AI agents are already working inside companies. An IDC survey from July 2026 indicates that 95% of organizations have at least one agent workflow in production, and almost one in four already has more than fifteen [1]. The question is no longer whether the company will use agents. It is now a different one: how far can the agent go on its own, and who answers when it does?
The two most-cited analyst firms in the market answer in ways that, at first glance, seem opposed. It is worth reading both closely, because the right way to operate agents lies in the tension between them.
In short
- AI agents already act on their own: 95% of organizations have at least one agent workflow in production, according to IDC [1].
- Full autonomy is not ready yet: Gartner recommends semi-autonomous deployments and expects more than 40% of agentic AI projects to be canceled by 2027 [2].
- Autonomy should be granted per action, in proportion to risk: the agent does on its own what can be undone, proposes what needs judgment, and anything irreversible goes through two people.
- Responsibility does not pass to the agent: the duty of those who run a company is fiduciary, and the record of what the agent did is the proof of the diligence of the person who answers [14].
Two readings of the same market
IDC defines the category by autonomy. In the assessment it published in October 2026, an agentic AI platform is the system that lets you build, deploy, govern and orchestrate agents able to reason, decide and carry out multistep tasks without continuous human supervision [1]. The same definition, however, requires people and agents to work together on business processes, with escalation and handoff to the person when needed.
Gartner applies the brake at the same point. In the 2026 Hype Cycle for Agentic AI, the reading is that fully autonomous agents are not yet ready for most enterprise cases, that human supervision remains essential and that companies should plan semi-autonomous deployments [2]. In the 2026 Hype Cycle for AI, Gartner projects that more than 40% of agent projects will be canceled by 2027, because of cost, unclear value and failures in risk management [2].
The adoption numbers also diverge. Gartner speaks of 17% of organizations with agents deployed and 42% expecting to deploy within twelve months [2]; IDC speaks of 95% with some agent workflow in production [1]. The surveys have different dates, samples and definitions (a workflow with an agent is not the same as a deployed agent), so the numbers do not cancel each other out. They show a market that experiments a lot and still scales little.
Read together, the two sources say the same thing: the value is in autonomy, and autonomy only scales when someone can explain, limit and answer for what the agent does.
Our thesis
The way we operate agents fits in one sentence: autonomy that grows with proof, within rules the company defines, and a person who always answers.
In practice, this has three parts.
Autonomy is granted per action, in proportion to risk. Checking documents, assembling a case file or checking inventory are reversible, low-risk actions; the agent can do them on its own, with every step recorded. Releasing credit above policy or sending personal data to a partner are actions of a different nature; there the agent stops, proposes and a person decides. An action that cannot be undone requires two people.
Autonomy rises with evidence and falls on its own. When the history of an action shows that the agent gets it right within the limits, the responsible person can ask for more autonomy on that action, and another person decides. If the agent repeatedly breaches the limits, if its behavior changes or if the owner stops answering for it, the level drops without waiting for anyone. Expanding requires a human decision; reducing is automatic.
Every autonomy has an owner. The agent always acts on behalf of someone with authority over that work. If that person leaves, the agent’s autonomy leaves with them, until someone else takes over. Responsibility never rests with the agent or with the tool vendor.
This translates into four outcomes that the executive team follows together: productivity (what the agent does on its own), budget (the cost of the agents set beside the measured gain), controls and risks (what falls outside the limit and why) and accountable authority (who delegated, who decided and with what proof).
Why responsibility cannot be delegated
There are three reasons, in increasing order of weight.
Regulation. The European AI Act requires that high-risk systems can be effectively overseen by people, that these people can interpret the output, decide not to use it, reverse it and safely stop the system [3]. In Brazil, the LGPD (General Data Protection Law) gives the data subject the right to request review of decisions made solely on the basis of automated processing and to receive clear information about the criteria used [4]. Sectors such as credit, health care and insurance add their own rules to this minimum.
Management standards. The NIST AI Risk Management Framework places accountability at the center of the governance function: roles, responsibilities and lines of authority defined for AI risks [5]. ISO/IEC 42001 calls for an AI management system with assigned roles, impact assessment and control over the life cycle of the systems [6]. Gartner, in its reading of AI TRiSM, insists that written policies are not enough: governance has to be embedded and enforced continuously, at runtime [7].
Audit. The question that reaches the board, the auditor and the regulator is always the same: who decided, with what information and with what authorization? An agent does not sign that answer. A person signs it, and needs to have the proof at hand.
The counterarguments, taken seriously
A thesis only holds if it withstands the strongest objections. These are the five we hear most.
1. “Human oversight does not scale. It becomes a rubber stamp.”
True, and the literature is old. Parasuraman and Manzey showed that people facing automated systems tend toward complacency and automation bias: they accept the recommendation without examining it, especially when the system is usually right [8]. The European AI Act names this bias and requires that those who oversee be able to recognize it [3].
