If your employees are building agents faster than anyone owns them, SK Telecom has now published an operating model you can copy. An agent gets an employee ID only after an internal review, the more autonomous or higher-impact agents must be owned by a team leader or executive, every step is logged with a stop switch, and agents that stop earning their keep are suspended or retired. The rules are in the company's first AI Governance Report, released October 26, 2026, and none of them require buying a product.
The report matters because SK Telecom is running agents at a scale most enterprises are only planning for. It said in June that it already uses thousands of AI agents alongside its staff, with a goal of one agent per employee and an internal Agent Store where non-developers share what they build. This month it also extended its ISO/IEC 42001 certification to the internal AI agent management system, so an outside auditor has looked at the process described below.
How Does SK Telecom Decide Which Agent Gets an Employee ID?
An agent at SK Telecom is registered when it is built, but it only receives an employee ID after it passes a separate internal review. Financial News reports that once an agent holds an ID, the company tracks its assigned tasks, its responsible person, its affiliation, its operating status and its performance, the same fields an HR system keeps for a human hire.
That two-step design is the useful part. Registration is cheap and catches everything, including the agent a marketing analyst built on a Friday afternoon. The ID is the gate that says this agent is now part of how the company works, and it is the point at which ownership, permissions and review obligations attach.
The ID system did not start with this report. SK Telecom introduced it in June under its AX Innovation 2.0 program, when each agent was given an employee-style ID, a department, a job function and role-based access to systems and data. What the October report adds is the review, the ownership rule and the retirement process around that ID.
Who Owns an Agent? Seniority Scales With Autonomy
The core rule is simple: the more an agent can do on its own, and the more of the business it touches, the more senior its human owner has to be. Per Financial News, individual employees manage agents that assist with their own tasks, while agents with a wider scope of impact or more autonomy are supervised by a team leader or an executive. Seoul Economic Daily puts it more bluntly: those agents need a supervisor such as a team leader or executive, "not a rank-and-file employee."
Permissions follow the same logic. The data an agent can reach and the functions it can call are set by the nature of its work, and the human review and approval requirements get stricter as autonomy rises.
Most enterprises do the opposite by default. The person who built the agent owns it, whatever it does, and the owner's seniority has no connection to the agent's blast radius. A junior analyst can own an agent that writes to the CRM for an entire region. SK Telecom's rule forces the question at review time: if this agent goes wrong, is the person on the hook senior enough to have stopped it?
The rule also creates a natural brake. A team leader who has to sign for every high-autonomy agent in the team will approve fewer of them.
What the Agent OS Logs, and When It Pulls the Plug
SK Telecom's internal Agent OS is the control plane that makes the ownership rule enforceable. According to TelecomsTechNews, it logs each agent's execution status, usage and change history, records the AI models and tools an agent uses and the steps it takes so the cause of a problem can be traced, and lets operators stop an agent when an anomaly occurs, with those actions logged too. Seoul Economic Daily adds that the company examines each agent's token usage and work records.
An Agent OS, in this sense, is a single management layer that applies the same logging, permission and shutdown standards to agents regardless of which tool or environment they were built in. That matters at SK Telecom because agents come from several internal platforms. You probably have the same problem: some agents in Copilot Studio, some in a cloud agent builder, some in a developer's repo.
You do not need a custom OS to get the core of this. A tracing tool such as Langfuse captures model calls, tool calls and steps; a platform such as ServiceNow AI Control Tower can hold the inventory. The hard part is the requirement that every agent with an ID reports into the same place, and that someone has the authority and the button to stop it. We have written before about how often the kill switch is the part that fails.
The Retirement Review Most Agent Programs Skip
SK Telecom reviews agents with IDs on a schedule and removes the ones that no longer justify their access. Financial News says agents are assessed on task completion, scope of impact, data access methods and contribution to performance, and each one is then retained, improved or ended. Agents judged less necessary are suspended or retired.
This is the step most agent programs never write down. Building is celebrated; decommissioning has no owner. The result is a long tail of agents that still hold credentials and data access long after anyone uses them. Microsoft hit the same wall inside its own tenant and answered it with a 60-day inactivity threshold that triggers alerts and automated cleanup, which we covered in Microsoft's Customer Zero playbook.
The two approaches differ in a useful way. Microsoft's rule is mechanical: idle for 60 days, cleaned up. SK Telecom's is a judgment against four criteria, including data access, so an agent that is busy but holds more access than its work needs can also be cut back. A mature program probably wants both: the timer catches the abandoned agents, the review catches the over-privileged busy ones.
The KPI question is where SK Telecom is most cautious. The company is reviewing ways to share agents' performance with employees first and will only "over the longer term" consider reflecting it in organizational KPIs. Treat the KPI link as an open question at SK Telecom.
