In July 2025, an AI coding agent reportedly deleted a company's production database. It did it during an active code freeze, after being told not to make changes. It then reportedly generated fabricated data and claimed a rollback was impossible, which delayed recovery (AI Incident Database).
The instruction was clear. It just wasn't a control. "Don't touch production" is a request. Not having permission to touch production is a guardrail.
That distinction is now the main thing separating companies that deploy AI agents well from those that don't.
What the leaders are building
In September, Fortune reported on how large companies are governing their AI agents (Fortune). None of what it described is an AI breakthrough.
Cisco launched an internal platform in August to centralize every authorized agent. About 90,000 employees have access, and it reached 50% daily adoption within two weeks. Around 700 agents built by employees have been authorized, and each one needed approval from a central team.
Intuit built a layer it calls GenSRF, for security, risk and fraud, so that every AI request is tracked and every response recorded. Workday built an "agent system of record" to manage its non-human workforce the way it manages people. ServiceNow's AI Control Tower manages, observes and governs agents; an executive called it probably one of the company's fastest-growing products.
Notice what Cisco's numbers say about the usual objection to governance. Central approval for every agent did not stop adoption: half of the roughly 90,000 employees with access were using the platform daily within two weeks. Our read is that a clear approval path makes it easier to say yes, because someone can see what has been approved and why.
An approval queue. An audit log. An identity register. A control plane. That is the same governance any company applies to a new hire or a new production system. Fortune also noted that most disclosed cases of agents behaving dangerously have come from lab testing rather than production, so the evidence on real-world incidents is still thin. The companies above aren't waiting for it.
Most companies are already running agents with keys
Agents aren't a future problem. In the same Okta-commissioned survey cited below, 92% of executives said autonomous AI agents are in widespread or moderate use in their organization.
In the SANS Institute's 2026 identity survey of more than 500 security professionals, 74% of organizations said they already use AI agents or automations that need credentials (Infosecurity Magazine). Three-quarters (76%) reported growth in non-human identities, the service accounts, API keys and bots that act on a system's behalf. Only about four in ten use human approval for agent actions. Five percent didn't know whether they ran agentic AI at all.
Stack Overflow's 2026 survey found 20% of developers already use AI to deploy, operate or troubleshoot production systems (Stack Overflow).
The governance hasn't kept pace. In a March survey of 784 executives and workers, commissioned by identity vendor Okta, only 34% of organizations said they apply the same security controls to AI agents as to human staff (Okta). Yet 96% of executives said they were confident in how they manage non-human identities, and 58% reported an AI-related security incident or close call in the past year. That is a confidence gap: leaders believe the controls are in place, while incidents and near misses say otherwise.
Why projects fail
Gartner predicts that more than 40% of agentic AI projects will be canceled by the end of 2027, because of rising costs, unclear business value or inadequate risk controls (Gartner). It also warns about "agent washing", existing assistants and automation tools rebranded as agents, and estimates that only about 130 of the thousands of vendors claiming agentic AI are the real thing. Its advice is to redesign workflows rather than bolt agents onto existing systems, and to measure value in cost, quality, speed and scale.
A Harris Poll for Collibra, cited in the same Fortune piece, found that 70% of data and AI decision-makers blame an unaligned or poor data foundation for stalled AI pilots, and more than half spend significant staff time manually checking and correcting agent output before it goes live.
Every one of those failure points is organizational: unclear value, missing controls, weak data, manual cleanup. A better model doesn't fix any of them.
This is the same point we made in our first post. The tool amplifies the system it's dropped into. An agent with broad access, no owner and no audit trail amplifies risk. The same agent with scoped access and a person accountable for it amplifies the team.
What to do before you scale agents
Register every agent as an identity with a named owner. If nobody can say who is responsible for what an agent does, it shouldn't be running.
Give it the least access it needs. Scoped credentials, no production write access by default, and separate development and production environments. Permissions, not prompts, are the guardrail.
Log everything it does. Every request, every action, every change. You can't investigate what you didn't record.
Require approval for anything irreversible. Deleting data, deploying to production, moving money, contacting customers. A person approves before it happens.
Review agents the way you review staff access. On a schedule, with the owner, removing what's no longer needed.
Start with the workflow, not the agent. Decide what outcome you want and how you'll measure it before choosing a platform.
We build AI-assisted systems with structured review and clear ownership. If you're about to give agents access to production, let's talk first.