Forty-seven agents.
That is how many a VP of Engineering at a Fortune 500 had on his spreadsheet last Tuesday. His governance team knew about twelve. The other thirty-five were scattered across six business units, each with their own API keys, their own data access patterns, and their own definitions of “production-ready.”
He pulled up the spreadsheet on a call with me. “We thought we had this under control,” he said. The spreadsheet told a different story. Two agents were making customer-facing decisions with stale data. One had been running for four months without a single human checking its output. Nobody could tell me what models they were calling or how much they were spending.
I’ve seen this pattern in three enterprises this quarter alone. The details change. The shape doesn’t.
Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls (Gartner, June 2025). Look at those three reasons again. Not one of them is a model failure. Every one is governance that never showed up.
After mapping this across multiple enterprise conversations, I see three distinct failure modes. Most teams recognize one. Almost nobody distinguishes all three. And the fix for each is different.
Here is the framework.
These three modes are connected. PoC Graveyard creates pressure to ship without governance. That pressure creates Agent Sprawl. And Agent Sprawl makes Silent Failure inevitable, because you cannot monitor what you do not know exists.
A mid-market fintech built a customer-onboarding agent last fall. The demo was spectacular: it pulled KYC documents, cross-referenced compliance databases, and generated approval recommendations in under ninety seconds. The CEO loved it.
Six months later, it is still running on a developer’s laptop.
The team never built a monitoring layer. There was no plan for what happens when the model provider changes its API. Nobody defined who reviews the agent’s decisions or how frequently. The compliance team had never been briefed.
The agent works perfectly. It just cannot be trusted in production.
This is the most common failure mode because it feels like a technology problem. It is not. It is an operational design problem. Every agent that passes a demo without an operational handoff checklist is pre-destined for the graveyard.
The VP of Engineering’s spreadsheet is not unusual. Most enterprise executives still struggle to articulate ROI from their AI investments. One reason: the agents that ARE delivering value are invisible to the people measuring ROI.
Agent Sprawl happens when individual contributors build agents to solve their own problems. A solutions architect builds a proposal-generation agent. A data engineer builds a pipeline-monitoring agent. A product manager builds a competitive-analysis agent. Each one works. None of them are registered, audited, or governed.
The compounding risk: each of these agents has API keys, data access permissions, and behavioral patterns that exist outside your security perimeter. MCP adoption is accelerating across software organizations, but governance frameworks have not kept pace (DX Heroes: MCP Governance Landscape). The surface area for ungoverned tool access is growing faster than any security team can audit manually.
And the MCP protocol roadmap signals a stateless, OAuth-aligned release candidate later this year (MCP 2026 Roadmap). Enterprises that deployed MCP-connected agents before the governed version will need migration plans. The governance conversation that should have happened six months ago is about to become mandatory.
This is the failure mode that keeps me up at night.
Silent Failure happens when an agent continues to produce output, but the quality of that output degrades without triggering any alert. The agent is not crashing. It is not throwing errors. It is just getting worse, slowly, and nobody is looking.
A healthcare analytics team I spoke with had a clinical-summarization agent that performed well for three months. Then the underlying model received a minor update. The summaries shortened by 40%. Key diagnostic context started getting omitted. It took six weeks for a physician to flag the issue. By then, the team had processed several thousand summaries with missing clinical context.
Nobody built a quality baseline. Nobody instrumented output drift detection. The agent looked functional in every dashboard.
Recent research on reasoning-focused models makes this operationally urgent: training models for stronger reasoning can increase tool-hallucination rates, not decrease them (arXiv: “The Reasoning Trap”). The smarter the model appears in evaluation, the more likely it hallucinates on tool calls in production. Observability between the thinking and the doing is not optional.
The root cause is structural. Enterprise AI adoption outpaced enterprise AI governance by at least eighteen months. Any developer with an API key can deploy an agent today, but the procurement, security, and compliance workflows that gate traditional software do not cover agent deployments. And the governance frameworks that do exist were designed for deterministic software. Agents are probabilistic. Their outputs vary by context, model state, and available tools. You cannot govern what you cannot predict with the same tools you use to govern what you can.
The result: most teams instrument for errors (did it crash?) but not for quality (is the output still good?). That gap is where Silent Failure lives.
If you recognize your organization in any of the three failure modes, here is a practical starting point. You can run this audit in a single afternoon.
Build a central registry of every agent running in your organization. Not just the ones your platform team deployed. Every agent. Include:
What model(s) it calls
What data it can access
Who owns it
When it was last reviewed
What decisions it makes (advisory vs. autonomous)
If you cannot fill in every field for every agent, you have a governance gap.
Add an observability layer between your agents and your business outcomes. This is not logging. Logging tells you what happened. Observability tells you whether what happened was any good.
At minimum, instrument:
Output quality baselines (what does “good” look like for each agent?)
Drift detection (has output quality changed over time?)
Cost per task (what does each agent decision actually cost?)
Tool-call reliability (are tool calls succeeding, or is the model hallucinating them?)
Every agent needs an operational handoff checklist before it leaves the prototype stage:
Who reviews the agent’s decisions, and how often?
What happens when the model provider changes its API or pricing?
Who is accountable for the agent’s output quality?
What is the escalation path when the agent produces a bad outcome?
Is there a kill switch, and who has access to it?
If your agents cannot answer these five questions, they are not production-ready. Full stop.
If you cannot answer how many agents your organization runs, what data they access, and whether their output quality has changed since deployment, you have a governance gap. The AI Readiness Assessment is the structured version of the audit above: where your governance stands today, and which gaps will cost you first. Reply to this email if you want to learn more.
Governance was never the thing that made AI work. It was always the thing that kept AI working.
Share this with the CTO or VP Engineering you think would find this pattern familiar.
Quick hits from this week in enterprise AI, governance edition:
↑ Gartner: uniform governance across AI agents is a “root cause of failure” (Gartner, May 2026) Treating agent governance as binary (locked down or fully trusted) kills both. Proportional governance by autonomy level is the only model that scales.
↑ Microsoft ships Agent 365 GA at $15/user/month; shadow AI discovery detects Claude Code, Cursor, and 18 agent types (VentureBeat) The fact that Microsoft built a product specifically to find the agents your IT team does not know about tells you how universal the spreadsheet problem is.
👀 30 CVEs filed against MCP infrastructure in 60 days; OWASP publishes MCP security cheatsheet (OWASP GenAI) MCP is a transport layer, not a governance layer. Every team treating it as both has a security gap they have not scoped yet.
↓ EU AI Act high-risk enforcement begins August 2; autonomous agents classified high-risk (EU AI Act) Fines up to 3% of global turnover (or EUR 15M, whichever is higher). Most enterprises deploying agents today have not started the compliance work that takes 6-18 months.
↑ Researchers propose HMAC-signed “tool receipts” to catch agent hallucinations: 91% detection, sub-15ms overhead (arXiv 2603.10060) Cryptographic proof that a tool call actually happened, not that the model said it did. This is what verifiable agent execution looks like.
👀 Gartner: average Fortune 500 will run 150,000 agents by 2028, up from fewer than 15 in 2025 (Gartner, April 2026) At that scale, manual registries are a fiction. The governance architecture is either automated or it does not exist.
↓ 88% of enterprises report AI agent security incidents; only 21% have runtime visibility (MSSP Alert) The gap between deployment velocity and governance readiness is widening, not closing. This is Silent Failure at industry scale.
More Signal. Less Noise.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.