The CFO Token Budget Problem: Why AI Agent Governance Can't Wait

TL;DR: AI agent governance is not a vendor feature or an IT policy; it's an accountability structure. Debu Chatterjee built ServiceNow's first AI platform, then founded Konfer.ai to solve the harder version of the same problem: governing agents that reason, act, and hand off work without a human reviewing every step. In this second episode of The AI Friction Files, recorded at IIT2026 in Long Beach, Chatterjee defines "consequential AI," decisions with organizational impact that can't be outsourced to a platform, and walks through agent discovery, the token budget problem catching CFOs off guard, and the TED framework (Traces, Explainability, Defensibility) he uses to make agent behavior auditable. His conclusion: governance designed from the top down costs less than governance paid for later, with interest.

Why Governance Can't Be Delegated

Debu Chatterjee spent nearly three and a half decades in enterprise software before founding Konfer.ai. From 2012 to 2017, he built DX Continuum, which ServiceNow acquired, and he became the company's first Head of AI, building out the platform that a large share of ServiceNow's customer base still runs on today. He left before large language models became the industry's obsession, already convinced governance was about to become the defining problem.

"Governance is going to become very important," Chatterjee said, describing what he heard from ServiceNow customers years before agentic AI had a name. Every customer needed its own version of trust and transparency into how its models worked, because the same algorithm behaved differently depending on whose data it touched.

What's changed since then is what the models do. "Agents today have an ability to do reasoning," Chatterjee said. "They try out different ways of achieving the goal they've been asked to perform." That's the shift from a system that captures information to one that executes a series of steps with a consequential impact on the organization. "Consequential AI means governance is an accountability. You cannot outsource it to anyone."

The risk profile isn't uniform. Chatterjee's example is a chatbot. The same underlying components can serve an employee or a customer, but the blast radius is different. "A problem with an employee is a much more contained problem," he said. Governing agents means accounting for who's on the other end of the decision, not just what the agent was built to do.

You Can't Govern What You Can't Map

Before an organization can govern its agents, it has to know they exist. Chatterjee calls this discovery, and he's direct about why it's urgent now. "The agents are going to proliferate. Somebody needs to know what these agents are doing, what they're supposed to do, and what they're not supposed to do."

Discovery means answering a specific set of questions for every agent in the environment, including where it’s deployed, who is deploying it, where it was produced, and what it’s authorized to do. None of that is a new discipline; asset inventories are old news in enterprise IT. What's new is the density of the problem. Agents interact with other agents, so governance requires a hierarchical map of that interaction, not a flat list. Some of those relationships are permanent, others transient. Both have to be captured.

Konfer.AI is built to operate at that layer, mapping the agent population an enterprise has deployed, so governance has something concrete to apply against instead of a static inventory that's already out of date.

The CFO Token Budget Problem

Chatterjee's second warning is aimed squarely at finance. "You can't arbitrarily consume tokens," he said. "Tokens are expensive." The shift he's describing is structural. Instead of relying on fixed headcount or fixed-fee services, organizations now rely on consumption that expands and contracts based on what agents are doing in a given month. "Budgeting becomes a big problem for the CFOs because now you don't have a fixed budget."

The problem stopped being theoretical this year. Uber rolled out Anthropic's Claude Code to roughly 5,000 engineers in December 2025, and adoption outran every finance model the company had built. In April 2026, CTO Praveen Neppalli Naga confirmed the company had exhausted its entire annual AI budget, just four months into the year. This shortfall was serious enough that Uber later imposed a $1,500-per-employee monthly cap on agentic coding tools (TechCrunch). The tool wasn't misused. Engineers used it for exactly the work it was built for. The budget simply wasn't built for a cost model where the same task, run two different ways, produces two very different invoices.

Chatterjee's framework for closing that gap ties three metrics together rather than treating cost as an isolated line item: what the agent produced, how much it cost to produce, and how quickly that output turns into revenue. "Money in today is more than money coming six months later," he said. Engineering, operations, and finance end up reading from the same measurement instead of three separate reports that don't reconcile.

The TED Framework: Traces, Explainability, Defensibility

Chatterjee's answer to how you operationalize this is a framework he coined on a conference panel and has repeated since: TED. Traces, Explainability, Defensibility.

