The answer lies in the architecture your agents run on. It determines who is allowed to do what before the first agent even launches. Business departments then build freely via self-service, while a gateway automatically secures every call.
Watch the preview and unlock the full recording.
Enterprise-proven: Kärcher, market leader in cleaning technology with 17,000 employees in roughly 90 countries, runs this architecture in production.
76 percent of large enterprises are testing AI agents, yet only 19 percent deploy them in production within core processes. This is shown by our study "Generative AI in Large Enterprises 2026."
Striking: Where agents run in production, multiple governance structures are established more than twice as often. Rules and compliance processes are widespread, but the decision-making bodies are missing: barely one in three companies has an AI board. Without decision-makers, two traps emerge:
- Individual reviews slow the pace: Reviewing every agent individually over months turns IT into a bottleneck.
- Shadow AI emerges: When approvals take too long, business departments resort to their own API keys. Data leaves the company unchecked.
Both traps share the same root cause: control is applied to the individual agent. That doesn't last, because models change constantly and new prompts emerge daily.
Interfaces (APIs) to your core systems, such as ERP, CRM, and databases, remain stable. Securing access to them centrally protects all agents built on top of them, without requiring a separate approval for every use case.
The gateway is the central control point between your agents and your core systems. Every call runs through it. No agent accesses databases, ERP systems, or models directly. This creates the foundation for your Agent Factory, an assembly line for agents.
- Identity: The agent uses the permissions of the logged-in user, no shared accounts. Every action remains attributed to an individual.
- Data privacy: Before a request reaches the AI model, the gateway redacts names, addresses, and other personal data. Data privacy reviews this single point instead of every agent.
- Cost control: Fixed token budgets per department prevent cost explosions. A semantic cache answers recurring requests from memory, reducing latency and costs by 40 to 70 percent.
- Audit log: The gateway logs every call tamper-proof for at least six months (EU AI Act, Art. 12). It blocks individual interfaces centrally if needed.
Example: A service technician asks their agent for a spare part. The gateway verifies permissions, redacts personal data, and logs the access to SAP. The technician receives the result directly.
.png?width=2000&height=694&name=2610%20Governance%20Agent%20Scale-%20diagram%20(1).png "2610 Governance Agent Scale- diagram (1)")
The gateway handles compliance once centrally, before the first agent is created. The Agent Factory builds on this: Every agent adopts the gateway's rules, whether no-code or pro-code.
- Business departments (No-Code): Users build agents via self-service, for example in Gemini Enterprise. They only access pre-approved interfaces. Identity, data privacy, and audit logging therefore apply from the very first call; an individual approval is not required.
Kärcher routes its agents through a shared gateway. The plan was one new agent per month; today, one is created in under two weeks. Three examples using the same interfaces:
- Sales agent for around 2,000 field sales reps.
- Service agent for around 1,500 technicians worldwide.
- Dealer agent for around 50,000 external partners, in preparation.
“Cultural change does not happen through appeals. It happens through architectural guardrails.”
Joachim Rosskopf, Partner and Expert for Enterprise AI & Data at Zoi, explains the architecture on video. You also receive the presentation as a PDF. What you receive:
- Video (30 minutes): Step by step, how the gateway and operating model interact, and how business departments and IT collaborate, using the Kärcher example.
- PDF of the presentation: the math behind the architecture and the table mapping every requirement from the EU AI Act and GDPR to a control in the gateway, for discussions with data privacy and legal.
Watch the 45-minute deep-dive video and receive the presentation slides including the EU AI Act mapping
As soon as you submit the form, you'll get immediate access.
PRESS CONTACT IMPRINT PRIVACY POLICY LEGAL Zoi ©2026