The first wave of enterprise AI answered questions. The current wave takes action. Agents now draft and send correspondence, update records, approve routine transactions, and move work between systems. BCG estimates agents' share of total AI value rose from 17 to 22 percent in a single year, and expects it to approach 39 percent by 2030.
The ambition is clear. BCG reports that 42 percent of companies expect agents to act autonomously by 2030. The readiness is not. Only 5 percent have the full set of critical controls in place today. McKinsey finds a similar gap from the people side: 70 percent of respondents feel personally ready for AI, but only 27 percent of leaders say their organizations are ready for an agentic future.
An agent that is right 97 percent of the time sounds dependable. Across a long workflow, it is not.
01Why agents fail differently
Bain illustrates the problem with simple arithmetic. In a workflow of 34 steps, a model that is 97 percent accurate at each step finishes the whole task correctly only about 36 percent of the time. At 99 percent per step, the result rises to about 71 percent. Small error rates compound, and they compound quietly.
Agents also drift. A model update changes behavior and accuracy slips without anyone noticing until a customer does. Costs creep as usage grows and loops run longer than expected. Agents multiply across teams until no one holds a complete list of what exists or what each one can reach. None of this shows up in a pilot. All of it shows up in production.
02What good control looks like
The leaders in BCG's research put controls in place before granting autonomy, and they see three times the agentic value of companies with minimal controls. The practical elements are well understood:
- An inventory. Every agent in production, its owner, its purpose, and the systems and data it can access.
- Graduated autonomy. Agents earn wider authority as they prove reliable, with people approving high stakes actions until they do.
- Continuous evaluation. Tests that run whenever prompts, models, or tools change, so quality never slips unnoticed.
- Cost guardrails. Spend tracked per agent and per outcome, with limits that stop runaway loops before they reach the invoice.
- Monitoring and response. Tracing across agent runs, alerts on failures and anomalies, and a clear plan for when something goes wrong.
- Reporting to leadership. A regular view of reliability, cost, risk, and the value each agent delivers.
03The question for the board
Boards already ask how cyber risk and financial controls are managed. Agents belong on the same list. The question is not whether to deploy them. It is whether the company knows what its agents are doing, what they cost, and how it would know if one went wrong. The companies that can answer clearly are the ones that will be able to give agents real responsibility, and capture the value that comes with it.