"T stands for traces, E stands for explainability, and D stands for defensibility," he said. "If you anchor those three things in the stuff you're producing, you'll end up getting governance by design, and you'll be in a reasonably good spot to protect yourself."

The mechanism underneath TED is what Chatterjee calls proof of work. Every agent action has to produce evidence of what it did and why, mapped to outcomes the organization already tracks, such as performance, cost, and revenue. Without that evidence, governance is retrospective and defensive instead of built into how the system runs. Chatterjee's framing of the alternative is blunt: "If governance is not done by design, it ends up being a cost center, because you'll end up paying the cost down the road."

Why This Has to Start in the C-Suite

Chatterjee is unambiguous that governance is not something that gets built from the bottom up. Leadership has to commit to the discipline before the people executing the work can be expected to follow it, because most employees don't have visibility into how the organization's broader goals are shifting as agents take on decisions that used to sit with a person. A supply chain call, a logistics call, a finance call that used to have a human behind it now has an agent behind it instead, and that carries consequences well outside any one team's view.

"It is a top-down approach," Chatterjee said. "I think governance cannot be a bottom-up" effort. The C-suite sets the discipline; the people closer to the work follow it once it's set, not the other way around.

The C-suite is the only vantage point with visibility across the supply chain, finance, and operational decisions that an agent might touch. A governance program that starts with individual teams inherits their blind spots.

The Questions to Ask Before Your Next Agent Ships

Chatterjee's framework translates into a short diagnostic that any enterprise architect, CTO, or AI program owner can run before the next agent goes into production:

Can you name every agent currently deployed, who built it, and what it's authorized to do? If the answer requires a meeting to find out, discovery isn't in place yet.

Is the token cost of this agent's workflow instrumented and capped, or will finance find out what it cost after the invoice arrives? Uber's experience is an example of what happens when the answer is the latter.

Does this agent produce a trace of what it did, why, and what outcome it affected? If the answer is no, TED fails at the first letter.

Who above this team has signed off on the governance discipline this agent operates under? If the answer is "no one above the team that built it," the accountability gap Chatterjee describes is already open.

Watch the Full Conversation

This post covers the core of Chatterjee's conversation with Sparq’s Sujatha Padmanabhan at IIT2026. Watch the full episode of The AI Friction Files below to hear it in his own words, on camera.

Back to Episode 1: Governance by Design: Why Retrofitted AI Guardrails Fail

Want help mapping your own agent population before the next one ships ungoverned? Book a strategy session with a Sparq architect.

Part 2 in Sparq's series, The AI Friction Files.

Frequently Asked Questions

What is AI agent governance?

AI agent governance is the discipline of discovering, authorizing, monitoring, and accounting for the AI agents an organization has deployed, including how they interact and what they're authorized to do. Unlike traditional software governance, it has to account for agents that reason and act without a human reviewing every step.

What does "consequential AI" mean?

Consequential AI is Debu Chatterjee's term for agentic systems that execute multi-step decisions with organizational impact, such as supply chain or financial calls, rather than simply retrieving information. Because the decisions carry consequences, the accountability for them can't be outsourced to a vendor.

What is the TED framework in AI governance?

TED stands for Traces, Explainability, and Defensibility, a framework Debu Chatterjee developed for making agentic systems auditable. Every action should leave a trace, that trace should be explainable in business terms, and the resulting decision should hold up if it's challenged.

Why do AI agents create a budgeting problem for CFOs?

Traditional IT budgets are built on fixed costs. Agentic AI bills on token consumption, which scales with what the agents are doing rather than a predictable seat count. Uber exhausted its full 2026 AI budget within four months of a company-wide agentic coding rollout, a preview of the gap many enterprises haven't modeled yet.

Why does agent governance have to start at the C-suite level?

Because agents increasingly execute decisions in supply chain, finance, and operations that used to require a human, the accountability for them sits above any single team's view of the business. Debu Chatterjee argues leadership has to set the discipline first; the teams building and operating agents follow it, not the reverse.

How is agent discovery different from a standard IT asset inventory?

Discovery has to capture who built each agent, what it's authorized to do, and how it interacts with other agents, including transient ones spun up for a single task. That interaction layer makes it a mapping problem, not a list, which is why static inventories go stale quickly in an agentic environment.