Agentic AI vs AI Agents: Judge Blast Radius, Not Brains

In agentic AI vs AI agents, the split is scope: an AI agent does one defined job with tools and stops, while agentic AI decomposes a goal, re-plans as conditions change, and coordinates several agents toward it. Neither label should decide your architecture or your controls.

Our position is narrower, and it disagrees with most of what ranks for this query. The distinction is real, but almost nobody is arguing about it usefully, because the argument is framed around intelligence when the thing that actually costs money is reach. What a system can touch, whose credentials it acts under, and how far a bad decision travels before a person sees it: those three answers change your security review, your budget and your audit obligations. Whether the vendor says "agent" or "agentic" changes none of them.

The clearest version of the frustration came from a Hacker News reader in a June 2025 thread about press coverage of Gartner's cancellation forecast. Quoting the passage on vendor rebranding, baobun asked: "What really differentiates 'real agentic' from 'slapped IFTT and an LLM together'?" No reply landed a definition a procurement reviewer could use. This article is an attempt at one, and it answers a different question than the definitional one.

The short answer: Treat "agentic" as a claim about reach, not intelligence, and set controls by autonomy level rather than by product category, because Gartner found in May 2026 that applying uniform governance across agents regardless of autonomy is itself a leading cause of enterprise agent failure.

Last updated: July 30, 2026.

The four levels, and the controls each one earns. Nothing is subtracted as autonomy rises.

One disclosure first. We did not run a controlled agent deployment for this article, so nothing below is presented as a first-hand test result. What we did do is re-verify every number at its primary source and check each one for a newer edition. That confirmed the most-quoted forecast in this topic as still current, and it corrected three things that are widely repeated at stale values: a benchmark score, a set of regulatory dates, and the size of the threat taxonomy most agent security reviews are built on. Each correction is flagged where it appears.

What each term actually denotes

An AI agent is a program that uses a model as its reasoning engine to complete a scoped task: read the ticket, classify it, look something up, draft a reply. Agentic AI describes systems where that pattern is composed. The academic taxonomy by Sapkota, Roumeliotis and Karkee ran in Information Fusion in 2025 and is open as arXiv:2505.10468. It describes AI Agents as "modular systems driven and enabled by LLMs and LIMs for task-specific automation". Agentic AI it calls "a paradigm shift marked by multi-agent collaboration, dynamic task decomposition, persistent memory, and coordinated autonomy."

That is a fair summary of the consensus, and it is where most treatments of agentic AI vs AI agents stop. The reader leaves with a vocabulary lesson and no decision.

Be equally clear about what neither term means. Neither is a synonym for a chatbot, and neither implies a model that learns from your data in production. An agent is not defined by having a friendly interface. And "agentic" is not a level of intelligence you can buy; it is a description of how much of a plan the software is allowed to own.

The most useful engineering cut is older than the current vocabulary and does not use the word "agentic" as a product category at all. Anthropic's December 2024 Building effective agents splits everything into two: workflows are "systems where LLMs and tools are orchestrated through predefined code paths", and agents are "systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks". The word "agentic" appears there as an umbrella over both.

Notice what that cut is actually about. It is not intelligence. It is who owns the control flow. If a human wrote the sequence of steps in advance, you have a workflow, and you can reason about its worst case by reading the code. If the model decides the sequence at runtime, you have an agent, and its worst case is bounded only by what it can reach. That is the boundary with operational consequences.

Why the definition fight is unwinnable

The agentic AI vs AI agents argument cannot be settled: the two most authoritative vocabularies cut the space along different axes and both are correct. The academic taxonomy separates by architecture: one agent versus many collaborating. The engineering literature separates by control flow: predefined path versus model-directed. A procurement questionnaire built on either account of the difference between AI agents and agentic AI will pass products the other would flag.

The security community sidestepped the argument entirely, and that is the tell. OWASP's Agentic AI - Threats and Mitigations, first published in February 2025 by its Agentic Security Initiative and now at version 1.1 of December 2025, states plainly that "providing a detailed definition and architecture of agentic AI is beyond the scope of our work". It then does something more useful than defining anything: it builds a taxonomy navigator that asks six questions about what the system can do, and routes you to the threats that apply based on your answers.

