Your next AI agent will fail on governance, not technology

The agentic AI market already has dozens of serious vendors and almost no company with a model to govern them. Before signing with any of them, it pays to settle who answers when an agent decides badly and which processes deserve autonomy.

An infographic is making the rounds that arranges the “global players in the agentic operating model” in a four-tier cylinder. At the top, Microsoft, OpenAI, Google and AWS. Then SAP, Siemens and Mistral. Next, Alibaba, Huawei and Samsung. At the bottom, Accenture, Deloitte, Infosys and Globant.

More than 70 logos. And from Latin America, practically one.

But the most revealing part of the image isn’t the logos. It’s the base of the cylinder, which reads: augmented people, autonomous processes, connected data, business outcomes. No vendor on the map sells that. You have to build it.

Figure	What it means
~40%	Estimated share of the 10 largest vendors in the global agentic solutions market, according to the infographic. Concentration, but not a monopoly.
40.2% / 18.1%	Estimated weight of North America versus the “rest of the world”, where Latin America falls. The technology is designed far from your operation.
Over 40%	Agentic AI projects Gartner expects to be canceled by the end of 2027 due to rising costs, unclear business value or inadequate risk controls.

The last figure is the one that matters. Projects won’t be canceled because the language model is bad. They’ll be canceled because nobody defined what the agent could do, who supervised it and how its value was measured.

This article is about that: what you need to have settled before choosing a logo from the cylinder, and which tools on the map itself can help you settle it.

The map shows vendors; the base shows the real work

Market infographics invite the wrong question: who do we marry?

The right question is different. Which processes in my company are ready for software to make decisions without asking permission?

Look at the makeup of the map itself. Next to the hyperscalers sit Celonis and SAP Signavio, specialists in process mining and modeling. There are UiPath, ServiceNow and Appian, which come from automation and workflow orchestration. And there’s ABBYY, focused on document processing, the raw material of many administrative processes.

The market has already figured it out: without documented, measured processes, an agent has nothing to operate on.

An agent doesn’t replace a process. It executes it, with all its logic and all its flaws.

An agent is an employee without a contract

A copilot suggests. An agent acts: it approves a credit note, reassigns a ticket, changes a purchase order, escalates an incident.

And building them keeps getting easier. Salesforce Agentforce, Microsoft Copilot Studio, Joule agents in SAP, IBM watsonx Orchestrate or Oracle AI Agent Studio let a business unit configure an agent in days, sometimes without going through IT.

That leap moves the conversation from technology to accountability. When an analyst approves an improper refund, there’s a clear chain: role, supervisor, policy, consequence. When an agent does it, most companies can’t answer three basic questions:

• Under which identity did it act, and with what permissions?
• Who was the human owner of that decision?
• Where is the log that lets you reconstruct why it decided that way?

Some vendors already treat the agent as another member of the organization: Microsoft Entra Agent ID gives it a manageable identity, and Workday proposes an agent registry similar to its employee records. The signal is clear. If your team can’t answer those three questions for a pilot agent, it won’t be able to for fifty in production.

Automating a broken process only breaks it faster

We’ve seen it with RPA: bots that replicated absurd manual steps and crashed every time a screen changed. Agentic AI repeats the mistake at a larger scale, because it also decides.

An accounts payable process with three undocumented exceptions that “Carmen handles” is a time bomb for an agent. Carmen knows when a supplier deserves flexibility. The agent doesn’t.

This is where process mining stops being a luxury. Tools like Celonis or SAP Signavio rebuild the real process from ERP logs and show where the variants, rework and bottlenecks are. It’s the fastest way to get an objective baseline before automating.

Ungoverned process	Agent-ready process
Exceptions resolved by personal judgment	Exceptions cataloged, with a defined rule or escalation
KPIs measured at month end	Baseline of time, cost and error before automating
Ownership blurred across departments	One process owner with authority to change it
Data in parallel spreadsheets	A single source of truth, accessible via API

The question isn’t whether the process can be automated, but whether it’s stable enough to delegate. If the answer is no, the first project is a redesign, not AI.

The four pillars of agentic governance

You don’t need a new committee or a 200-page framework. You need four concrete capabilities, built into what your risk and compliance area already runs.

Identity and permissions

Every agent is a non-human identity and must be managed as one.

• Its own credentials, never a borrowed user’s.
• Least privilege, reviewed as often as human access.
• Immediate, tested revocation.

Autonomy levels by risk

Not every decision deserves the same freedom.

• Full autonomy for reversible, low-value tasks.
• Mandatory human approval above thresholds for money, customers or sensitive data.
• Explicit escalation when the agent isn’t confident enough in its answer.

Traceability and audit

If you can’t reconstruct a decision, you can’t defend it.

• A log of inputs, tools invoked, decision and outcome.
• Retention aligned with your local regulatory obligations.
• Periodic sample-based review, just like a transaction audit.

Cost and consumption

Agents chain calls to models and tools. Spend scales without warning.

• Budget per agent and per process, not per global contract.
• Alerts for anomalous consumption, as in any FinOps practice.
• Cost per transaction compared against the manual process baseline.

