Agentic systems chain together several operations, interact with applications and carry out actions with a variable degree of autonomy, which moves AI from assistance to the execution of processes. As long as a system produces a recommendation, the decision remains under the direct control of an employee; once it can commit to an action, modify information or interact with a third party, the consequences of its errors become immediate.

The Boston Consulting Group’s Applied AI Index 2026 highlights the gap between companies’ ambitions and their readiness. According to the study, 42% of companies plan to grant agents genuine decision-making autonomy by 2030, while only 5% today have the full set of controls deemed critical. Companies that have put in place the six control mechanisms examined by BCG also report generating three times more agentic value than those with only one.

These results do not show that governance mechanically produces more value: the best-controlled companies may also have a clearer strategy, better-structured processes or greater deployment experience. They do suggest that the ability to frame autonomy could be an important condition for creating value from it.

The central question becomes which decisions a company can reasonably delegate to an agent, with what level of autonomy, for what economic benefit and under what conditions of control.

The central question becomes which decisions a company can reasonably delegate to an agent, with what level of autonomy, for what economic benefit and under what conditions of control.

From Recommendation to Action:

A Change in the Nature of Risk

A predictive model can identify a risk of supplier delay, and an assistant can analyze its consequences and propose corrective measures. An agent with the appropriate permissions can go further: contact the supplier, change a procurement priority, update an order or trigger an escalation. These capabilities speed up execution in processes that involve many repetitive decisions, but they change the relationship between information and action.

When a system gives an erroneous recommendation, an employee can still question it before applying it. When an agent carries out the operation directly, this prior check may disappear, and the error then concerns the consequences of an action actually taken, beyond the quality of an analysis. In procurement, an agent could commit to an order on the basis of incomplete information; in accounts receivable, trigger an inappropriate reminder; in an industrial environment, modify operating parameters with effects on quality, continuity or safety. These examples do not rule out autonomy in these functions, but its suitability depends on the nature of the actions, their economic materiality and the company’s ability to control their consequences.

Risk can also build up gradually: individually limited actions produce a significant commitment when they accumulate, and several decisions that each appear correct can lead to an unfavorable outcome when their interactions are not properly taken into account. The more a system acts without human intervention, the more decisive the definition of its scope of authority becomes.

Matching Autonomy to Materiality and the Cost of Error

Not all decisions carry the same level of risk: some are frequent, standardized and easily reversible, while others involve large amounts, affect third parties or produce consequences that are hard to correct.

Whether to delegate a decision to an agent is assessed along four dimensions, beyond technical feasibility.

Economic materiality distinguishes an action involving a few pieces of internal information from a change to a customer’s commercial terms or a financial commitment.

Reversibility separates a document classification error, corrected at low cost, from an executed order or a communication sent to a customer, whose effects persist after an IT correction.

Frequency and volume also matter, because an error that is cheap in isolation becomes significant when repeated thousands of times: automation speeds up value creation and the spread of errors alike.

Finally, the degree of uncertainty varies according to whether the situation is governed by precise rules or requires judgment of context and exceptions that the data does not fully represent.

These dimensions lead to several levels of delegation.

• At the first, the system proposes an action and the decision remains entirely human.
• At the second, it prepares an operation that is subject to validation before execution.
• At the third, it acts autonomously within predefined limits, with monitoring and escalation.
• At the most advanced level, it coordinates several operations or systems, subject to controls suited to the reach of its actions.

This progression is by no means mandatory: in some functions, human validation costs little relative to the risks avoided, whereas for quickly handling many low-sensitivity situations, supervised autonomy produces significant benefits. The choice weighs expected gains, supervision costs, the possible consequences of errors and control capabilities, in order to select the level of autonomy that is economically justified and compatible with the risk the company can accept.

Governance as a Condition of Execution

AI governance is not limited to general rules on confidentiality, security or compliance: it specifies how systems take part in decisions, what powers are assigned to them and how the company retains control over outcomes. MIT’s AI Strategy and Leadership program, for its part, links the deployment of AI to managerial responsibilities, organization and risk management.

Governance starts with the identification of a business owner. An agent is not deployed because a technology team demonstrates that it can execute a process: the function concerned defines the expected actions, the acceptable limits and the conditions for human intervention, and responsibility for the process remains explicit when several functions take part in the design, operation and supervision of the system.

Permissions are then defined precisely: an agent may read certain data without modifying it, prepare an order without validating it, or trigger an action when predefined criteria are met. These limits must be enforced technically, because an instruction to the model not to exceed a given amount does not replace an independent mechanism that actually prevents that commitment.