That is the move worth copying. The people whose job is to be right about consequences gave up on the noun and inventoried the verbs.

There is a good counterargument to the whole framing, and it comes from inside the field. In that same Hacker News thread, a reply to baobun offered the cleanest short answer anyone gave: pre-defined execution paths through a graph are deterministic, while agents "design the execution path on the fly", making them non-deterministic. Baobun's response was that this describes software that has existed for over a decade, naming networks of trading bots and airline price-setting systems. He has a point. If the definition is "non-deterministic software with an execution engine", a great deal of pre-LLM automation qualifies, and the word carries no information.

We think that objection is right about the word and wrong about the situation. What is new is not non-determinism. It is that the non-deterministic component now accepts natural language from untrusted sources, holds live credentials to business systems, and can be instructed by the data it reads. A trading bot cannot be argued into emailing your customer list. An LLM-driven agent with a mail tool can, and NIST has measured how easily.

Agent washing: separating a new capability from a new label

Gartner named the pattern in a June 2025 press release: "agent washing", defined as "the rebranding of existing products, such as AI assistants, robotic process automation (RPA) and chatbots, without substantial agentic capabilities". In the same release Gartner estimated that "only about 130 of the thousands of agentic AI vendors are real", and predicted that over 40% of agentic AI projects would be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls.

A note on currency, since this number is quoted constantly. We checked for a newer edition. The 40% figure still stands as published in June 2025. Gartner then returned to agent washing in a May 2026 release on supply chain planning, where Senior Director Analyst Jan Snoeckx said the priority "is not full autonomy, but building the operational discipline, architectural flexibility and decision frameworks that allow agentic AI to scale as the technology matures".

That 2026 release contains the most usable test we found anywhere, and it is a test of behaviour rather than branding. Gartner's caution to buyers is that "many current offerings do not independently re-sequence objectives, negotiate trade-offs or adapt execution logic". Turn those three clauses into three demands and you have a demo script.

One practical note on running that script: bring your own broken tool and your own pair of conflicting constraints to the call. A demo the vendor prepared proves the vendor can prepare a demo.

The same release warns that "vendors claiming end-to-end autonomous supply chain planning before 2027 are overstating what is possible in the near term". Read that as a general dating rule. A claim of end-to-end autonomy today is a claim about a roadmap, and it should be priced as one.

There is an honest reason so many products sit below the line. Almost nobody wants software that invents its own objectives; buyers want dependable execution of objectives they set. A product that is really a very good workflow with a language interface is often the correct product. The problem is that it gets sold under a word implying a different risk profile, and the review that word triggers is either wastefully heavy or dangerously light.

Side by side: the differences that change what you do

Most agentic AI vs AI agents tables contrast autonomy, learning and complexity. Those are real differences that change nothing about your Monday. Here is the same comparison restricted to rows that change a decision, a control or a line item.

Every row after the first is a consequence of the first. Control flow sits upstream of identity, cost, evidence, rollback and oversight, and it is the only row a product category reliably tells you about.

The Blast-Radius Inventory: eleven questions, one sitting

Here is the diagnostic. It takes under an hour per system, needs no vendor cooperation for the first six questions if you have a network trace or an integration list, and produces a tier rather than an adjective. We call it the Blast-Radius Inventory, and the naming is deliberate: the output is a radius, not a verdict about how clever the software is.

Questions 1 to 6 are OWASP's six navigator questions, condensed for the table from the Agentic AI - Threats and Mitigations taxonomy navigator, which phrases them as steps about "the AI agent" and "the AI system". Questions 7 to 11 are ours, and they are the ones a security or procurement reviewer will ask that no capability rubric covers.

Score it plainly. Answering yes to question 3 puts you above the line where an incident becomes an action rather than a wrong answer. Yes to 6 brings in a threat class that single-agent controls do not address. And a no anywhere in 7 through 11 is a governance gap that will be discovered by an incident rather than a review, which is precisely the failure Gartner quantified in May 2026.

