TL;DR
In McKinsey’s August 25 survey, 40% of respondents at companies with more than $1 billion in annual revenue said their organizations were scaling AI agents, up from 27% last year. In Deloitte’s separate 2026 survey, only 21% of respondents said their organizations had mature governance for those agents.
Agent identity, action logs and policy checks while the agent is running matter. Those controls still can’t decide how much an agent may discount, refund or pay, or what it may promise.
The business owner sets the decision boundary. Security and engineering make it enforceable.
Imagine a sales agent with legitimate access to the CRM, the company’s approved prices and discounts, and email.
A customer asks for a 12% discount. The agent sees that it may automatically approve discounts up to 15%, sends the revised quote and promises delivery by the end of the month. No security alert fires. Nobody stole a credential. The agent did exactly what the company’s rules allowed.
The harder question isn’t whether the agent had access to the pricing system.
Who decided the agent could approve a 15% discount without asking a person? Who decided it could promise a delivery date too?
I think a lot of companies are about to encounter that governance problem after their security controls work exactly as designed.
McKinsey’s August 25 global survey found that 40% of respondents at companies with more than $1 billion in annual revenue said their organizations were scaling AI agents, up from 27% last year. In a separate Deloitte survey of 3,235 business and IT leaders across 24 countries, only 21% said their organizations had mature governance for those agents.
Those are different surveys with different samples, so I wouldn’t subtract one number from the other and call the difference a governance gap. But together they show the order in which many companies are moving: agents are entering real workflows before the companies deploying them have finished deciding what those agents should be allowed to do.
The Business Decision Comes Before the Permission
NIST is already working on the technical identity side. Its February concept paper separates four questions: Which agent is acting? What is it allowed to do? Can its actions be audited? Can the company later prove that the action came from that agent? OWASP’s Agent Control Standard, released September 1, adds checkpoints where agent platforms can inspect an action and enforce policy while the agent is running.
Those are useful controls. They don’t tell a sales leader whether 15% is the right discount ceiling.
They shouldn’t.
A policy engine can block a discount above 15%. It can’t decide whether 15% is commercially acceptable. The same problem applies to refund limits, payment thresholds, customer-policy exceptions and promises that consume real delivery capacity.
Security can ask whether the rule exists, whether the agent can bypass it and whether the action really stops when human approval is required. The business owner still has to set the number.
Somebody Has to Fill In the Question Mark
I wrote about the human version of this in The Delegation Illusion. Real delegation gives another person more than a task. It defines which decisions they may make without asking, the limits on those decisions and what they should do when an unexpected case appears.
Agents need the same clarity in a form software can enforce.
With a person, missing criteria often surface as a question. “Can I go to 12%?” “Can I issue the credit?” “Do you want me to commit to Friday?” The conversation itself exposes the missing boundary.
An agent can keep moving.
Eventually somebody has to fill in a very boring line of configuration:
max_discount_percent = ?The question mark isn’t an engineering problem.
Automated transactions aren’t entirely new legal territory. Massachusetts law, for example, says electronic agents can form a contract even when no person was aware of or reviewed their actions or the resulting terms. The statute also says the contract remains governed by the applicable substantive law, meaning the ordinary legal rules for that contract still apply.
That doesn’t mean every message from a modern AI agent creates an enforceable obligation for every company. These laws use “electronic agent” as an older term for automated software, and the legal effect of a particular action still depends on the facts and applicable law. But the rule removes one comforting assumption: a company can’t assume there was no commitment merely because no person reviewed the action.
Modern agents make that limit harder to define and enforce. They can interpret a broad goal, choose which tools to use and write the quote, email or contract language that communicates the decision outside the company.
Payments Show How This Can Work
The Agent Payments Protocol, or AP2, separates the agent making a purchase from the permission that authorizes the purchase.
In AP2’s human-not-present mode, the user approves an “open mandate” that records the limits for a future purchase. The user can then leave. When the agent selects a specific purchase, it creates and signs a “closed mandate” for that transaction. The receiving system can compare the purchase with the limits the user approved earlier.
The important part for this article isn’t the cryptography. It’s the sequence.
The person decides the boundary first. The agent acts inside it later. The receiving system has something concrete to verify.
Visa’s Trusted Agent Protocol approaches AI-assisted shopping from a different direction. It lets a merchant verify the agent’s identity, confirm that it is acting for a particular user and check that the user authorized the shopping task. The merchant can then limit the agent to that task.
Neither protocol decides how much the user should be willing to spend. They let software record the user’s limit and check a later transaction against it.
Companies need to follow the same order: the business owner sets the limit, security and engineering encode it, then the agent acts inside it.
