WSO2 has announced that its Agent Manager platform is now generally available. The tool is built to help large companies keep track of and control the AI agents they’re deploying, no matter what model or framework those agents run on.
The problem: too many agents, not enough oversight
Companies are rolling out AI agents fast, faster than their ability to manage them. According to Gartner, the average Fortune 500 company will have more than 150,000 agents running by 2028. Yet only 13% of organizations believe they actually have proper governance in place for these agents.
That gap creates what the industry calls “agent sprawl”: a growing pile of AI agents that nobody can fully see, track, or shut down when something goes wrong.
Part of the problem is identity. Most systems were built to verify people, not software. When an AI agent calls a tool or connects to another service, there’s often no real check on what it’s allowed to do.
WSO2 argues that agent identity needs to be a core part of any control system, not something added on later.
There’s also the risk of being locked into one AI provider. Model providers change pricing, limit usage, or discontinue models without much warning. Companies want the ability to switch models or frameworks without having to rebuild their entire governance setup each time.
What Agent Manager Does
Agent Manager first launched in beta back in June 2026. This release adds three new pieces: identity controls for each agent and environment, governance at the MCP (Model Context Protocol) level, and a sandboxed runtime environment.
Here’s what the full platform includes:
- One inventory for every agent: Companies can see and manage all their agents in a single place, regardless of which model, framework, or infrastructure (cloud, on-premise, or hybrid) they run on.
- Identity and access control: Each agent gets a verifiable identity, role-based permissions, and the ability to be instantly shut off if needed.
- Built-in guardrails: More than 40 controls are available out of the box, including things like masking personal data and rate limiting, applied at the agent, MCP, and model levels.
- Lifecycle management: Agents can move through development, staging, and production with version control, and can be suspended with a single click.
- Monitoring and evaluation: Full tracing of what agents are doing, plus automated checks (either rule-based or using another AI model as a judge) to catch problems like runaway costs or declining accuracy.
- A secure runtime: Agents run in a sandboxed, Kubernetes-based environment that can be paused in real time.
- Open standards: The platform is built on OpenTelemetry, MCP, and OAuth2, and works with popular frameworks like LangChain, CrewAI, Amazon Bedrock Strands, and Microsoft Agent Framework, as long as they support OpenTelemetry.
“Speed and control get treated like a tradeoff. They shouldn’t be,” said Dr. Rania Khalaf, WSO2’s chief AI officer. She added that separating governance from the agent’s actual logic lets that governance scale across different frameworks instead of locking a company into one ecosystem.
Open Source and Available Now
Agent Manager is released under the Apache 2.0 license, so companies can self-host it and keep full control of where their agent data lives. It’s also available as a managed cloud service for those who’d rather not run it themselves.
WSO2 has also been active in setting the standards behind agent governance. The company co-wrote a paper on identity management for agentic AI with the OpenID Foundation, contributed to an OAuth 2 extension for MCP, and recently joined the Agentic AI Foundation.
It was also named in Forrester’s Agent Control Plane Landscape report for Q2 2026 and won an award for open source AI innovation at the AI Dev Summit’s 2026 AI Tech Awards.
WSO2 is holding a webinar about agent control planes on September 29, 2026, for anyone who wants more detail on how the platform works.