Two of the questions need a concrete check, because they are easy to answer optimistically. For question 9, ask where the deny decision is evaluated: if the only thing standing between the agent and an action is text in its system prompt, there is no policy layer, because a model can be talked out of its instructions and a proxy cannot. For question 3, ask for the list of attached tools and their scopes as configuration rather than as prose; in 2026 that usually means an MCP server manifest, and reading it is faster than any questionnaire.

Here is the inventory filled in for an illustrative case, so the output shape is clear. This is a constructed example, not a deployment we observed.

That system is Level 2 on capability and unmanaged on governance, which is the most common real shape. Nothing about it is dangerous today. Everything about it becomes dangerous the week someone adds a send tool, because questions 7 through 11 all still read no and nobody will revisit them for a feature that "just automates the last click".

Two things about this inventory are worth stating honestly. It is a structuring device rather than a validated instrument; nobody has run it across a population of deployments and measured whether the tiers predict incidents. And questions 7 through 11 reflect what we build, so treat them as a position rather than a neutral finding. Both caveats also apply to every capability rubric published by every vendor in this category, including the ones that do not say so.

Four autonomy levels and the controls each one earns

The AI agent autonomy levels this section is built on come from a May 2026 Gartner press release. Its headline finding is this article's argument, stated by an analyst firm. "Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure," said Shiva Varma, Senior Director Analyst. Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps found only after production incidents.

The failure in agentic AI governance is symmetrical, which is why "just be strict" is not the fix. Varma named both directions: "over-restriction of simple agents, which slows delivery and drives shadow development, or under-restriction of more autonomous agents, which increases operational, security and compliance risk". Over-restriction does not produce safety. It produces a second, invisible estate of AI that nobody reviewed, which is the same dynamic behind shadow AI generally.

Gartner's prescribed remedy is proportional governance: classify agents across distinct autonomy levels, each of which represents "a different trust boundary and corresponding governance requirements". Trust boundary is the useful unit, because it is defined by what sits on the far side of it rather than by how sophisticated the caller is. Two agents with identical decision logic sit at different levels if one can only read and the other can send.

Here are the four levels with a verdict block each. Level names and the control recommendations are Gartner's; the "buy it when" and "the trap" lines are our reading.

Level 1: Observe. Read-only access to defined data sources, with output visible only to the requesting user. Document summarisation, retrieval, code explanation.

• Controls it earns: scoped data access, user authentication, usage logging, basic functional and security testing. Gartner's guidance is that controls here "should remain lightweight and targeted" because risk is limited to data exposure and output accuracy.
• Buy it when: the job is finding and condensing things people already have permission to read.
• The trap: scoping the read too widely. A summariser pointed at an entire document store inherits every access mistake in it.

Level 2: Advise. Generates recommendations, drafts or proposed actions; humans review everything and execute manually. Read-only, no write access anywhere.

• Controls it earns: everything from Level 1, plus accuracy and hallucination testing, domain-specific quality evaluation, and user training on appropriate reliance.
• Buy it when: the bottleneck is producing a first draft, and a competent reviewer is already in the loop for other reasons.
• The trap: automation bias. Gartner's phrasing is that advisory agents "can anchor judgment, creating downstream risk when inaccurate outputs are trusted". The reviewer who approves 200 drafts a day is not reviewing.

Level 3: Act with approval. Executes real actions such as writing data, sending communications or modifying configuration, but only after explicit human approval for every action.

• Controls it earns: Level 2 plus strong security testing, approval workflows with audit trails, and agent-specific incident response procedures.
• Buy it when: the action is reversible, the approver is accountable for the outcome anyway, and volume is low enough that reading each request is realistic.
• The trap: approval fatigue, which OWASP catalogues as its own threat, T10, "Overwhelming Human-in-the-Loop". Gartner puts it directly: without those controls, "approvals can degrade under time pressure or approval fatigue, creating a false sense of safety while expanding the attack surface". An approval queue nobody can keep up with is worse than no queue, because it launders responsibility.

Level 4: Act autonomously. Executes independently inside defined guardrails; humans review exceptions, audit logs and aggregate outcomes rather than individual decisions.

