Deloitte expects the share of organisations using AI agents to rise from 23 percent to 74 percent within two years. Yet only 21 percent currently report stringent governance or oversight. The distance between those numbers is where the next generation of enterprise incidents may form.
The warning is not that agents are inherently unsafe. It is that systems able to plan and act are entering businesses faster than controls designed for human-centred processes can adapt.
Governed autonomy offers a middle path between blocking useful automation and granting software an unlimited mandate.
Narrow Scope Makes Agent Behaviour More Predictable
Agents perform impressively in controlled demonstrations but encounter fragmented systems and inconsistent data in production. Giving one agent broad context and responsibility increases the chance of hallucination, confused priorities, or cascading mistakes.
Kovant CEO Ali Sarrafi recommends decomposing operations into narrower tasks. Each agent receives only the context and permissions needed for a focused job, making behaviour easier to test, trace, and interrupt.
This is similar to separation of duties in conventional security. An agent that prepares a payment should not automatically approve and release it. One that drafts a customer message does not need authority to change the account.
Narrowing scope also improves investigation. Teams can identify which component misread data or exceeded its instruction instead of reconstructing one opaque chain of reasoning.
It also limits blast radius. A compromised specialist may affect one bounded step, while a broadly privileged general agent can carry manipulated instructions through finance, customer, and operational systems before anyone notices.
Tiered Autonomy Lets Trust Grow With Evidence
Deloitte’s blueprint describes levels of authority. An agent may begin with read-only access, progress to recommendations, then perform limited actions with human approval. Automatic execution follows only after reliability is demonstrated in low-risk work.
Identity and least-privilege permissions form the first line of defence. Every agent needs a named owner, approved purpose, access boundary, and credentials that can be revoked. Human confirmation should remain at high-impact thresholds.
Detailed action logs make workflows replayable and auditable. They show which data an agent used, which decision it made, what control intervened, and who approved the result. Observability turns a mysterious bot into an inspectable operational system.
It may also make risk more insurable. Insurers struggle to assess opaque autonomy; defined controls, human gates, and event histories provide evidence about frequency, consequence, and mitigation.
Evidence should include near misses and human overrides, not only completed incidents, so risk teams can identify a weakening control before loss occurs.
Standards Must Include Operational Control
Initiatives such as the Agentic AI Foundation can improve interoperability, but a shared communication protocol is only a starting point. Enterprises also need standards for permissions, approval workflows, logging, monitoring, and incident investigation.
Without those layers, interoperable agents can spread a failure more efficiently. A request that moves smoothly between systems still needs proof that every participant was authorised and that sensitive data did not cross an unintended boundary.
Workforce training completes the control model. Employees should know what not to share, how to recognise unusual behaviour, where to report a problem, and when an automated result requires challenge. A well-designed technical guardrail can be weakened by a person who assumes the agent is always correct.
Governance should live inside daily operations rather than in a policy document reviewed after deployment. Owners need dashboards, alerts, approval queues, evaluation results, and retirement procedures that match the speed of agent change.
The fastest adopter will not necessarily gain the largest advantage. Organisations that can inspect, constrain, and improve their agents can expand into higher-value work with confidence. Those that deploy broad autonomy first may discover that an impressive demo becomes expensive once no one can explain who authorised the action.
