The enterprise agent race will not be won by the company with the most agents. It will be won by the company that can prove what each agent may do, what it actually did, and how to stop or recover it.
Investment appetite is already ahead of operational readiness. Deloitte predicts that as many as 75% of companies may invest in agentic AI by the end of 2026. Gartner lists multiagent systems among its strategic technology trends. McKinsey’s 2026 survey finds that leading companies are raising technology budgets to scale agentic systems.
The same sources describe the constraint. Better orchestration, secure data foundations, system integration, talent, and change management determine whether an agent becomes a repeatable workflow or an expensive demonstration.
The control plane is therefore the product. Models and tools create capability; identity, policy, telemetry, approval, and recovery convert that capability into an operation the enterprise can own.
Adoption forecasts are not deployment evidence
Deloitte’s 2026 forecast puts the agentic AI market at a projected $8.5 billion in 2026 and says stronger orchestration and risk management could lift a 2030 projection from $35 billion to as much as $45 billion. Those figures describe a possible market, not demonstrated enterprise value.
McKinsey surveyed 632 technology and business leaders across 69 countries and 24 industries for its Global Tech Agenda 2026. One quarter of respondents from top-performing companies said they lacked the data foundations needed to scale agentic AI securely and reliably. Nearly one third of companies reported AI talent, capability, or integration problems. Change management remained a core scaling challenge.
Figure: Deloitte’s market forecast and McKinsey’s survey use different methods. Together they show why investment intent should not be confused with production readiness.
An agent can look successful in a pilot because the task is narrow, the operator watches every step, and failures are manually repaired. Scale removes those protections. More users create more ambiguous instructions. More tools create more combinations of side effects. More agents create delegation chains that are difficult to reconstruct after an incident.
The relevant deployment metric is not agent count. It is the share of eligible workflows that complete within defined cost, quality, and risk limits.
Multiagent systems multiply authority paths
Gartner defines a multiagent system as a collection of agents that interact to achieve individual or shared goals, potentially across distributed environments. Modularity can help teams reuse specialized components and adapt workflows more quickly.
It also creates a new systems problem. Agent A may be allowed to read a customer record. Agent B may be allowed to send a message. Agent C may summarize the result. If delegation is represented only in prompts, the combined workflow can perform an action that no single approval screen described.
The risk is not that agents secretly become conscious collaborators. It is that ordinary software authority becomes distributed across probabilistic planners.
Figure: Prompts and model outputs remain untrusted until deterministic policy, scoped tools, and an isolated runtime constrain their effects.
Every handoff should therefore preserve a machine-readable chain:
- The originating human or service.
- The workflow and business purpose.
- The identity and version of each agent.
- The capabilities delegated at each step.
- The data classifications and environments in scope.
- The expiration, budget, and approval attached to the task.
This is standard distributed-systems hygiene applied to a new runtime. A natural-language explanation can help an operator understand the plan, but it cannot replace an authorization record.
Identity and authorization must live outside the model
NIST launched an AI Agent Standards Initiative in February 2026 around secure interoperability, authentication, identity infrastructure, and security evaluations. A related concept paper asks how existing identity and authorization standards can apply to software agents.
The framing is important. An agent is software acting on behalf of another principal. It needs a verifiable identity, but that identity should not inherit broad user authority by default.
A production control plane should issue short-lived credentials for a specific task, resource, action, and environment. A research agent may read approved sources without receiving permission to publish. A finance agent may draft a payment without receiving permission to execute it. A coding agent may change a development database without holding a token that can delete production backups.
Our analysis of DNS-anchored agent identity makes the same distinction: a durable name can identify the accountable owner, but it cannot decide what the agent may do.
The policy decision should evaluate canonical resource identifiers, not the label the model supplied. It should also run after tool arguments are resolved. A path, URL, account, or database name that looks harmless before resolution may point to a protected target.
Figure: Models, tools, and workflow logic create capability; identity, policy, telemetry, budgets, and recovery make that capability operable.
Observability must record effects, not conversations
Chat logs are useful for product debugging. They are weak incident records.
An investigator needs to know which credential was used, which policy version allowed the action, which target was resolved, what changed, how much it cost, and whether rollback succeeded. The model’s explanation of its intent is not evidence of the system’s effect.
Figure: Useful telemetry records identity, provenance, canonical targets, policy decisions, effects, and rollback state below the model layer.
The control plane should emit structured events before and after every state-changing tool call. High-risk actions need an approval identifier and immutable correlation ID. Sensitive values should be redacted, but the existence, scope, and result of the operation must remain auditable.
Cost belongs in the same record. Multiagent workflows can create retry loops, duplicated research, and cascading model calls even when no security boundary is crossed. Set per-task budgets, maximum delegation depth, retry ceilings, and wall-clock limits outside the agent.
Monitoring should detect repeated denials, unusual tool frequency, elevated privileges, data-volume spikes, and changes in approval behavior. The OWASP AI Agent Security Cheat Sheet similarly recommends least privilege, structured logging, anomaly detection, and human approval for high-impact actions.
Recovery is part of autonomy
An autonomous workflow is not production-ready if every failure requires an engineer to reconstruct state by hand.
Before increasing autonomy, define the unit of rollback. A content agent might revert one commit. A support agent might withdraw a draft response. A finance agent might cancel an unsubmitted transaction but require a compensating entry after settlement. A database agent may need a point-in-time recovery process that the agent’s own credential cannot erase.
Human approval should be proportional to reversibility and blast radius. Reading public documentation may proceed automatically. Sending a customer message may require policy checks and sampling. Deleting production data, moving money, changing permissions, or publishing legal commitments should require explicit approval from an independent authority.
The existing production AI agent security checklist provides a technical gate for tools, paths, network access, secrets, logging, and destructive actions. The operating-model addition is ownership: one team must be accountable for the workflow’s business outcome, not merely the model endpoint.
That owner decides when a failure is tolerable, when a person must intervene, and when the system should be disabled. Without that decision authority, an agent pilot can remain “temporarily supervised” forever.
The 2026 deployment gate
An enterprise should not scale an agentic workflow until it can answer seven questions with system evidence:
- Who authorized the task? The initiating principal and delegated chain are verifiable.
- What may the workflow touch? Data, tools, environments, and monetary limits are explicit.
- Which policy decides? Authorization runs outside the model on resolved targets.
- What happened? Structured events capture requested actions, decisions, effects, and costs.
- How does it stop? Credentials and execution can be revoked without asking the model.
- How does it recover? Rollback or compensation has been tested against realistic failures.
- Who owns the outcome? A business and technical owner accept the operating risk.
Model quality still matters. A better planner can reduce retries and improve task completion. Better tools can make actions more reliable. Neither removes the need for the control plane, because even a correct action can be unauthorized, unaffordable, or irreversible.
The market will produce thousands of agents. Most enterprises will need far fewer than vendors suggest. They will need a small number of workflows with clear authority, measurable value, and recovery they trust.
The scalable advantage is not autonomous software everywhere. It is autonomy that remains legible when something goes wrong.
