The audit problem nobody wants to own

I have now recorded more than 750 conversations with founders, CTOs and chief data officers. Over the last 18 months, one line keeps surfacing, usually near the end of a recording, usually after I have stopped pushing.

"We have agents in production and I could not tell you exactly what they are doing."

Nobody says that on stage. Everybody says it in the hallway.

That sentence is what Boomi built its Sydney announcement around, and it is why I want to give this issue proper room rather than summarising a press release and moving on. There is a real architectural argument inside this news, and whether or not you ever buy anything from Boomi, the argument is going to shape how your organisation runs agents over the next 2 years.

Here is how this issue is structured, so you can skip to what you need.

1. The 3 numbers that set the frame

2. What Boomi actually announced, grouped so it is memorable

3. The architectural argument: observing versus enforcing

4. What happens to a single agent request

5. The cost question, worked through with real math

6. Why Sydney, and what sovereignty actually means in APJ

7. Why the MCP layer is the strategic prize

8. Chicago to Sydney, and what changed in 4 months

9. What this means for you, by role

10. The 5 questions I would ask before buying

11. What I am watching next

12. A short glossary, if any of this is new

1. The 3 numbers that set the frame

Three independent data points landed in the same window, and they line up uncomfortably well.

Governance. Gartner projects that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps identified only after production incidents occur.

Read the timing in that sentence carefully. The gap is not found in a design review. It is not found in a risk workshop. It is found in the incident. That is the difference between a control that works and a control that documents.

Cost. The FinOps Foundation's 2026 State of FinOps survey covered 1,192 practitioners representing more than 83 billion dollars in annual cloud spend. 98% now manage AI spend. Two years ago that figure was 31%. AI cost management is now the most in-demand skill in the discipline.

A jump from 31% to 98% in 24 months is not a trend. That is a discipline being rebuilt around a new cost centre in real time.

Trust. In a Forrester Consulting thought leadership paper commissioned by Boomi in July 2026, 86% of leaders said their organisations had moved past agent pilots. Only 34% said they trust the actions their agentic systems take. Organisations that deployed agents before they were ready reported an average of 2.1 million dollars in added cost.

I want to be fair about that last one. Boomi commissioned it, and vendor-commissioned research tends to find the problem the vendor solves. But the 86 versus 34 split is consistent with what I hear in rooms nobody paid for, and the direction matches the independent Gartner and FinOps numbers. I am treating it as directionally sound and clearly labelled.

Put them together and the picture is specific. This is not a capability problem. Agents work. Models are good enough. This is an accountability problem, and accountability problems get solved by infrastructure or they get solved by shutting things off.

Most enterprises currently pick the second option. They restrict connectivity. It looks responsible on a risk register, and it quietly starves the agent of exactly the systems and data that made it worth building.

2. What Boomi actually announced

The centrepiece is the Agent Control Plane: AI-native infrastructure that securely connects AI agents to core business systems, provides governance over agent activity, and controls runaway AI costs. It is vendor and model neutral, and it runs on public cloud, in a customer's own VPC, or on premises.

Boomi presented 6 operating scenarios. Six is too many to hold in your head, so I have collapsed them into 3 jobs.

Job 1. Control the path.

A single control point centralises visibility for agents and tools across vendors, inspects live traffic, applies identity and rate limits, curbs token overruns and cost surges, and holds high-risk transactional actions for human approval.

Two components matter here and they are not the same thing. The Agent Control Plane provides the AI infrastructure. The Boomi AI Gateway, built on technology from the Lunar.dev acquisition, is described as the enforcement layer, combining MCP gateway and LLM gateway capabilities in a single control point. Boomi's own language says the gateway "will act as" the enforcement layer. I will come back to that tense.

Job 2. Connect by default.

Boomi Connect exposes enterprise systems as governed MCP servers and tools that any MCP-compatible agent can discover and call. More than 1,000 pre-built MCP servers and tools, access provisioned through your existing identity provider, with tool calls authenticated, logged and metered.

This is the piece that changes daily behaviour. It is how an analyst using Claude, ChatGPT or Gemini touches a real system without an engineer hand-rolling a connector and stashing a credential in a config file. It replaces the single worst pattern in enterprise AI right now, which is the shared service account with too much scope and no expiry.

Alongside it, the hybrid runtime runs agents, tools, bring-your-own models and specialised small language models inside private networks and regional boundaries. BYOM starts with Anthropic, OpenAI and Gemini models and is stated to expand.

Job 3. Make the output defensible.

Agent Context grounds reasoning in expert-endorsed business definitions with end to end lineage, giving visibility into data provenance for AI-driven actions. That reduces hallucination and, less obviously, cuts token waste, because a grounded agent stops re-deriving things it should already know.

