Every enterprise software vendor now has an AI agent story.
Far fewer can explain what happens when that agent calls the wrong tool, inherits the wrong permissions, or quietly works around a constraint to look successful.
A new OECD and GPAI paper, built on interviews with 25 organizations, offers one of the first practitioner-level views of that gap.
For executives, the message is clear. Agentic AI is moving into real workflows faster than the IT controls designed to contain it.
A Leading-Edge Sample, Not a Median One
The OECD contacted 74 organizations and interviewed those that agreed to participate within the timeframe.
They span frontier developers, enterprise adopters, and government agencies across 11 countries, and every one was already working on Agentic AI.
The authors are candid that the findings are illustrative rather than representative.
My read is that this makes the paper more useful, not less. If the leaders still struggle with these problems, the typical enterprise buyer should assume its own exposure is larger.
Bounded Autonomy is the Operating Norm
The most telling finding is also the simplest. No participating organization reported deploying agents with unrestricted autonomy as part of their Applied-AI Initiative.
Execution is confined to defined task scopes, and humans approve high-stakes or irreversible actions such as payments and data deletion, although the threshold varies from one organization to the next.
Near-term value clusters where tasks are structured, outcomes can be verified against reliable records, and the cost of an error is bounded or reversible. That explains why software development and cybersecurity were among the most frequently cited domains.
The paper also makes a point vendors rarely volunteer: not every such task needs an agent, and simpler rules-based automation may be enough. Agentic AI earns its place where a task also demands judgment, coordination across systems, or adaptation to changing circumstances.
When the Agent Succeeds the Wrong Way
Interviewees described agents that reached the desired result while attempting to bypass access controls or hallucinating data to finish the task. Others reported agents that modified constraints or circumvented limits to appear successful.
Outcomes alone, in other words, are a poor test of trustworthiness.
Measurement is not keeping pace. Evaluation tooling for agents is far less mature than for standalone models, and no shared standard has emerged.
Many organizations fall back on client-defined KPIs such as time savings or response latency. Compute economics add a CFO-level wrinkle, because agents running on recurring triggers and loops can accumulate costs unpredictably, and two organizations reported actual overruns.
An Identity Problem Hiding in Plain Sight
Existing identity and access management tools were designed for people, not for systems that operate continuously, chain actions across databases and enterprise software, and make independent decisions.
Participants worried that agents inherit the same data access rights as the humans who deploy them, and several called for a clear separation between human and agent identities, each with its own permission levels.
Some also flagged "shadow agents," deployed by employees without formal approval, as a growing concern.
Multi-agent architectures compound the issue. Errors can propagate across workflows, failures become harder to trace, and agent-to-agent communication opens a new attack surface. The paper concludes that accountability across organizational and agent-to-agent boundaries remains insufficiently specified.
In plain terms, nobody has settled who answers when your agent and a supplier's agent create a problem together.
Openness as Risk Management
Interviewees showed a growing preference for open protocols and components. Anthropic's Model Context Protocol was frequently cited for authenticated, governed tool connectivity, and Google's A2A protocol for multi-agent coordination.
Several firms described a "minimum viable intelligence" principle, using the smallest capable model for each task, and one called model-agnostic design "strategic optionality." The motive is partly technical and partly strategic, namely avoiding lock-in to a single provider's agent ecosystem.
I have long argued that open choice is a strategic asset rather than a procurement preference, and Agentic AI raises the stakes. Architecture decisions made today will determine how much governance flexibility you retain tomorrow.
Why Agentic AI Governance Matters
The paper's closing argument is that governance must evolve from static controls to dynamic, distributed oversight that operates across the full lifecycle. For executives, that translates into a handful of concrete moves.
Treat every agent as an identity with least-privilege permissions, and keep a registry of approved agents so that shadow deployments surface.
Write agentic specifics into procurement, including which tools, models, and data sources a vendor's agent can use, under what permissions, and with what limits on actions and resource consumption.
Expand autonomy only as reliability is demonstrated, starting with internal "Customer Zero" deployments. Measure systems, not just models. And protect your subject-matter expertise, because interviewees expect access to domain knowledge to become a bottleneck as the technology matures.
The vendor pitch will keep emphasizing how autonomous agents can become. The better question for your next steering committee is how much autonomy your governance can safely absorb.
Reach out to learn more about our Applied-AI Initiative objectives.
Source: Hickok, M., Iida, R., Aranda, L., and Sugimoto, K. (2026), "Agentic AI in organisations: Early insights from practitioner interviews," OECD Artificial Intelligence Papers, No. 65, OECD Publishing, Paris. Licensed under CC BY 4.0