update a record does so through the same permission and audit machinery a human user goes through. The agent has an identity, its actions are logged, its access is scoped, and an admin can revoke it in one click. That's the entire governance wishlist, and it was already there for the humans. Extending it to agents is a framing problem, not an engineering problem.

The reframe is simple and it changes the value proposition. No-code isn't "build apps without engineers." It's "run agents with governance you didn't have to build." The second framing is the one the enterprise with an 80-point gap actually needs.

Why hasn't anyone framed it this way?

Because the platforms haven't either. They've marketed themselves as "build apps fast" when the thing enterprises are desperate for is "run agents safely." The features are all there. The framing is backwards. That's the opportunity: the first no-code platform to describe itself as the governance layer for enterprise AI walks into a market that's currently buying exactly that as an expensive service engagement.

The competitive window won't stay open forever. As the governance gap becomes the dominant enterprise story, the big platform vendors will move in and buy or build their way into the framing. The no-code players that stake the claim now get to define the category. The ones that wait will be described as "legacy app builders" while someone else owns "AI governance layer."

What to look for in a platform

When you evaluate a platform for this, look for the six things from earlier, and test them the way you'd test an employee onboarding system. Can you create an agent with its own identity? Can you scope its permissions? Is every action logged? Can you set a spend cap and a kill switch? Can you swap the model without rebuilding? Five or six yeses and you've found your governance layer. Two, and you've found another agent you'll have to govern by hand.

The takeaway

An 80-point gap between adoption and governance isn't a risk to manage. It's a market to win. The enterprises that close the gap will do it by running AI through platforms where auth, permissions, audit, and abstraction are built in, not bolted on. That's no-code. Someone just needs to say so.