• Controls it earns: continuous monitoring, enforced guardrails, rapid rollback, "circuit breakers that halt agent operation on threshold violations", and clear ownership for agent behaviour.
• Buy it when: the action is high-volume, low-consequence, measurable, and reversible in bulk. Gartner's parallel advice to supply chain buyers is to start with "well-defined, high-volume planning activities where impact is measurable and the cost of error is low".
• The trap: assuming you are here because the vendor says so. On the evidence in this article, very little shipping software operates at Level 4 in the sense Gartner defines, and the honest posture for most buyers in 2026 is Level 3 with a credible path upward.

The important structural property is that the levels are cumulative. Nothing is subtracted as autonomy rises. If a vendor's Level 4 story does not include everything their Level 1 story included, the story is incomplete.

What actually changes when a system is genuinely agentic

This is the question popular comparisons raise and drop. Suppose the claim is true and you bought something genuinely agentic. Six things change, each with a concrete control attached.

The threat surface gains classes, not degrees. OWASP's taxonomy runs T1 to T17 in the current edition, version 1.1 of December 2025. T1 through T11 describe things that can go wrong with a single capable agent: memory poisoning, tool misuse, privilege compromise, resource overload, cascading hallucination, intent breaking and goal manipulation, misaligned and deceptive behaviours, repudiation and untraceability, identity spoofing, overwhelming human-in-the-loop, and unexpected remote code execution. Three sit behind the navigator's sixth question and exist only once agents talk to each other: T12 Agent Communication Poisoning, T13 Rogue Agents in Multi-Agent Systems, and T14 Human Attacks on Multi-Agent Systems, which OWASP describes as adversaries exploiting inter-agent delegation and trust relationships to escalate privileges. T15 Human Manipulation applies wherever an agent talks directly to people rather than only to other agents. Crossing from one agent to several does not make the existing risks worse by a factor. It adds a category your single-agent controls were never designed to see.

Two of the seventeen were not in the February 2025 edition at all. T16 Insecure Inter-Agent Protocol Abuse covers flaws in the protocols agents use to reach tools and each other, naming MCP and A2A directly, and T17 Supply Chain Compromise covers poisoned models, libraries and build environments reaching the agent through its dependencies. A threat taxonomy that grew by two classes in ten months is itself a data point about how settled this area is. If you are working from a printout of the February version, the two newest classes are the ones your review will not ask about.

The first six inventory questions, and what each yes brings into scope.

IBM Technology's nine-minute walkthrough, "Top 10 Security Risks in AI Agents Explained", covers this territory from a practitioner angle if you want the spoken version before reading the taxonomy itself.

Injection stops being a content problem and becomes an action problem. NIST, working with the UK AI Security Institute, defines agent hijacking as "a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent, causing it to take unintended, harmful actions". In a January 2025 technical blog NIST's AI standards centre, red-teaming with the UK institute, reported that attack success rose from 11% for the strongest previously known attack to 81% for the strongest attack its team built against the model itself. The target was Anthropic's upgraded Claude 3.5 Sonnet, which the AgentDojo benchmark had rated among the best models at resisting hijacking. The new attacks were developed against one AgentDojo environment and tested on held-out tasks, then carried over to the other three environments without being rebuilt. That is a seven-fold rise from adversarial prompt engineering alone, against a model with a strong security reputation. Separately in the same work NIST extended the benchmark to three higher-consequence categories it had not covered: remote code execution, database exfiltration and automated phishing. The model tested was the October 2024 build, so do not read 81% as today's number for today's models. Read the finding as being about method: adversarial optimisation transfers, and a defence validated against known attacks has not been validated against the next ones. The control is not a better prompt. It is that the tools reachable from untrusted input must be the ones you are willing to lose.

Identity becomes the primary boundary. OWASP notes that agents "often operate under NHIs when interfacing with cloud services, databases, and external tools", and that "unlike traditional user authentication, NHIs may lack session-based oversight". The scale is no longer theoretical. Palo Alto Networks' 2026 Identity Security Landscape reports machine identities at 109 per human in the enterprise, up from 82:1 the previous year, with 99% of organisations having adopted AI agents and 40% of those agents already holding access to organisational data. An agent without an owner, a scope and an expiry is a credential you cannot offboard, which is the argument we made at length in our earlier analysis of non-human identity. Least privilege is not a new idea here; what is new is that the thing holding the privilege negotiates its own tool use at runtime, so the scope has to be right before the run rather than argued about after it.