Traceability makes it possible to know what information was used, what actions were executed and when, which facilitates incident handling and the reconstruction of responsibilities. The company must also be able to suspend an autonomous system when unexpected behavior appears or a risk threshold is exceeded; BCG mentions in this respect oversight and rollback mechanisms, as well as security, audit and cost guardrails.

Supervision cannot rely on an employee observing all actions in real time. A limited pilot can be followed manually by a specialized team, whereas a system deployed across thousands of operations requires built-in controls, alert thresholds, escalation mechanisms and recovery procedures, all reproducible and economically sustainable. The quality of these mechanisms thus determines whether agents can be industrialized.

Governance as a Source of Value Creation

Control mechanisms (validations, documentation, access restrictions, supervision) are often perceived as constraints that raise costs and slow operations. In the case of agentic AI, this reading is only partial. Without sufficient controls, the company may forgo delegating actions that would be economically worthwhile: a process stays dependent on manual validations when authority limits, reliability or exception handling are not defined clearly enough, even if the agents are capable of executing it. When delegation rules are explicit, operations are traceable and sensitive situations can be identified, human interventions concentrate on the decisions that warrant them and the acceptable scope of automation widens.

The association observed by BCG between the breadth of controls and the level of agentic value reported points in this direction. It is not enough to establish that the controls explain performance, but it challenges the idea of a systematic opposition between governance and value creation.

Controls do have a cost, however. A system that requires systematic human validation, numerous corrections and permanent supervision loses a significant part of its economic advantage, while removing those interventions to cut costs exposes the company to errors whose consequences may exceed the expected savings. The relevant level of control therefore depends on its effect on the net value of the process, which includes the benefits of speed, productivity or quality, as well as the costs of supervision, human intervention and correction and the potential losses from errors. The level of control to adopt is the one that maximizes lasting economic value, given the risks the company is able and willing to accept.

Processes, Responsibilities and General Management

Agents also transform the architecture of processes. A traditional process strings together human interventions, applications and validation points, and agents able to coordinate several operations call this organization into question: systems carry out part of the repetitive activities, while employees concentrate on defining rules, handling exceptions and making complex judgments. Simply replacing certain human interventions with agents rarely improves a process designed around those interventions, whose steps, validations and information exchanges often need to be rethought.

When an agent takes an inappropriate action, the company’s responsibility cannot be attributed to the system alone: one must determine whether the incident stems from the data, the delegation rules, the model, its integration or a failure of supervision, and then identify the corrections and who is responsible for them. Employees must also understand the role of agents and the situations where their own judgment remains indispensable, because excessive trust leads to accepting insufficiently verified decisions and systematic distrust neutralizes the expected benefits.

Authorizing an agent to carry out operations amounts to delegating to it a capacity to act inside the company, with possible effects on the resources committed, on customers, on suppliers and on performance. This delegation therefore belongs to general management, which defines the areas where autonomy is desirable, the expected benefits and the limits that must not be crossed. Business leaders take ownership of the results of the processes concerned, technology functions guarantee execution and controls, and the risk, compliance and security functions intervene according to the sensitivity of the operations. The finance function assesses the materiality of the decisions delegated, the savings expected, the full costs of supervision and the economic consequences of potential errors, in order to determine whether the additional autonomy justifies the costs and risks it introduces.

Governance mechanisms should be assessed from the design stage of initiatives, before technical feasibility is demonstrated, because an agent that performs satisfactorily in a pilot may remain unsuited to a broader deployment. For boards of directors, the issue is the general framework of delegation and oversight: approving every automation would be unrealistic, but boards are responsible for verifying that the company has coherent principles on which decisions can be automated, acceptable levels of risk, responsibilities and control mechanisms.

Governing Autonomy to Capture Its Value

Autonomy increases the speed at which operations are executed, and it can just as well accelerate the spread of errors, multiply inappropriate commitments or weaken controls when it is deployed without sufficiently defined limits. Value results from a balance between the benefits of automation, the reliability of decisions, the handling of exceptions and the cost of supervision.

Executives therefore have to set the boundaries of delegation explicitly: which decisions can be automated without prior control, which require human validation, which commitments a system may make, and how inappropriate behavior is detected and stopped. These points fall under the allocation of responsibilities and economic governance, beyond IT management.

The best-performing organizations may be those that have determined precisely which decisions to delegate, which limits to impose and under what conditions autonomy produces a real benefit. Autonomy is a matter of technology, its delegation is a management decision, and its justification lies in the economic value the company manages to capture.

Sources

•            Boston Consulting Group, The Formula for Agentic AI Value: The Applied AI Index 2026 (42% of companies planning to grant agents autonomy by 2030, 5% with the full set of critical controls, three times more agentic value with six controls against one)

•            Boston Consulting Group, press release of September 30, 2026 on the Applied AI Index (examples of oversight, rollback, security, audit and cost-control mechanisms)