The Governance Gap Behind Agentic AI's Fast Rollout

Adoption Has Lapped Governance

EY's September 2026 survey of 202 executives found that 91% are already piloting or deploying agentic AI: systems that do not just answer a question but take an action, such as approving a refund, rebalancing a queue, calling another system, or writing to a database. The same research found that governance has not kept pace with that rollout. Most of the organisations surveyed are running live agents without having first settled, in any formal or enforced way, what those agents should actually be allowed to do.

McKinsey's 2026 trust survey describes the same shape from a different angle. Asked what is actually slowing agentic AI from moving beyond pilots into real scale, executives put security and risk at the top, ahead of cost, talent, or model quality. Two separate pieces of research, one measuring how fast agents are going in and the other measuring what stops them going further, point at the same underlying gap: decisions about adoption and decisions about permission are being made on different timelines, by different parts of the business, often without either side fully aware of the other.

What the Gap Looks Like Inside a Company

In practice, the gap rarely arrives as one bad decision. It builds up from a series of individually reasonable ones. A team wants an agent to triage support tickets, so it is given read access to the ticketing system, then write access so it can close tickets, then access to the customer database so it can check order history, then an API key with broader scope than anyone intended because the narrower one kept failing in testing. Research into AI agent security from Gravitee describes this as a structural feature of how these systems get built, not a one off oversight: agents accumulate access incrementally, each grant looks small in isolation, and nobody sees the full footprint until someone finally stops to ask what the agent can actually reach.

That footprint is usually assembled under deadline pressure, by people solving an immediate problem rather than answering the harder one: what, specifically, should this agent be authorised to do, against which systems, under which conditions, and who is accountable for that answer once it is live and acting without a human reviewing each step. EY's finding that 91% of organisations are already piloting or deploying while governance lags is the aggregate version of exactly this pattern, repeated across teams faster than any central function can track.

Why Security Has Become the Scaling Bottleneck

McKinsey's finding that security and risk now sit above every other barrier to scaling agentic AI makes sense once the access footprint problem is visible. A chatbot that gives a wrong answer is embarrassing. An agent with write access to a production system, a payment queue, or a customer record that takes the wrong action is a different category of problem, because the permission to act was already granted before anyone reviewed the specific decision. Scaling multiplies that exposure rather than diluting it: ten agents each quietly over provisioned is not ten times the convenience, it is ten times the surface area nobody has fully mapped.

This is also why the gap is not a paperwork problem a policy document can close on its own. A written AI policy that was never wired into the actual permissions an agent holds does not change what that agent can do at two in the morning when no one is watching. Closing the gap means the authorisation boundaries have to live inside the system itself, not in a slide produced after the agents were already running.

What Closing the Gap Actually Requires

Architecturally, the fix starts further back than most teams expect. Before any agent is given access to anything, someone has to know what data and systems exist, what each one is for, and how sensitive it is. Most organisations cannot answer that cleanly, because the data they are about to connect an agent to was accumulated over years across departments that never agreed on a shared classification. Agent permissions end up layered onto a foundation nobody actually mapped first.

This is the specific problem our AI Readiness assessment is built to address at Mickai. Before any agent, ours or anyone else's, is connected to a company's historic data, we work through classifying and permissioning that data first: what it is, who it belongs to, what it is sensitive to, and what an autonomous system should and should not be allowed to touch. We also build our own Sovereign Intelligence Operating System around staged authorisation, so an agent's permissions are granted step by step against defined conditions rather than all at once, with an audit record of what was authorised, when, and by whom. We are not suggesting that architecture alone resolves the gap EY and McKinsey describe. It is a design principle aimed at the same category of problem: making permission decisions deliberate and recorded before access is granted, rather than reconstructed afterwards from whatever an agent happened to be able to reach.

None of this requires slowing adoption to a crawl. It requires sequencing: classify before connecting, define boundaries before granting access, and keep a record that can be checked rather than assumed. Taken together, the EY and McKinsey findings describe an industry that adopted first and is now discovering, survey by survey, that the second step was never optional.

Sources

• EY, 'EY survey finds that autonomous AI implementation outpaces oversight, yielding an AI governance gap', ey.com (September 2026).
• McKinsey & Company, 'State of AI trust in 2026: shifting to the agentic era', mckinsey.com (2026).
• Gravitee, 'State of AI Agent Security', gravitee.io (2026).