Cost stops tracking volume. Anthropic's June 2025 engineering write-up on its multi-agent research system reports that "agents typically use about 4x more tokens than chat interactions" and "multi-agent systems use about 15x more tokens than chats". The same post notes that "token usage by itself explains 80% of the variance" in performance on their evaluation. Read those two sentences together and the economics are stark: the capability is largely bought with tokens, so a system that plans its own work has a spend profile set by plan length rather than by request count. A per-agent ceiling denominated in currency, with a hard stop, stops being a nice-to-have.

For a rough absolute anchor rather than a multiplier, TheAgentCompany leaderboard publishes an average cost in dollars beside most submissions. Across the 15 of its 18 entries that report one, checked on 30 July 2026, the figures run from $0.28 to $6.78 per task depending on the model and the scaffold around it. Those are averages over 175 tasks inside one simulated company, so read them as an order of magnitude, not a quote. This article does not price vendor licences, because the licence is rarely the surprising line. The surprising line is a plan that decided to think harder.

Evidence requirements expand from output to reasoning. For a bounded agent, the record of what happened is input, output and tool calls. For a planning system, the useful record includes the plan, each revision of the plan, messages between agents, which approval gates fired, and what was refused. That last item is the one most often missing and the one an auditor asks for first, because a log of successful actions cannot demonstrate that a control was working. Auditability, in other words, is not a checkbox a vendor either has or lacks; it is a question of whether the record contains refusals. We have written separately about what belongs in an agent action audit trail.

Failure gets quieter. A bounded task fails loudly, because the output is missing or wrong. A multi-step plan can complete while a middle step went wrong, and the visible result looks fine. The Berkeley-led study Why Do Multi-Agent LLM Systems Fail? is the strongest evidence on this. Its authors annotated over 1,600 traces across seven multi-agent frameworks and built the Multi-Agent System Failure Taxonomy from close analysis of 150 of them, with inter-annotator agreement of kappa 0.88. They identify 14 distinct failure modes in three categories: system design issues, inter-agent misalignment, and task verification. Two of those three categories describe coordination rather than capability, and no amount of model improvement addresses them directly.

The failure evidence: what breaks, and how often

The honest summary of the current evidence is that bounded agents work about as well as the literature says, coordination is where things break, and the gap between demonstration and production is wide but narrowing measurably.

The most-cited benchmark for real work is TheAgentCompany from Carnegie Mellon and collaborators, which drops agents into a simulated software company with internal sites, a chat system and a code host. The paper, arXiv:2412.14161, reports that "the most competitive agent can complete 30% of tasks autonomously". That figure is widely quoted, including in press coverage that translated it into agents getting office tasks wrong 70% of the time.

Here is the first of two currency corrections: the paper's number is not the current number. The project's live leaderboard shows the top entry at 46.3% of its 175 tasks resolved, submitted 25 June 2026, against 33.1% for the best entry dated June 2025. Anyone citing 30% in mid-2026 is citing an eighteen-month-old measurement of a fast-moving thing. Anyone citing 46.3% as evidence that agents are ready for unsupervised work is reading a benchmark as a deployment guarantee. The defensible reading is that autonomous completion of realistic multi-step office work has gone from about a third of tasks to just under half in a year, and still fails the majority of the time.

Transparency about what any of this means is itself thin. The 2025 AI Agent Index, which documented 30 state-of-the-art deployed agents using public information and correspondence with developers, found "different transparency levels among agent developers" and observed that "most developers share little information about safety, evaluations, and societal impacts". If you are struggling to assess a vendor's claims, the reason is partly that the information you would need is not published. That is a finding, not a failure of your process.

Almost everything above is a forecast or a benchmark. The one large survey measurement worth setting beside them cuts against the urgency of the whole debate. McKinsey's state of AI in 2025, published 5 November 2025, reports that "twenty-three percent of respondents report their organizations are scaling an agentic AI system somewhere in their enterprises", with a further 39% experimenting, and that "in any given business function, no more than 10 percent of respondents say their organizations are scaling AI agents". Read the second sentence twice. Enterprise-wide agent adoption is mostly one function deep. The argument about what to call these systems is running well ahead of the number of places they actually run.