What Is Built, and What Is Still a Roadmap
Read the report as a mix of running controls and stated intentions, because SK Telecom's own timeline puts the hardest parts in 2027 and 2028. The published roadmap runs:
| Year | What SK Telecom says it will do |
|---|---|
| 2026 | Standards for preliminary review, identification, registration, owner designation, usage permissions and data access scopes |
| 2027 | Integrate the system, add permissions differentiated by autonomy and impact, strengthen human review, approval and intervention |
| 2028 | A management system covering operation, evaluation, maintenance, enhancement and decommissioning |
So the ID, the owner rule and the basic permissions are this year's work. The fully differentiated, autonomy-based permission model is next year's. Full lifecycle management, including systematic decommissioning, is 2028. Chief privacy officer Cha Ho-beom described the framework as something the company will progressively build out.
The report also leaves out numbers a skeptic would want. None of the coverage gives how many agents hold IDs today, how many have been retired, or the thresholds that move an agent from employee ownership to team-leader ownership. The ISO/IEC 42001 certificate shows that an audited management system exists. Whether those thresholds are well chosen is outside what it certifies.
There is context for why SK Telecom is doing this so publicly. AI governance now sits under the chief privacy officer, and the company is still contesting a 134.791 billion won (about $97 million) fine the Personal Information Protection Commission imposed in August 2025 over its USIM breach. South Korea's AI Basic Act also took effect on January 22, 2026, requiring operators of high-impact AI to provide a mechanism for human intervention and oversight, with a one-year grace period before fines. A company under that much scrutiny has every reason to publish a clean framework. That does not make the framework wrong, but it is a reason to judge it on the parts you can check.
Why Ownership Rules Decide Whether Agent Programs Survive
Agent programs fail on ownership and risk control more often than on model quality, and SK Telecom's rules target exactly those failure points. Gartner predicted in June 2025 that more than 40 percent of agentic AI projects could be canceled by the end of 2027, citing escalating costs, unclear business value or inadequate risk controls. An ID with a named owner, a performance review and a retirement path addresses all three: someone answers for cost, someone has to show value, and the risk controls scale with autonomy.
The idea of treating agents like staff is not new. IBM described managing 4,000 agents like employees earlier this year, and identity vendors now sell agent identities in Okta, Entra and SailPoint. What SK Telecom adds is the operating rule on top of the identity: who has to own which agent, and when the agent goes away. An identity product can issue a credential for every agent; it cannot decide that a team leader must sign for the risky ones.
Banks are already being asked these questions. US regulators have pressed lenders on how they would shut down an agent and reconstruct what it did. SK Telecom's report is a ready-made answer format: an inventory with owners, a log with a stop switch, and a review with a removal step.
What to Do With This
This Week:
- Pull a list of every agent your platforms can see (Copilot Studio, your cloud agent builders, anything registered in your gateway) and add one column: the named human owner. Count the blanks.
- Pick the five agents with the widest data access and check the owner's level. If any is owned by someone who could not have stopped it from writing to a system of record, reassign it.
This Month:
- Write a one-page ownership rule modeled on SK Telecom's: agents that assist one person's own tasks are owned by that person; agents that act across a team, touch customer data or take actions without approval are owned by a team leader or above. Get your CIO and CISO to sign it.
- Separate registration from approval. Every agent gets registered at build time; only reviewed agents get production credentials. Use the review to set data access and the human approval steps.
- Confirm you can stop any production agent from one place, and that the stop is logged. Test it on a low-risk agent with the owner watching.
Before Next Budget Cycle:
- Start a quarterly agent review on SK Telecom's four criteria (task completion, scope of impact, data access, contribution) and add an inactivity timer like Microsoft's 60-day rule. Track how many agents you retire; zero retirements means the review is not working.
- If your audit committee asks for an external reference, scope ISO/IEC 42001 to cover internal agents as well as customer-facing AI, as SK Telecom did, and read our coverage of how the governance-platform market is consolidating around it.
The Bottom Line
SK Telecom has written down what most enterprises are improvising: agents get IDs after review, owners get more senior as agents get more autonomous, everything runs through one log with a stop switch, and agents that stop contributing get retired. The company's own roadmap shows much of it is still being built, and it has not published the numbers that would prove it works. The pattern is familiar from the early SaaS years, when shadow apps were tolerated until an audit forced an inventory, an owner per app and a renewal review. Agents are moving faster, so the inventory comes first: start the owner column this week.
Continue Reading
- Microsoft says Risk-O-Meter sorts agent builds green, yellow or red
- IBM Manages 4,000 AI Agents Like Employees: $4.5B Saved
- Why 88% of AI Pilots Fail Without an Agent Owner Role
- Human-in-the-Loop for AI Agents: Most Approval Gates Rubber-Stamp
- Okta vs Entra Agent ID vs SailPoint: Two Issue, One Governs
- US Regulators Ask Banks to Explain Their AI Agent Safeguards