Boomi Orchestrate converts natural language intent into multi-system agentic workflows, presented in two views: a business view of the logic and a technical view of the implementation, staged for testing and review before go-live. The two-view idea is the underrated part. Most failed automation projects fail because business and IT reviewed two different artefacts and both signed off.

Finally the platform opens further to builders through expanded Agentstudio APIs, Companion skills, and an agent trust scorecard published on GitHub.

3. The architectural argument: observing versus enforcing

Strip the product names away and Boomi is making one claim. Enforcement has to sit in the path, not alongside it.

That sounds like a small distinction. It is the entire thing.

Most AI governance tooling shipped in the last 18 months observes. It ingests logs, builds dashboards, scores risk, and tells you what happened. That is genuinely useful for reporting and completely useless at the moment of decision. By the time the event reaches the dashboard, the agent has already written to the record and already spent the money.

A control point in the request path can do something an observer structurally cannot. It can refuse.

It can refuse a call that falls outside policy. It can throttle an agent stuck in a retry loop before that loop costs 4 figures. It can hold a write to a general ledger until a named human approves it. And it produces one complete record rather than a reconciliation exercise across four partial ones.

Michael Barnes, Chief Analyst for Enterprise IT at Omdia, framed the underlying problem precisely: cloud and model providers each govern their own estate, which leaves the average enterprise holding several partial audit trails and no complete one.

That is the real gap, and it is worth being concrete about it.

Your model provider can tell you which tokens were consumed. Your cloud provider can tell you which compute ran. Your identity provider can tell you who authenticated. Your SaaS vendor can tell you which record changed. None of them, alone or together, can reliably tell you that agent 47 updated a customer record at 3am, grounded in a definition your finance team endorsed, at a cost of 12 dollars, after a named human approved the write.

Reconstructing that story from four vendors' logs 6 months later, under audit, with staff turnover in between, is not a governance strategy. It is a fire drill.

Steve Lucas put the business consequence plainly: finance is now asking which agent spent this, on what, and who approved it. Until an enterprise can answer those, AI is an expense nobody can defend, and what cannot be defended does not get funded.

I think that is largely right, and I would go one step further. The organisations that solve this first will be able to expand agent scope faster than their competitors, not slower, because their risk committee will finally have something to say yes to.

4. What happens to a single agent request

The hero image at the top of this issue is the clearest way I found to explain this to a non-technical executive, so here it is in words.

An agent asks to do something. Before that request touches a business system, 7 things have to happen.

1. Identity resolved. Access is provisioned through your existing identity provider, not a shared key in a config file. The agent inherits a real, revocable identity.

2. Policy applied. Scope, rate limits and tool permissions are enforced at the gateway, in the path, not checked afterwards.

3. Cost metered. Token spend is attributed to a team, an agent and a budget as it happens, not reconciled at month end.

4. Tool called. A governed MCP server exposes the system rather than a bespoke connector somebody wrote in 2024 and left.

5. Context grounded. The reasoning is bound to endorsed business definitions with traceable lineage, so the answer has a provenance chain.

6. Human approves. High-risk transactional actions are held until a person signs off, and that person is recorded.

7. Action logged. One record of what ran, what it cost and who authorised it.

Miss any one of those and you have an agent nobody can defend in an audit. Miss steps 2, 3 and 6 in particular and you have the exact failure mode Gartner is describing, where the gap only reveals itself once something has gone wrong in production.

Take that list into your next vendor conversation, whoever the vendor is, and ask which of the 7 their product actually performs versus merely records.

5. The cost question, worked through

I want to spend real time here, because cost is where this becomes a board conversation rather than an architecture conversation.

98% of FinOps practitioners now manage AI spend. That means somebody in your organisation has already been handed a number they cannot explain. Here is the shape of the report that ends that problem.

That table is illustrative. I built it to show the shape, not to represent Boomi output. But look at what it makes visible.

The 2 cheapest agents in that view did roughly 79% of the token volume. They cost the least because they run small language models close to the data, one on premises and one inside a VPC. The single most expensive agent did a fraction of the volume, because it is a frontier model calling a public endpoint from procurement.

Without per-agent attribution, that entire picture collapses into one line item on a cloud bill labelled "AI". You cannot optimise it, you cannot charge it back, and you cannot defend it. With attribution, three decisions become obvious in an afternoon: move the high-volume, low-complexity work to small models, put the frontier model behind a stricter budget, and check why procurement is calling a public endpoint at all.

This is why I keep saying agent-level cost attribution is going to become a procurement requirement, the same way SOC 2 did. It is not a dashboard feature. It is the thing that decides whether an AI programme survives its second budget cycle.