The answer is to keep people from reviewing routine work. If the agent can act on its own within the limits, the person steps in only for what falls outside them, and the review volume drops to what really deserves attention. In the most sensitive decisions, the person records their own assessment before seeing the agent’s recommendation, so that the recommendation does not decide for them. Oversight that turns into a rubber stamp is a sign that the limit is badly designed.
2. “Incremental autonomy is slow. Whoever grants full autonomy arrives first.”
They arrive first at cancellation, if Gartner is right about the 40% [2]. The increment we defend is no queue: it works per action and in proportion to risk. A reversible action can gain autonomy quickly; an action that cannot be undone may never gain it. IDC records that 69% of organizations prioritize agents specialized in specific tasks and processes [1], which is exactly the ground where autonomy can be measured and released action by action.
3. “Governance is a cost. It delays value.”
The data point the other way. The three biggest challenges cited to IDC are transparency and explainability of results (37%), the cost of deployment and integration (36%) and managing cultural change (34%) [1]. Gartner lists observability, cybersecurity and proactive cost control as priorities in the face of rapid adoption [2]. To enter the IDC assessment, governance is the only mandatory capability, and value measurement is one of the eleven assessed [1]. Without governance, the company does not know what the agent did or how much it cost. Without knowing that, it cannot prove the return, and the project joins the canceled statistics.
4. “The law does not require a human in everything.”
Correct. The European AI Act requires human oversight for high-risk systems, not for all of them [3]. The LGPD, since the 2019 amendment, ensures the right to review of automated decisions but does not require that the review be performed by a person [4]. Our position does not lean on the legal minimum. It leans on corporate responsibility: someone has to answer to the board, the client and the auditor for what was done in the company’s name, with or without a specific legal obligation.
5. “The big platforms already govern agents.”
Also true, and IDC shows the market converging from several directions: vendors of enterprise applications, automation, data, cloud and models [1]. Several of these platforms already govern their own agents and those of third parties. Two things, however, remain open for many companies. The first is where the agent runs: IDC records that 42% of organizations aim for private cloud and 34% for their own servers for their agents [1], and not every platform offers that. The second is who answers for each case: governing the agent’s access is different from having a person with a name, authority and proof for every action it takes.
How this shows up in operations
The best test of the thesis is to take it where error costs the most. In the three cases below, all illustrative, the same rule repeats. The agent does on its own what is routine and reversible. It proposes what requires judgment, and a person decides. What cannot be undone goes through two people. Autonomy is released step by step, in proportion to the risk of each action, and each case has an owner with a name.
Credit: the decision the law says must be explained
A lender receives personal credit and working capital requests every morning. The credit manager owns the case: she defines how much the agents may cost, what they do on their own and the expected effect, which is approving more good requests without raising defaults.
- The agent does on its own: assembles the case file for each request (registration, income, credit check, documents), verifies the information and calculates the policy indicators. Every step leaves a record, and none of them moves money.
- The agent proposes, a person decides: the grant. When the borrower is an individual, credit assessment is among the high-risk uses in the European AI Act [9], and the LGPD gives the client the right to request review of the automated decision that defines their credit profile and to know the criteria used [4].
- Two people: the exception to policy, such as a limit above what the policy allows. After disbursement, there is no way back.
- How autonomy grows and falls: with history, the limit renewal for clients in good standing, within policy, can start to go out on its own, if the manager asks and another person approves. The client can still request review, and the manager still answers for each renewal. If the performance of these renewals falls below what the policy accepts, autonomy goes back to proposal only, without waiting for anyone.
Health care: approving is allowed, denying never
A health plan operator receives thousands of requests per day to authorize exams and procedures. The case owner is the physician responsible for care regulation.
- The agent does on its own: checks contract coverage, waiting periods and request documents, and authorizes routine exams when all contract criteria match. Health data is sensitive personal data under the LGPD [4], and the agent’s limits also define which data it may consult.
- The agent proposes, a person decides: any denial. The agent may approve what meets the criteria, but never denies on its own. The denial goes to an auditing physician, who decides and signs the justification. The rules of the ANS (Brazil’s national regulator for private health plans) require that a denial be given in writing, with the reason and the clause or rule that supports it, and ensure the beneficiary can request reanalysis [12].
- Two people: the denial of a high-cost procedure or of continuing treatment, such as oncology, where the effect on the patient can be severe and hard to reverse. The auditing physician decides, and a second clinical review confirms.
- How autonomy grows and falls: automatic authorizations can extend to new exam types as the history shows accuracy. If an audit finds improper authorizations above what the operator accepts, the agent goes back to proposing for that type of request.
Risk and compliance: the communication that cannot be undone
A bank monitors millions of transactions per month to prevent money laundering. The case owner is the director responsible for money-laundering prevention, a role that Banco Central do Brasil (Brazil’s central bank) regulation requires the institution to designate [11].
- The agent does on its own: monitors transactions, cross-checks them against the client register and restricted lists, and assembles the case file for each alert with the client’s history.
- The agent proposes, a person decides: closing an alert as a false positive or classifying it as suspicious. The analyst decides and records the reason.