Several players on the map already offer pieces for these pillars. Use them as a reference for evaluation, not a shopping list:

Pillar	Example tools in the ecosystem
Identity and permissions	Microsoft Entra Agent ID, Workday agent registry
Autonomy levels	UiPath Maestro (orchestration with human-in-the-loop), NVIDIA NeMo Guardrails (behavior limits)
Traceability and audit	IBM watsonx.governance, ServiceNow AI Control Tower
Cost and consumption	Native cost tools from AWS, Azure and Google Cloud applied to AI services

An agent’s autonomy isn’t granted by its technical capability. It’s granted by the risk the company is willing to take.

Market concentration is a continuity risk

According to the infographic itself, ten vendors hold about 40% of the market. And most platforms push you to build agents inside their ecosystem: Amazon Bedrock AgentCore on AWS, Vertex AI Agent Builder on Google, Azure AI Foundry on Microsoft, OpenAI’s Agents SDK. Each with its own models, connectors and orchestrator.

That’s convenient in year one and expensive in year three. A change in pricing, data policy or regional availability can leave critical processes without a plan B.

Three decisions reduce that exposure:

1. Separate process logic from the model. Business rules should live in your orchestration layer, not inside a prompt hosted in the vendor’s console.
2. Prefer open interoperability standards. MCP (to connect agents to tools and data) and A2A, backed by Google (for agent-to-agent communication), are already supported by several of the big names on the map. Require your platform to support them.
3. Demand an exit clause. Export of configurations, logs and data in usable formats, within defined timeframes.

For a Latin American company there’s one more factor: data residency and support in the right time zone. The fact that the map includes European options like Mistral AI or OVHcloud shows that data sovereignty is already a buying criterion in other regions. It should be here too. An agent incident at 3 a.m. in Quito or Bogotá can’t depend on a team that answers on another continent’s schedule.

The integrator implements; you remain accountable

The bottom tier of the cylinder is full of consultancies and integrators: Accenture, Deloitte, TCS, Infosys and Globant, the only name of Latin American origin on the map. They’re necessary: they bring accelerators, talent and experience from previous implementations.

But an integrator can’t own your agentic governance. Their incentive is to get agents into production; yours is that those agents don’t trigger a regulatory incident in two years.

Before signing, require the contract to include knowledge transfer, documentation of every agent (purpose, permissions, thresholds, business owner) and handover of the monitoring dashboards to your team, not to a vendor account.

A 90-day plan before your first agent in production

1. An honest inventory. List the agents and copilots that already exist, including those business units switched on inside SaaS tools. Enterprise architecture platforms like SAP LeanIX or ServiceNow’s own CMDB can serve as the registry. There are almost always more agents than IT thinks.
2. Pick two or three candidate processes. Choose high-volume processes with clear rules and reversible errors. Measure their cost, time and error rate today, ideally with process mining.
3. Autonomy matrix. Together with risk and the business, define which decisions the agent can make alone, which require approval and which are forbidden.
4. Minimum controls. Its own identity, a decision log, a consumption budget and a tested way to switch the agent off.
5. A pilot with exit criteria. Before starting, agree on which result justifies scaling and which forces you to stop. Write it down.
6. Choose the vendor last. With processes, controls and metrics defined, comparing platforms becomes objective and short.

What a skeptical manager will ask

“Aren’t we falling behind while we set up all this governance?” The real risk isn’t arriving late to a pilot: it’s arriving fast to an incident. The controls described above are weeks of work, not quarters, and they speed up the second and third implementations because you no longer have to negotiate from scratch each time.

“The big vendors already come with built-in governance.” They come with governance tools, and some are good, as the table above shows. What they don’t bring are your policies, your risk thresholds or your map of who is accountable. The tool executes governance; it doesn’t define it.

“Our volume doesn’t justify this much process.” Then start with a single agent and a minimum version of the four pillars. What you shouldn’t do is skip the baseline: without it, you won’t be able to show finance that the agent created value, and the project will be the first to go in the next budget cut.

The vendor changes; the base doesn’t

The infographic’s cylinder will keep filling up with logos. Some will disappear, others will merge and new ones will arrive. Product names will change almost every quarter.

What won’t change is the base: clear processes, reliable data, people who know when to step in and a chain of accountability that holds up to an audit. The companies that build it first will be able to switch vendors without changing course.

The vendor is a purchasing decision; governance is a leadership decision.

Your first step this week: ask your team for an inventory of every agent and copilot able to act that already operates in the company, with its business owner, its permissions and the platform it lives on. If the list is incomplete or has empty owners, you already know your first agentic AI project.

Sources

• Infographic “The Global Players in Agentic Operating Model”. According to the piece itself, based on public research, analyst reports and corporate websites; market shares are 2025 estimates.
• Gartner — “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027”. Press release, June 25, 2025.
• Official websites of the vendors mentioned (Microsoft, Salesforce, SAP, Oracle, IBM, ServiceNow, UiPath, Celonis, Workday, NVIDIA, AWS, Google, OpenAI).