One more point that gets missed. Grounding reduces cost, not just error. An agent that has to rediscover a business definition on every run burns tokens doing it. Agent Context is presented as a quality feature, and it is, but the token bill is where a CFO will notice it first.

6. Why Sydney, and what sovereignty actually means

Boomi could have held this news for a US stage. Putting it in Sydney is a deliberate signal, and it is the part of this announcement I would pay closest attention to if you operate in APJ.

Sovereignty language in this region is not aspirational. Australian regulated industries, public sector buyers, and anyone working under regional data residency obligations have a hard constraint: sensitive data, and the intellectual property sitting inside prompts, cannot leave the boundary. Not as a preference. As a condition of purchase.

Most AI governance products answer this with a region selector on a control plane that still lives somewhere else. Boomi's answer is that the same control plane runs in three places: public cloud, your own VPC, or on premises. Agents, tools, bring-your-own models and specialised small language models all execute inside private networks and regional boundaries.

That distinction is the difference between a product a regulated Australian bank can shortlist and one it cannot.

I hear the same requirement in India, arriving from a different direction. There, the pressure is a combination of data localisation and cost structure. Frontier model calls at Indian enterprise volumes get expensive fast, and small models running close to the data are not a compromise, they are the sensible default for most workloads.

Both markets are converging on the same architecture: small models near the data, frontier models called sparingly and under policy, and a boundary that is enforced rather than promised. The vendors who assume unlimited public frontier model calls are building for a market that does not exist in this region.

7. Why the MCP layer is the strategic prize

Here is the part that is more about strategy than product.

MCP is becoming the standard way agents reach tools and systems. Once your enterprise systems are exposed as governed MCP servers, and once every agent in the building discovers and calls them through that layer, the gateway sitting in front of those servers becomes extremely difficult to remove.

It holds the identity bindings. It holds the policies. It holds the cost attribution history. It holds the audit trail your regulator has already seen. Replacing it means re-onboarding every tool, re-issuing every policy, and explaining a gap in your audit record.

That is a strong position, and Boomi clearly understands it. So does everyone else in this market, which is why the gateway layer is about to get crowded.

For you as a buyer, that means one thing above all others: ask how you get out. Can policies be exported in a portable format? Can the audit record be extracted in full? Are the MCP server definitions yours or theirs? Ask it now, while you have leverage, rather than in year 3 when you do not.

I am not saying this to be cynical about Boomi. The same question applies to every vendor competing for this layer, including the hyperscalers, and the ones with good answers will say so happily.

8. Chicago to Sydney

For anyone tracking Boomi across the year, the 4-month arc is worth seeing laid out.

At Boomi World in Chicago in May, Steve Lucas opened with the statistic that only 7% of enterprise data is genuinely in motion, and made the case that the one remaining moat beyond physical infrastructure is your data. That event introduced the Agent Control Tower, announced Boomi Connect, and disclosed a letter of intent to acquire Lunar.dev, an MCP and AI gateway specialist.

Sydney is where the intent becomes architecture. The acquisition closed, the technology became the enforcement layer of the Boomi AI Gateway, and the Agent Control Tower has broadened into the Agent Control Plane spanning public cloud, VPC and on premises.

Four months from letter of intent to a shipping architecture story is fast for infrastructure of this kind. Acquisitions of gateway technology usually take longer to surface as anything other than a slide.

I will hold one reservation. Fast integration on stage is not the same as fast integration in a customer's environment, and the enforcement layer is still described in future tense. That is my first question in the next section.

9. What this means for you, by role

If you are a CIO or CTO. Your exposure is not the model. It is the write path. Inventory every agent currently able to write to a system of record, and check whether any human approval sits between the agent and the write. If the answer is no, that is your highest-priority gap regardless of which platform you eventually buy.

If you own data or platform engineering. The MCP layer is about to become load-bearing infrastructure in your estate. Decide deliberately whether governed MCP servers are something you build or something you buy, before the decision gets made for you by whichever team ships first. Also start treating agent identity like service identity, with rotation, scope and revocation.

If you sit in FinOps or finance. Ask for per-agent, per-team token attribution this quarter. Not a total. An attribution. If your current tooling cannot produce it, that is the requirement to write into the next procurement cycle. Chargeback is what turns AI from an unexplained line item into a funded programme.

If you are an engineer building agents. The constraint arriving in your world is not capability, it is provenance. Design now for the assumption that every tool call will be logged, metered and possibly held. Agents that assume unlimited, instant, unapproved access to systems will need rewriting.

If you are in security or risk. Push back on uniform governance. Gartner's second finding is that applying the same governance to every agent regardless of autonomy level and scope leads to failure. An agent that reads a dashboard and an agent that posts a journal entry should not sit under the same policy.

