Uniform governance is what makes AI agents fail

No, and it is one of the rare governance mistakes that costs you twice. A single policy constrains the harmless agents and leaves too much room to the ones that genuinely act, which produces teams equipping themselves off the radar on one side and incidents nobody modelled on the other.

Gartner put a number on the second half in May 2026: by 2027, 40% of enterprises will demote or decommission an autonomous agent, because of governance gaps identified only after a production incident. Note that this is not the already familiar forecast that more than 40% of agentic AI projects will be cancelled before the end of 2027, and the two compound rather than repeat each other: the first concerns projects that never land, the second agents that land and get unplugged afterwards.

What exactly does the tier model say?

Gartner proposes classifying by level of autonomy, each level carrying its own trust boundary and its own requirements, rather than writing one rule for “agents”.

Observe. The agent reads defined sources and returns output to the requesting user alone. Summarising a document, retrieving data, explaining code. Controls stay light: scoped data access, authentication, usage logging.

Advise. The agent produces recommendations, drafts, proposed actions, and a human executes manually. What becomes necessary here is not security but quality: output review, hallucination testing, training users on how much to rely on it.

Act with Approval. The agent writes, sends, modifies a configuration, but only after explicit approval, action by action. The human stays in the loop before anything goes out.

Act Autonomously. The agent executes on its own within defined guardrails, and control shifts from pre-approval to post-review: exception monitoring, audit logs, examining aggregated outcomes rather than each act.

Shiva Varma, who signs the analysis, sums up the cause of failure in a phrase I find accurate: enterprises treat agent governance as binary, locked down or fully trusted.

Why one rule produces two opposite failures

The first failure is the one nobody sees coming, because it does not look like an incident. When an agent that merely summarises meeting notes has to go through the same approval file as an agent writing to clients, the review takes six weeks for a tool that was worth two days. The team does not protest, it works around, and what was meant to be governed ends up in a personal subscription paid on a credit card.

We described this mechanism about employees rather than agents, and it behaves in exactly the same way: clandestine usage proves less an act of disobedience than the absence of an approved tool, and blocking trades visibility for nothing. Governance too heavy for the tier at hand manufactures the very blind spot it meant to remove.

The second failure is more conventional and better documented. An agent able to act on the outside world inherits the light regime designed for agents that read, because the policy does not distinguish, and the gap only shows up on the first message that goes out by itself.

The tier is a property of the action, not of the agent

Here is where we depart from the model, and it is the most useful practical consequence of the whole exercise.

A real recruitment agent does not fit in one tier. Within a single request it reads the ATS, which is Observe; it drafts a summary note for the team, which is Advise; it updates a record, which is an internal write; and it prepares a message to a candidate, which must not go out without approval. Classifying the agent forces you to keep the most restrictive tier for all of it, which amounts to requiring human approval in order to read a document.

So the wording we use as a rule is a different one: what stays inside the company can go as far as autonomy, what leaves it goes through a person, and a decision that closes a door stays human even when it does not leave. It is the same line we apply when an AI writes to candidates, and its virtue is that it is mechanical: a criterion argued case by case is a criterion people eventually work around.

The two models do not conflict, they compose. The tier tells you which controls to install, the direction of the action tells you where to put the human, and you need both answers because they do not answer the same question.

How to classify your actions without spending a quarter on it

Three columns are enough, and the exercise fits in one meeting if you list actions rather than use cases.

For every action the agent can trigger, note what it touches, whether it leaves the company, and whether it is reversible. A write to an ATS field is internal and reversible, therefore autonomous. A send to a candidate is outbound, therefore approved, whatever trust has accumulated. Deleting a file is internal and irreversible, therefore human, which incidentally shows that direction alone is not sufficient.

That list has a side effect I had not anticipated the first time I made one: it is short. An agent that appears to do everything usually triggers between twelve and twenty distinct actions, and once they are written down, the governance discussion stops being philosophical. It becomes a twenty-line review settled in an hour.

Where do you start when no governance exists at all?

That is the most common situation, and Varma says so plainly: many organisations have no agent governance whatsoever, or a blanket policy applied blind. Starting from nothing has an underrated advantage, which is having nothing to undo.

Do not start by writing a policy. Start with the inventory, which is tedious and which answers the question the incident will ask you: which agents are running, who put them into service, with which credentials, and what can they write to. In the companies where we have watched the exercise happen, half the answers were missing, and that half is the real risk rather than the duly declared agents.

Then write the one rule that does not wait for the inventory, because it holds whatever the inventory finds: nothing leaves the company without a person releasing it. It fits in a sentence, it needs no arbitration, and it covers the category of incident you do not recover from. The rest, the tiers, the reviews, the thresholds, gets built afterwards on known material.

The reverse order is what produces governance documents nobody applies. A policy written before the inventory describes the agents you imagine rather than the ones running, and it ages all the faster for never having met a real case.

What stays true even with tiers

The leading cause of decommissioning, in Gartner’s analysis, is not misclassifying agents. It is the confusion between the ability to act and the scope of access granted, and that confusion survives a four-tier model perfectly well.

An agent that can do only one thing, send an email, but holds the complete address book and an unmetered right to send, is more dangerous than an agent that can do anything to a single test mailbox. The tier describes the first term and says nothing about the second, which is exactly why a limit written into a policy never replaces a limit written into the product.

The consequence fits in one sentence, and it is unwelcome for anyone hoping for a matrix to fill in: the tier is declared, the scope of access is verified. The first fits in a table, the second is obtained by asking to see the credentials the agent actually holds, and nobody enjoys that question.

Which leaves the question of what the agent you are governing is worth, because impeccable governance laid over a product that is not an agent protects nothing. That is the subject of agent washing and the grid that detects it.