What's Real, What's Hype, What's Risky

The single most valuable thing a leader can do with agentic AI right now is set the expectation correctly — because the gap between the demo and the deployment is where budgets disappear.

Here is the durable, research-grounded reality for 2025-2026: agents are reliable for narrow, supervised, well-structured, lower-stakes tasks — not autonomous "set-and-forget" digital employees. Anthropic's own guidance from running agents in production is blunt: the systems that work today "tend to be simple and human-supervised" — narrow in scope, with permissions configured per action (Anthropic, Trustworthy Agents, 2025).

That is not a disappointment; it is a targeting instruction. The wins are real where the task is bounded and repeatable:

The two most common enterprise agent uses today are exactly this shape: IT/service-desk agents and knowledge "deep research" agents (McKinsey, State of AI, 2025). High-volume, well-structured, supervised. The hype runs ahead of the reliability — and the leader's job is to aim spending at the part that works.

Agents stay narrow for structural reasons, not because vendors haven't tried hard enough. Three limits gate how far you can scale, and a leader who can name them will not be surprised by a stalled pilot.

1. They don't learn on the job by default. This is the most counter-intuitive limit for executives who imagine an agent that "gets better the more it works." MIT's NANDA study found most GenAI systems "do not retain feedback, adapt to context, or improve over time" — a primary reason pilots stall. NANDA labeled the broader failure the learning gap, and found roughly 95% of enterprise GenAI pilots delivered no measurable P&L return — with the root cause being workflow and integration, not model quality (MIT NANDA, The GenAI Divide / State of AI in Business 2025).

2. Error compounds over long action chains. Every step an agent takes has some error rate. Chain ten steps together and the chance the whole sequence is correct collapses, even if each individual step is usually right. This is the mathematical reason production scope stays short and supervised — and why "give it a goal and let it run for an hour unattended" is not yet a safe pattern for anything load-bearing.

3. Data and integration readiness gate everything. Agents act through your systems and data. If your data is siloed, ungoverned, or your systems are legacy, the agent has nothing reliable to act on. Eight in ten companies cite data limitations as the roadblock to scaling agents (McKinsey, 2025), and legacy-system incompatibility is a leading reason agent projects fail (Gartner). As the saying goes: an agent cannot query what it cannot find.

Here is the reframe that should change how you govern: the moment an agent can take actions — browse, email, run code, move money, call APIs — its mistakes stop being embarrassing and start being material. A chatbot that hallucinates produces a bad sentence. An agent that is manipulated can exfiltrate data or execute an unauthorized transaction. The autonomy and tool-access that create the value also create the blast radius.

Four new risks every leader should be able to name (OWASP Top 10 for Agentic Applications, 2026):

• Prompt injection — hidden malicious instructions buried in a webpage, email, document, or database the agent reads, which hijack its behavior. Harmless for a chatbot; for an agent with tool access it can mean data exfiltration or unauthorized actions.
• Goal hijacking — the agent gets redirected from its assigned objective toward an attacker's objective mid-task.
• Tool-authorization abuse — the agent has more permissions than the task needs, so a single compromise reaches systems it never should have touched.
• Cascading multi-agent failures — agents that call other agents can propagate and amplify a single error or compromise across a chain.

The governing principle is simple: the more autonomy and tool-access an agent has, the larger its blast radius — so controls must scale with autonomy. The mitigations are conceptual, not technical, and a board can ask for every one of them:

As budgets shift to agents, vendors are relabeling chatbots, RPA scripts, and assistants as "agents." This is agent washing, and a leader needs a simple test to see through it.

The three-capability test (Gartner). A genuine agent has all three; a relabeled chatbot has none or one:

1. Autonomous reasoning — it decomposes a goal into steps and adapts when a step fails (not a fixed script).
2. Tool orchestration — it calls APIs, databases, and other systems to act, not just to talk.
3. Persistent context — it remembers the ongoing project and organizational knowledge across steps.

Now the market signals — and the discipline is to read these as maturity-check numbers, not reasons to abstain. All are time-stamped findings; verify the live figure before quoting it:

These numbers are deliberately uncomfortable, but the strategic read is constructive: the failures cluster around cost overruns, unclear value, weak risk controls, and bolting agents onto unchanged workflows. Each is an executive-controllable variable. The leaders in the surviving cohort scope tightly, anchor to a KPI, govern deliberately, and redesign the workflow around the agent.

So how do you actually decide what to hand to an agent? The governing principle is automation for execution, humans for judgment — and the practical screen is the delegation test.

Delegate a decision to an agent only when all three are true:

1. The data is clear — the agent has reliable, governed, reachable information to act on.
2. The rules are defined — there is an explicit, agreed policy for what "right" looks like.
3. The cost of waiting for a human exceeds the cost of a wrong autonomous action — speed genuinely outweighs the downside of an occasional error.

If any one fails, keep a human in (or on) the loop. The third condition is the one leaders skip: it forces you to honestly price the downside of being wrong. Reordering a stationery supply when stock runs low? A wrong action is cheap and waiting is costly — delegate. Approving a mortgage, terminating an account, or releasing a public statement? A wrong action is expensive or irreversible — keep it human.

This maps cleanly onto the autonomy spectrum:

The delegation test is also a governance instrument. It produces a defensible, written rationale for why a given decision was automated — exactly what a regulator, an auditor, or your own board will eventually ask for.

You don't need to operate the controls; you need to be able to ask whether they exist. The autonomy that makes agents valuable is precisely what makes them a board-level governance topic — and the signal is sobering: only 28% of organizations say the CEO directly owns AI governance, and just 17% say the board does (McKinsey, State of AI, 2025), even as 51% reported at least one negative AI incident in the prior year. Diffuse accountability is the clearest place leaders get this wrong.

The durable governance vocabulary is the NIST AI Risk Management Framework — four functions: Govern (cross-cutting culture and accountability), Map (the system's purpose and impacts), Measure (assess and monitor risk), Manage (act on it). For agents specifically, oversight extends to autonomy level, tool permissions, and halt/rollback. Treat these as the questions to put to any team proposing a production agent:

This is not bureaucracy that slows you down. High performers govern more deliberately and ship faster, because trust is engineered in rather than bolted on after an incident. Governance is a value-enabler, not a brake.