10. The 5 questions I would ask before buying

I do not write brochures, so here is what I would press on in an evaluation. These apply to any vendor in this category.

1. What is generally available today, and what is roadmap? Agent Control Plane isn't a standalone product with its own separate release cycle; it's a solution powered by the Boomi Enterprise Platform that brings together capabilities its customers already rely on (connectivity, identity governance, data grounding, and run-anywhere execution) under a single, purpose-built control point for agentic workloads. Some of the newest capabilities, like the AI Gateway enforcement layer built on Boomi's Lunar.dev acquisition and expanded SLM support, are rolling out in 2026 and will continue to broaden through the rest of the year, but the core capabilities enterprises need today (connecting, governing, and controlling AI agents in production) are available now.

2. How is policy actually expressed? A control point is only as good as the policy model behind it. Can I write policy as code, version it, test it, promote it through environments, and diff two versions? Or is it a settings page with toggles? This determines whether governance scales past 20 agents.

3. How do you handle risk tiering? Following on from Gartner's warning about uniform governance: show me how an agent that reads gets a different policy from an agent that writes, and how that tiering is assigned, reviewed and enforced. This is the hardest problem in the category and almost nobody has fully solved it.

4. What does the checkpoint chain cost in latency? Every check in the request path adds milliseconds. For a nightly reconciliation agent, irrelevant. For an agent inside a live customer conversation, decisive. Ask for published p50 and p99 overhead numbers, not a reassurance.

5. How neutral is neutral, and how do I leave? BYOM starts with Anthropic, OpenAI and Gemini. Ask about open weight models on your own hardware, how quickly new frameworks get first-class support, and whether policies, audit records and MCP server definitions are exportable in a portable format.

If a vendor answers all 5 without flinching, that tells you a great deal. If they answer 3 and get vague on 2, that tells you which 2 to keep asking about.

11. What I am watching next

Agent-level cost attribution becomes a procurement checkbox. Within 12 months I expect per-agent chargeback reporting to appear in RFPs the way security certifications do. The vendors who can produce it get shortlisted. The ones who cannot spend every deal explaining themselves.

Small language models stop being a cost optimisation and start being the default. Once cost is attributed per agent, the economics of running high-volume work on frontier models stop surviving contact with a finance team. Expect a rapid shift toward specialised models running close to the data, with frontier models reserved for genuinely hard reasoning.

The gateway layer consolidates. Too many products are converging on the same position between agents and systems. Expect acquisitions, and expect at least one hyperscaler to make the neutrality argument harder to sustain.

Risk-tiered policy becomes the differentiator. The single control point is now table stakes. The next competitive round is fought over granularity: how finely can you tier, and how cheaply can you maintain that tiering as agent counts grow.

Human-in-the-loop gets an efficiency problem. Holding high-risk writes for approval is correct, and it creates a queue. The interesting products in 18 months will be the ones that make approval fast enough that people do not start rubber-stamping.

12. Short glossary, if any of this is new

Agent. A system that uses a model to take actions, not just produce text. The distinction that matters is that it writes, calls tools and triggers workflows.

MCP. Model Context Protocol. An open standard for how agents discover and call tools and data sources. It is becoming the common interface layer, which is why control of that layer is strategically valuable.

Control plane. The layer that decides what is allowed and enforces it, as opposed to the data plane that does the work. Borrowed from networking, and the analogy holds well.

Gateway. A component sitting in the request path that inspects and acts on traffic. An MCP gateway governs tool calls, an LLM gateway governs model calls. Boomi is combining both.

Grounding and lineage. Grounding binds an agent's reasoning to approved definitions of business terms. Lineage records where the data came from. Together they are how you answer "why did it say that" months later.

BYOM. Bring your own model. Running the model of your choice inside your own environment rather than being tied to the platform vendor's model.

SLM. Small language model. Smaller, cheaper, often specialised, and increasingly good enough for the majority of enterprise tasks.

FinOps. The practice of managing cloud, and now AI, spend as an operational discipline rather than an accounting exercise after the fact.

One thing to take away

Control is not the brake on enterprise AI. It is what lets you take your hands off the wheel at all.

Every organisation I speak to that has genuinely scaled agents did the same thing first. They made agent activity legible. Not perfect, not fully automated, just legible enough that somebody could stand behind it in a meeting.

If you are running agents in production today and you cannot answer which agent spent this, on what, and who approved it, that is the work for this quarter. Whatever platform you use, and whether or not it is this one.

Reply and tell me: are your agents in production, in pilot, or paused on governance grounds? I read every response, and the pattern will go into a future issue with no names attached.

If this was useful, forward it to the person on your team who owns AI cost. They are having a harder month than you think.

Ravit Jain
Founder and Host,
The Ravit Show