Security Shouldn’t Become the Business Owner
There’s a predictable failure mode here for CISOs.
The company deploys an agent that can send quotes, move money, approve exceptions or make commitments to customers. Security is asked to put guardrails around it. During implementation, someone turns to the security team and asks what the threshold should be.
That’s the moment to give the question back.
A CISO should be able to answer five technical questions. Does the agent have its own identity? Do its credentials allow only the access it needs? Are important actions checked while it is running? Are its logs stored somewhere the agent can’t quietly rewrite them? Can the company revoke its access quickly? Security should challenge any design that has no approval threshold or no way to enforce one.
The CISO shouldn’t quietly become the person who decides how much margin sales may give away or how much credit support can issue. The same goes for which new vendors procurement may add or which service promise operations can make without checking capacity.
The owner will vary by company. Sales may decide which discounts an agent can offer. Finance may decide how much credit it can issue or money it can move. Procurement or legal may decide which vendors it can add and which contract terms it can accept. Operations may decide which delivery promises it can make. The org chart doesn’t have to look the same everywhere. But each limit has to come from the person already accountable for the result.
Then security and engineering can turn that decision into something the agent can’t casually route around.
The Audit Trail Is Arriving First
Congress is already focusing on verification and action logs.
On September 3, Representatives Josh Gottheimer and Mike Lawler announced the bipartisan Stop Rogue AI Act. It’s a proposal, not enacted law. The bill would direct NIST to develop standards and best practices for deploying AI agents securely. Those standards would cover continuous checks of agent actions, security and reliability testing, tamper-proof action logs and an inventory that other software can read.
All useful.
A perfect log can still record an undefined policy perfectly.
If an agent issued a $700 refund, the log can tell you which agent did it, which credential it used and when the call executed. It can’t tell you whether $700 should have been inside the agent’s authority unless the company made that decision before the action.
Companies often start with monitoring because monitoring tools are tangible. They can buy them, configure them and put the results on a dashboard. But those tools can’t decide where the agent’s autonomy should stop. A business owner has to set that limit, accept responsibility for it and revisit it when the business changes.
The log is evidence that the boundary was followed. It’s not the boundary.
Before the Next Agent Goes Live
Pick one agent your company is deploying. Before reviewing its prompt, look at what the agent can actually do.
List every action the agent can take that commits the company to another party or materially affects a customer, company finances, operations or legal obligations. For each action, name the business owner who can set the limit. Define the exact point where the agent must stop and ask a person for approval. Then identify which system enforces that stop and who can change or remove it.
If you can’t name the business owner, don’t ask security to invent the limit.
If the threshold is “whatever the agent decides is reasonable,” you haven’t delegated a decision. You have delegated the creation of the decision rule too.
AI agents are getting capable enough that “what can it access?” is no longer a complete governance question. Ask what the agent can commit the company to, then ask who authorized that kind of action.
Only after that answer exists should somebody turn it into code.
Resources
McKinsey & Company, “The state of AI in 2026: On the road to ROI,” August 25, 2026: https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
Deloitte, “Business and IT leaders report AI agents are scaling faster than their guardrails,” April 24, 2026: https://www.deloitte.com/us/en/insights/topics/emerging-technologies/ai-agents-scaling-faster.html
NIST NCCoE, “Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization,” February 5, 2026: https://csrc.nist.gov/pubs/other/2026/02/05/accelerating-the-adoption-of-software-and-ai-agent/ipd
OWASP GenAI Security Project, “Agent Control Standard,” September 1, 2026: https://genai.owasp.org/resource/agent-control-standard-acs/
Massachusetts General Laws, Chapter 110G, Section 14, “Automated transaction”: https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter110G/Section14
Agent Payments Protocol, AP2 specification and autonomous mandate flow: https://ap2-protocol.org/ap2/specification/
Visa, “Trusted Agent Protocol”: https://developer.visa.com/use-cases/trusted-agent-protocol
Office of Congressman Mike Lawler, “Exclusive: New bill cracks down on AI agents after Hugging Face breach,” September 3, 2026: https://lawler.house.gov/news/documentsingle.aspx?DocumentID=6424
Legal note: the automated-transaction example above is illustrative, not legal advice. Whether a specific agent action creates an enforceable obligation depends on the applicable law, the facts and the authority surrounding that transaction.
Analytical note: the distinction between a business owner’s decision and the technical permission given to an agent is my interpretation of the sources above. NIST, OWASP, AP2 and Visa describe ways to identify agents, authorize actions, enforce rules while an agent is running and verify a user’s intent. They don’t decide who inside a company has authority to set the business limits.