A note on how these sources were obtained, since it bears on what you should trust. Gartner, ISO, McKinsey and the Council of the EU all refuse automated requests and had to be read directly in a browser; the OWASP taxonomy was read from its primary PDF rather than its landing page, which is how the version discrepancy above surfaced. No figure here is quoted from a secondary summary.

Choose a bounded agent, an orchestrated workflow, or a multi-agent system

Three architectures, three verdicts. Match the shape of the work, not the label on the box.

Choose a bounded AI agent if the job has a stable definition, a clear success test, and a small tool set. Ticket classification, document extraction, first-draft generation, retrieval with citations. This is where the evidence is strongest and the controls are cheapest, and it is where most value is currently being captured. It is also the correct answer far more often than the market's vocabulary suggests.

Choose an orchestrated workflow if the work spans several systems but the sequence is knowable in advance. You get most of the reach with a control flow you can review before deployment, plus the ability to put a human gate at exactly the step that matters. Gartner's supply chain guidance points the same way: traditional automation still suits "repetitive, low-complexity tasks", while current agents "can support high-volume, medium-complexity planning actions where risk is low". If you can draw the flowchart, do not buy a planner.

Choose a multi-agent system if the sub-problems are genuinely independent, the search space is large, and the answer is worth many tokens. Task modularity is the precondition, not a nice property: if the pieces cannot be handed out separately, splitting them across goal-oriented agents adds coordination cost and buys nothing. Anthropic's guidance from building one is specific about the inverse case: "some domains that require all agents to share the same context or involve many dependencies between agents are not a good fit for multi-agent systems today", and "most coding tasks involve fewer truly parallelizable tasks than research". Their own multi-agent configuration outperformed single-agent Claude Opus 4 by 90.2% on their internal research evaluation, at roughly 15 times the tokens of a chat. That is a good trade for research and a bad one for a task a workflow could have done.

If you cannot answer questions 7 through 11, that is not automatically a reason to buy nothing. It is a reason to stay at Level 1 or Level 2, where nothing writes, sends or spends, while the identity and budget work happens in parallel. Reading and drafting deliver real value and buy you the operational knowledge you will need at Level 3.

When the incumbent still wins. If you already run a rules engine, an RPA estate or a scheduled ETL job that does the work correctly, the agentic version is usually a downgrade dressed as a modernisation. Deterministic systems have properties that are hard to reacquire: identical output for identical input, a worst case you can read off the source, and a debugging story that does not involve reconstructing a plan from logs. The honest case for replacing them is that the input is unstructured or the branching is unbounded. "It would be more modern" is not a case. And the pilots that stall are frequently the ones that replaced something working, which is a pattern we examined in why AI pilots stall before production.

What regulators require regardless of the label

No regulation currently distinguishes "agentic AI" from "AI agents", and none is likely to, because the obligations attach to use and risk rather than to architecture. Arguing about the category buys nothing in a compliance review. The concrete duties are already specific.

Under the EU AI Act, Article 14 requires that people assigned human oversight of a high-risk system be enabled to do several specific things. Two matter most here. They must be able "to decide, in any particular situation, not to use the high-risk AI system or to otherwise disregard, override or reverse the output". And they must be able "to intervene in the operation of the high-risk AI system or interrupt the system through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state". Article 14 also names automation bias: overseers must "remain aware of the possible tendency of automatically relying or over-relying on the output". A high-risk Level 4 deployment without a working stop mechanism does not satisfy that, whatever the vendor calls it.

Article 26 puts duties on deployers rather than builders, which is where most companies reading this actually sit. Deployers must "take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use", must "assign human oversight to natural persons who have the necessary competence, training and authority", and must keep the system's automatically generated logs "for a period appropriate to the intended purpose... of at least six months". Two qualifications, because this gets over-applied. These duties bind only where the system falls inside a high-risk classification, so most internal drafting assistants are out of scope. And the logs in question are the ones the system generates automatically, not a bespoke audit trail you build. Even so, the six-month clause is the one to design for now: retention and schema are much cheaper decided before deployment than retrofitted, and a system that gets reclassified after you built it is the expensive case.