- Two people: the report to Coaf, Brazil’s financial intelligence unit. It cannot be undone, and the law forbids informing anyone of it, including the client [10]. The agent prepares the report to fit the 24-hour deadline the law sets, but two people send it, and the agent never speaks to the client about the alert.
- How autonomy grows and falls: with history, the closing of alerts of a known, low-risk pattern can go out on its own. If a review shows that an alert was closed improperly, the autonomy for that action drops immediately, and the pattern goes back to the analyst.
In all three cases, the question “who decided?” always has a name, and the autonomy the agent has today is the one its history justified. The cost of the agents sits beside the measured gain, and the company is the one that closes the account.
How these limits apply to agents running on several platforms is covered in The tenth deployment is not redesigned and in Arcogi’s agent architecture.
Where this sits on the market map
In the 2026 Hype Cycle for Agentic AI, governance and security for agentic AI appear near the peak of expectations, while the space of collaboration between people and agents and guardian agents are still at the start of the curve [2]. In the 2026 Hype Cycle for Emerging Technologies, the first priority pointed out to CIOs is to distribute decisions between people and autonomous machines, balancing innovation with human oversight and organizational readiness [2]. In other words: the market has already understood that it needs to govern agents, and is beginning to design how people and agents work together. It is in this second part that responsibility is decided.
The point: autonomy does not exclude responsibility
The autonomy of agents is what generates productivity, and so it will grow. But autonomy does not remove human responsibility. Granting autonomy to an agent is someone’s decision, and whoever decides answers for what they decided.
To err is human, and agents also err. They err in a different way: a language model can produce a false answer with all the appearance of a correct one, and NIST lists this confabulation among the risks specific to generative AI [13]. So who errs less, the person or the agent, is the wrong question. The useful question is whether the error shows up in time, whether it can be undone and whether someone answers for it. Risk-based limits, the record of each act and the autonomy that falls on its own exist so that all three answers are yes.
The responsibility of those who run a company is fiduciary. The Brazilian Corporations Law requires of the officer the care and diligence that an active and honest person uses in their own business, and loyalty to the company [14]; the Civil Code requires the same care of the managers of other kinds of companies [15]. This duty cannot be transferred to a tool, a vendor or an agent. Whoever delegates work to the agent keeps answering for the result.
There is a side of this duty that often goes unnoticed. The same Corporations Law allows the judge to excuse the officer who acted in good faith and in the interest of the company [14]. When an agent errs, what shows the good faith and diligence of the person who answers is the proof: the limit that was defined, the record of what the agent did, who authorized it and why. Governing agents, therefore, also protects the person who answers for them.
The question, then, is whether autonomy grows with proof, within rules the company understands and with someone who answers, or whether it grows in the dark until the first incident.
The agent acts. The person answers.
Sources and further reading
- IDC. IDC MarketScape: Worldwide Agentic AI Platforms 2026 Vendor Assessment. Neil Ward-Dutton and Melih Murat. IDC #US54140926, October 2026 (excerpt IDC #US54140926e). IDC survey of July 2026 cited in the document. link
- Gartner. See 3 of the Most Popular Gartner Hype Cycles: Hype Cycle for Agentic AI (2026), Hype Cycle for Artificial Intelligence, 2026, and Hype Cycle for Emerging Technologies, 2026. Gartner, 2026. link
- European Union. Regulation (EU) 2024/1689 (AI Act), art. 14, Human oversight. link
- Brazil. Law No. 13,709/2018 (LGPD, General Data Protection Law), art. 11 (sensitive data) and art. 20 (review of automated decisions), as amended by Law No. 13,853/2019. link
- NIST. Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1, January 2023, GOVERN function. link
- ISO/IEC 42001:2023. Information technology. Artificial intelligence. Management system. link
- Gartner. AI Trust, Risk and Security Management (AI TRiSM), article at gartner.com/en/articles/ai-governance-trism. link
- Parasuraman, R.; Manzey, D. H. Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors, 52(3), 381–410, 2010. link
- European Union. Regulation (EU) 2024/1689 (AI Act), Annex III, point 5, items (b) and (c) (credit assessment of individuals; risk and pricing in life and health insurance). link
- Brazil. Law No. 9,613/1998 (anti-money-laundering law), art. 11, II, as amended by Law No. 12,683/2012 (report to Coaf within 24 hours, without informing anyone). link
- Banco Central do Brasil. Circular No. 3,978/2020 (policy, procedures and internal controls for preventing money laundering and terrorist financing). link
- ANS (Agência Nacional de Saúde Suplementar, Brazil’s national regulator for private health plans). Normative Resolution (RN) No. 623/2024 (customer service for beneficiaries; it revoked RN No. 395/2016), in force since July 1, 2025. link
- NIST. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1, July 2024 (confabulation risk). link
- Brazil. Law No. 6,404/1976 (Corporations Law), arts. 153 (diligence), 154, 155 (loyalty), 158 and 159, § 6. link
- Brazil. Law No. 10,406/2002 (Civil Code), art. 1,011. link