Gartner is describing a product category that barely exists yet, and predicting that CIOs will go looking for it regardless.
In its top predictions for IT organizations, Gartner said that by 2028, 40% of CIOs will demand that guardian agents be available to autonomously track, oversee, or contain what their AI agents do. The same set of predictions carries a harder number alongside it: by 2028, a quarter of enterprise breaches will trace back to AI agent abuse, from outside attackers and from insiders misusing the access an agent already has. Read together, the two predictions say the same thing twice: agents are getting enough reach to cause real damage, and CIOs will notice before most vendors have a mature answer ready to sell them.
That gap between demand and supply is the useful part of this story for a team already shipping agents. Gartner is not describing a rule to comply with. It is describing a shift in what customers, boards, and CIOs will expect to see. A team that builds the practice before the product exists to buy is not behind; it is early.
What a guardian agent actually is
Gartner's own framing, from its guardian agent forecast, gives the category more shape than "an agent that watches another agent." It splits guardian work into three roles.
- Reviewers check AI-generated output and content for accuracy and acceptable use, after the fact.
- Monitors observe and track what an agent and its actions actually did, so a human or another agent can follow up.
- Protectors adjust or block an agent's actions and permissions automatically, while the agent is still running.
The same forecast puts a number on where this is heading commercially: guardian agent technologies are expected to account for at least 10 to 15% of the whole agentic AI market by 2030. That is Gartner's estimate of a market size, not a measurement of anything that has already happened, and it is worth holding those two kinds of claim apart deliberately.
Building the practice before the purchase
None of the three roles above require a vendor relationship to start. Each one has a version a team can build this week out of parts it probably already has.
Reviewer, without a product. The reviewer role is a review step before anything merges. That can be a second agent that reads a pull request and flags anything that looks wrong before a human sees it, or it can simply be a human who reads every agent-authored diff before it lands. Either way, the rule is the same: nothing an agent writes reaches production without a second party looking at it first.
Monitor, without a product. The monitor role is an observer that runs outside the agent's own environment and records what the agent actually did, not what the agent claims it did. An agent that can edit its own logs is not a monitor; it is a witness that can be bribed. Put the observer somewhere the agent cannot reach: a separate process, a separate machine, a separate account, and let it write a record the agent has no path to alter.
Protector, without a product. The protector role is the set of walls an agent cannot talk its way past: credentials scoped to a single repository rather than an organization, a default-deny egress policy so the agent can only reach the small list of destinations it actually needs, and a rule that every change lands as a branch and a pull request, never a direct commit. None of that requires a guardian-agent platform. It requires deciding, in advance, what the agent is allowed to touch, and then removing everything else from its reach.
The honest caveat
Two things are worth saying plainly, because they are easy to blur together. First, everything above from Gartner is a prediction about the years ahead, not a measurement of what has already happened; treat it as a forecast a team can prepare for, not a fact already on the record. Second, a guardian that runs inside the same box, with the same permissions, as the agent it is supposed to be watching, can be switched off by that agent. A reviewer, a monitor, or a protector only holds if the agent being watched has no way to reach it, credential it, or shut it down. Put the guardian anywhere the agent can touch, and it stops being a guardian and becomes one more thing the agent controls.
That is the same view this site keeps coming back to: the walls matter more than the label on the product that sits behind them. A team that builds a real review step, a real outside observer, and real scoped credentials today is doing the substance of what Gartner expects the market to eventually sell back to it.
Sources: gartner.com/en/newsroom/press-releases/2024-10-22-gartner-unveils-top-predictions-for-it-organizations-and-users-in-2025-and-beyond and gartner.com/en/newsroom/press-releases/2025-06-11-gartner-predicts-that-guardian-agents-will-capture-10-15-percent-of-the-agentic-ai-market-by-2030