For most large organizations, the technology estate has long outgrown any single person's understanding. Salesforce's 2026 Connectivity Benchmark Report found that the average enterprise now runs 957 applications, up from 897 a year earlier, and only 27% of them are integrated with one another.
That gap matters because the pressure to explain how systems behave is growing. Finance teams, risk functions, and auditors are increasingly being asked to show how data moves, who accesses it, and why. Applying AI agents across this estate makes that task even more difficult.
With Gartner reporting that 33% of enterprise software applications will include agentic AI by 2028, Yulia Plugatyreva, Senior IT & SOX Auditor at Chime, argues that "companies should invest now in visibility tools, because if they do this later, it will cost a lot."
Why AI Agents Can't Be Traced Through a Tangled Stack
A decade ago, an auditor asking IT to trace a transaction from initiation to financial reporting would typically be shown a couple of applications and a clear path between them. Now, Plugatyreva says, companies are building more of their own systems, and a single interaction can touch hundreds of services.
Interactions rarely retain a single identifier from start to finish. A customer taking out a loan might be identified by a user ID at the front end and a different internal database key further downstream. Some services also modify data as it passes through, sometimes deliberately and sometimes unintentionally. When something goes wrong, teams can struggle to establish where the data originated, how it changed, and which systems were involved.
The introduction of AI exacerbates the issue. The EU AI Act requires high-risk AI systems to keep logs so their actions can be reconstructed and reviewed. However, logging an AI system's actions is not enough on its own. Plugatyreva puts the expectation plainly:
"It's not enough to say the AI made the decision."
Companies need to understand the rationale behind those decisions. She says this is possible because AI works with data according to rules configured by people, but only if the company can see where the data came from, how it changed along the way, and which rules were applied. Across hundreds of poorly connected services, identifying the data an AI system used to reach a decision can be difficult.
AI agents widen the gap. Unlike a model that only reads data, an agent can act on a person's behalf, adding another actor to a transaction journey that is already difficult to follow.
How to Regain Visibility Before Deploying AI Agents
Addressing technology sprawl is increasingly necessary in its own right, but it also prepares companies to adopt AI with greater confidence that they can meet regulatory requirements. The work is much the same in both cases, and it starts with ownership.
Plugatyreva is clear that engineering teams should retain responsibility for the systems they build. Her point is that "there should always be a person who would be above all these engineering teams," someone who connects technical decisions to business needs and can account for a transaction from start to finish. As a company grows, she suggests, internal auditors or outside consultants can help map key transactions and keep those maps up to date.
The second step is to limit the scope. Plugatyreva recommends starting with processes that cannot fail. For a financial institution, these include payments, lending, onboarding, and revenue recognition. For each process, the company records who owns every important step and every point where data is transformed. AI can then accelerate the initial mapping process. When connected to internal logs and financial reporting, it can build a first version of the transaction journey and flag gaps, such as services that produce no logs. The result is only as reliable as the logs it uses, so Plugatyreva stresses the importance of regularly reviewing workflows and logging settings, as well as maintaining a list of dependencies showing how a change in one system affects another.
The third step is to apply the same discipline to AI agents. Plugatyreva treats them as "another employee but digital." Each agent receives limited access to the systems it needs and is subject to the same segregation-of-duty rules as a human colleague. For example, an agent that can approve a payment should not also be able to create the payee. Every action it takes should be traceable through the mapped process. A company that has done the groundwork can add agents to a process it already understands. One that hasn't is adding them to a journey nobody can follow.
Why Early Visibility Pays Off
Businesses are adopting tools designed to simplify work, but the way many are doing so is creating environments that are increasingly difficult to monitor.
Plugatyreva expects the problem to deepen as access to AI enables more teams to build their own services. Against that backdrop, the case for mapping systems now is hard to dispute. Mapping a dozen critical journeys is a contained project. Reverse-engineering hundreds of undocumented services after an incident or regulatory inquiry is not.
When the delayed AI Act obligations take effect in December 2027, companies that can answer an auditor's question, "Show me how this transaction happened," will be those that mapped their critical processes while their technology estates were still manageable. Those that waited will have to reconstruct journeys from scratch, under deadline, across more systems than they started with.
