The Agentic AI Trust Race: Why More Autonomy Is Losing to More Control

Most of the enterprise agentic AI conversation over the past two years rested on a single, mostly unexamined assumption: give an agent more room to plan, decide, and act on its own, and it performs better. That assumption is now being stress-tested in live production environments, and the results are not kind to it. Two figures from 2026 research capture the scale of the miss. Gartner forecasts that more than 40% of the agentic AI projects running today will be cancelled before 2028 — not because the underlying models fall short, but because of runaway cost, unclear business value, and risk controls that were never built. McKinsey's 2026 AI Trust Maturity Survey lands in the same place from a different angle: agentic deployment is accelerating in every industry it measured, yet average responsible-AI maturity sits at only 2.3 out of 4, with roughly three in ten organisations reaching a governance maturity of three or higher. A third data point rounds out the picture and probably deserves more attention than it gets — against thousands of products marketed under the agentic AI label, Gartner's own count finds real autonomous capability behind only around 130 of them. Most of what enterprises are buying under that name is automation, or a chatbot, wearing this year's terminology.

Put the three together and a specific failure pattern emerges, distinct from the usual "AI hype cycle" story. It is not that agentic AI doesn't work. It is that capability and control have been allowed to drift apart, and the projects getting cancelled are disproportionately the ones that let an agent's scope grow faster than anyone built the guardrails for it. The TRUST framework's second principle — that AI accelerates work but does not inherit accountability for it — was written for credit decisioning, but the same logic explains why the enterprises actually getting value from agentic AI right now are rarely the ones with the most autonomous agents. They are the ones that scoped each agent to a specific responsibility and left the authority for anything consequential with a human or a hard-coded boundary.

What it looks like when an enterprise closes that gap deliberately is worth naming, because it is rare enough to stand out. Visa's president of technology, Rajat Taneja, described at VB Transform 2026 how the company turned Anthropic's Mythos loose on its own payment network as an internal red-team exercise. The model chained together a set of individually minor weaknesses into exploit paths a human review would likely have missed. Visa's response was not to quietly patch and move on — it open-sourced the harness that had governed the exercise, so other institutions could run the equivalent hunt against their own systems. That is a rare combination: enough engineering depth to let a highly capable model probe your own infrastructure, and enough governance maturity to trust and act on what it found.

Most enterprises are nowhere close to that combination, and the numbers show exactly where the gap sits. Just over half of enterprises, 53%, have already had an agentic security incident or a near-miss. Sixty-five percent enforce agent permissions at runtime — a control that is comparatively cheap to stand up. But only 18% isolate their highest-risk agents, and a mere 8% do both together. Runtime enforcement tells a system what an agent is allowed to attempt. Isolation is the separate, harder-to-build layer that limits the damage when enforcement misses something, or when an edge case nobody scoped for shows up. Building the first without the second is precisely why an enterprise can report both a high incident rate and high confidence in its own controls at the same time — most teams have genuinely tested what their permissions block, and never tested what happens once those permissions are wrong.

That specific gap — watched but not contained — is the same incomplete half of resilience the CLEAR framework calls out for credit decisioning AI systems: monitoring an AI system is not the same capability as being able to stop it. Seen through that lens, the 40% cancellation figure and the 2.3-out-of-4 maturity score stop looking like two unrelated statistics about a hyped technology cooling off, and start looking like a single, fairly ordinary governance failure, playing out at industry scale.

None of this is an argument against agentic AI, or even against ambitious scope for what an agent is allowed to do. It's an argument that the competitive question for 2026 and 2027 was never going to be who builds the most capable agent. It's who can get an agent approved for production by risk, legal, and compliance — and keep it approved once real traffic hits it. That is a containment problem wearing a capability problem's clothes — exactly the gap an Atimitra guardian layer is designed to close permanently. The enterprises treating it as such are the ones likely to still be running their agentic AI programme when Gartner's cancellation forecast comes due.