Part 1 of The AI Governance Moment: A Practical Series on Saying Yes to AI Without Losing Control.
On a Tuesday afternoon, a sales ops analyst tests an agent that drafts renewal reminders. The test message reads “TEST, please ignore, checking merge fields.” Then the agent makes a poor decision about who should receive it. It skips the team’s test list, selects the full customer list instead, and the message goes to 5,000 customers. By Wednesday morning the analyst is on a call with the head of sales, the head of support, and someone from legal they’ve never met.
For some companies, the governance moment arrived like that, all at once and followed by an apology email. For most, it has been quieter. A director realizes she can’t say how many AI tools her team pays for. An admin finds a connected app he doesn’t recognize with read access to every account. A VP connects Claude to Salesforce over the weekend, gets a great answer, and wonders on Monday what else it could have changed. Nothing went wrong in any of those cases. It just started to feel like something could.
Regardless of your path, the governance moment is here. It’s the point where AI use has grown faster than anyone’s view of it, and a company needs to know what’s running, who owns it, and what it’s allowed to touch.
What the experiments bought us
The experiments were worth it, awkward emails included. When companies told their people to go try AI, they were betting that hands-on use would teach them more than any strategy deck, and the bet paid off. Teams found out which tasks AI handles well, like summarizing an account, drafting a first version, or pulling an answer out of scattered records. They found out where it breaks, usually on judgment calls and on data nobody had cleaned. They found the handful of use cases worth building properly, and they found them faster than a planning committee would have.
That path was normal. Salesforce’s study of agentic AI leaders, published in August 2026, found that most organizations running agents went live with partial oversight and added the rest later. Nearly everyone started this way, including the companies now doing well. The ones that locked everything down early avoided the mess and also missed the learning, and they’re now trying to catch up with a policy and very little experience behind it.
What the experiments left running
The experiments also left a lot to figure out. In our customer work, what we find tends to fall into three groups.
Cost. A pilot that cost pennies per run can cost dollars per run at production volume, and nobody sees the real number until after the decision to scale. Licenses get bought team by team. When finance asks what all of it returns, the spend usually can’t be tied to a use case, so nobody has an answer.
Visibility. Teams build overlapping tools without knowing about each other. Proofs of concept pile up with no business owner. Agents that were useful for a month keep running long after anyone checks on them. Salesforce’s 2026 Connectivity Benchmark found that 89 percent of enterprises are deploying agents while 54 percent have a governance framework, and that the average organization runs 12 agents with about half working in isolation. Surveys on unapproved AI use land between half and 80 percent of employees, and senior leaders use unapproved tools at about twice the rate of their staff.
Access. Ask what a given tool can reach inside Salesforce, and what it can change, and the usual answer is a pause. Most of these tools came in as ungoverned apps and connectors, so they never got the profile, permission set, and onboarding a new user would get.
Governance is how you keep going
Governance has a reputation problem. The word suggests committees, a long policy document, and a review queue where good ideas go to wait. People who lived through the experimenting phase have reason to dread it.
In practice, governance answers four plain questions:
- What AI is running across the company, including the tools that arrived without a project plan.
- Who owns each tool, agent, and connection, by name.
- What each one can read, and what it can change.
- What each one costs, and what it returns for that cost.
Once those answers exist, a lot of good things follow. The agent that emailed 5,000 customers would have had a named owner and a sandbox for testing. The connected app the admin didn’t recognize would have a request on record with a reason. The VP’s weekend session could go ahead with read access and no worry about Monday.
The payoff employees will notice is speed on the next request. A company that knows what it’s running can approve a new use case in days, because the review already knows where to look. A company that doesn’t know is left with two bad options. It can say no to everything, or it can say yes and hope. Over time, employees come to see why the process matters. The director, the admin, and the VP who each wondered whether they should be doing this now have a place to ask, and a quick answer when they do. Structure before the bad day is how you avoid both bad options.
The experiments showed what AI can do. Governance lets you keep doing it with more confidence and fewer apology emails.
If any of the scenes in this article felt familiar, let’s talk. We help Salesforce teams take stock of the AI they’re already running and put the structure in place to approve what comes next. Contact us to start the conversation.
In Part 2, we’ll look more closely at the specific AI governance questions we’re hearing from teams that run Salesforce.