On timing, here is the second currency correction. The dates moved, and a great deal of guidance still online is working from the old ones. In a 7 May 2026 press release the Council of the EU set out a provisional agreement on the simplification package which "introduces a fixed timeline for the delayed application of high-risk rules: the new application dates would be 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products". Provisional is the operative word; the agreement still has to be formally adopted. Our guide to EU AI Act compliance for deployers covers the sequencing in more detail.

Two voluntary frameworks are worth knowing by name because auditors and enterprise buyers ask for them. ISO/IEC 42001:2023, titled "Information technology — Artificial intelligence — Management system", is the first international AI management system standard and specifies requirements for establishing and maintaining an AI management system. NIST's AI Risk Management Framework 1.0, released January 2023, is explicitly "intended for voluntary use" and organises work into four functions: Govern, Map, Measure and Manage. Neither mentions agentic AI as a category. Both give you a place to record the answers from the Blast-Radius Inventory in a form an assessor recognises.

Where this framing is still uncertain

Several parts of the argument above are positions, not settled facts. Here is which.

The Blast-Radius Inventory has not been validated. It is assembled from a published threat navigator and our own procurement experience, and nobody has run it across a population of deployments to test whether the tiers predict incidents. Treat it as a structuring device that makes disagreements explicit, not as a scoring instrument.

The AI agent autonomy levels model may be too coarse in one direction and too fine in another. A single system frequently spans levels: a research agent that reads freely (Level 1) but drafts an email for approval (Level 3) is not one tier, and Gartner's classification does not say how to handle a system whose level varies by action. In practice we score per action class rather than per system, which is an extension of the model, not something the source supports.

The benchmark evidence is narrow. TheAgentCompany simulates a software company, which flatters agents on code-adjacent work and tells you little about regulated processes, physical operations or anything with an external counterparty. The 46.3% figure is one submission on one leaderboard, and leaderboard entries are self-reported.

The failure statistics are forecasts. Gartner's 40% cancellation and 40% demotion figures are predictions, not measurements, and forecasts from analyst firms are directional. They are useful because they name mechanisms, escalating cost, unclear value, inadequate risk controls, governance gaps found after incidents. Cite the mechanisms, not the percentages.

The term may collapse. It is entirely possible that within two years "agentic" means nothing at all, in the way "cloud-native" and "digital transformation" now mean nothing, and that products are described by what they can touch instead. That would be a good outcome, and it would make this article's framing conventional rather than contrarian.

We have no first-hand measurement of our own to offer on the central question, and no comparative test of named agent frameworks. Where we have relied on argument rather than evidence, the argument is above and can be attacked directly.

How we draw the boundary at LeapForce

One section about our own product, and the boundary is narrow: LeapForce does not sell you an agent that does your job. We build the layer underneath, which is the layer questions 7 to 11 are about. Once work moves from a person to software, the operative questions become who owns this thing, what can it reach, what did it do, and what did it cost.

Three parts of how we build map onto the argument above. Agents get first-class non-human identity: every AI Coworker is created through the lifecycle Build, Scope, Review, Share, Improve, where Scope assigns a named owner, the minimum connector permissions, a model policy and a budget before the thing is shared with anyone. Policy is evaluated outside the prompt: our AI Gateway runs the request lifecycle Identify, Check, Protect, Route, Execute, Record in the request path, so an allow-or-deny decision does not depend on a model choosing to comply. And human gates are structural rather than cultural: Workflows chain coworkers and connectors with explicit approval gates and budget caps, which is what makes Level 3 an architecture instead of a promise.

Our rollout model is the one we publish on the gateway page, and it applies here directly: Observe first. Enforce second. Optimize third. Route traffic through in observe mode before writing a single rule, because an inventory of what your agents actually reach beats a policy written against what you assume they reach. Per-capability build status is disclosed on the site and some controls named above are further along than others, so read the labels rather than this paragraph. On connector scoping specifically, our analysis of MCP server security goes deeper.

Ready to Govern Your AI?

Talk to LeapForce — one controlled layer for every AI tool, connector, model, and agent.