AI agents promise efficiency gains, but governance gaps threaten enterprise deployment

AI Agents Shift From Assistants to Autonomous Operators

AI agents are moving beyond simple copilots that assist employees to autonomous systems that execute multi-step tasks, interact with enterprise systems, and make decisions within defined guardrails. With technology budgets for AI expected to increase more than 70% over the next two years, these autonomous AI agents promise to deliver significant performance gains while shifting humans toward higher-value work 1

1

. McKinsey predicts the agentic AI market will surge from roughly $5-7 billion in 2024 to over $199 billion by 2034 3

3

.

Yet this transformation introduces new challenges. Unlike generative AI tools that provide recommendations for human review, agentic systems operate directly within business processes where the margin for error becomes much smaller. When AI starts acting inside workflows—triggering supply chain adjustments, initiating operational tasks, or executing financial decisions—the risk profile changes entirely 3

3

. Organizations are discovering that unlocking the potential of enterprise AI requires more than deploying advanced models.

Governance Gaps Threaten Widespread Adoption

Despite significant investment, most agentic AI projects struggle to move beyond pilots. Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027 3

3

. Meanwhile, Qlik found that 97% of organizations have committed budget to agentic AI, but only 18% are fully deploying it 3

3

. The disconnect reveals a critical problem: many businesses lack the governance infrastructure needed to deploy agents safely at scale.

The most common reason agentic AI projects stall is insufficient data maturity. Agents depend on consistent, trusted information across the organization, yet many businesses operate with fragmented data, duplicated sources, and unclear ownership 3

3

. Without reliable governed data, even sophisticated models struggle to produce outputs teams can confidently act upon. As Ben Kus, CTO of Box, explains, "The organizations that will lead in AI are the ones that built the governance infrastructure to make any model trustworthy, with the right permissions in place, the right content accessible, and a clear audit trail for every action taken" 2

2

.

Agent-First Process Redesign Requires New Operating Models

Successful deployment demands more than bolting AI agents onto existing systems. Companies must embrace agent-first process redesign, fundamentally rethinking operating models around autonomous systems rather than traditional optimization methods. "You need to shift the operating model to humans as governors and agents as operators," says Scott Rodgers, global chief architect and U.S. CTO of the Deloitte Microsoft Technology Practice 1

1

.

This shift means AI agents require machine-readable process definitions, explicit policy constraints, and structured data flows—capabilities legacy processes weren't built to provide 1

1

. The real risk isn't that AI won't work, but that competitors will redesign their workflows while others remain stuck piloting assistants. Organizations that achieve nonlinear gains create agent-centric workflows with human governance and adaptive orchestration 1

1

.

Identity and Access Management Must Evolve for Digital Employees

As agents become independent actors within enterprise environments, they behave less like software tools and more like digital employees. This creates a fundamental challenge: identity and access management systems were designed around human users, not autonomous agents that adapt, operate at machine speed, and may touch far more systems than any single employee 5

5

.

Only 16% of organizations treat AI as its own identity class with dedicated policies, creating blind spots that increase security risk 5

5

. Unlike human employees who arrive through structured HR onboarding processes, agents are created by developers, embedded into workflows, or introduced through platforms—often without central visibility or consistent accountability. Every autonomous agent needs clear ownership tied to someone who understands why it exists, what it should do, and which systems it should access 5

5

.

Treating AI Agents as Junior Engineers Demands Strict Oversight

The December 2025 AWS incident illustrates the consequences of inadequate governance. Engineers used an internal AI coding agent, but misconfigured access controls granted broader permissions than intended, leading to approximately 13 hours of downtime 4

4

. While Amazon clarified the primary cause was human error rather than technical failure, the lesson remains clear: when you give AI tools the same permissions as senior engineers but none of the judgment, small misconfigurations become serious incidents 4

4

.

Engineering leaders should view AI agents as extremely fast junior engineers—brilliant at pattern-matching and execution, but lacking judgment, context, and restraint. This requires implementing least privilege principles, restricting agent access to only what they need for defined tasks 4

4

. Human oversight must scale with autonomy: the more an agent can act without human initiation, the tighter its audit and traceability mechanisms must become 4

4

.

Content Platforms Evolve Into AI Control Planes

As frontier models converge in capability, the competitive advantage in enterprise AI shifts from the model itself to the data it can safely access. For most enterprises, that advantage lives in unstructured data—contracts, case files, product specifications, and internal knowledge 2

2

. "It's not what the model does anymore, it's the enterprise's own unstructured data - their content, how it's organized, how it's governed, and how it's made accessible to the AI," says Yash Bhavnani, head of AI at Box 2

2

.

Enterprise content platforms are evolving into AI control planes—orchestration layers that sit between models, agents, and enterprise data. Rather than just storing documents, these platforms govern how content is accessed, route it to the right reasoning engine, enforce permissions, and maintain complete audit trails 2

2

. Permission-aware access becomes essential as agents execute tasks autonomously across systems, acting faster than humans and often without the contextual judgment needed to decide what data they should access 2

2

.

Building Trust Through Accountability and Visibility

As agents take on more responsibility, organizations need clear answers to fundamental questions about accountability: Who owns the data feeding the system? Who approves actions an agent takes? When should a person step in to review decisions? 3

3

. Clear accountability helps teams trust deployed systems and reduces the risk of mistakes, especially when AI outputs affect revenue, compliance, or business planning.

Once multiple teams deploy agents, organizations quickly lose track of where AI-generated code has landed and what it's doing. Portfolio-level visibility becomes essential—leaders need a current, organization-wide view of where AI agents operate, which systems carry the most risk, and whether similar agents repeat flawed processes across teams 4

4

. Without unified oversight and integration across tools, content gets duplicated, shadow knowledge stores accumulate outside IT visibility, and employees build workarounds that create security and organizational risk 2

2

.

What Organizations Should Watch

With nearly three in four companies planning to deploy agentic AI in the next two years but only one in five having mature governance models, the gap between ambition and readiness continues to widen 5

5

. Organizations that strengthen data foundations, establish clear ownership structures, implement identity governance for autonomous agents, and build permission-aware systems will position themselves to scale AI safely. Those that continue piloting agents without addressing these fundamental governance challenges risk being left behind as competitors redesign their operating models for the agent-first era. The question for enterprise leaders is no longer whether to adopt AI agents, but whether their governance infrastructure can support the autonomous workforce they're building.