Every AI readiness conversation I have this year eventually turns to agents: an AI system that does not just answer a question but takes an action on the back of it. The interest is reasonable. The sequencing is usually backward. Organizations are asking “which process should we hand to an agent first” before they have answered “what happens when the agent gets it wrong.”
Adoption is not the hard problem
Standing up an agentic workflow on Azure AI Foundry, wiring it to a set of tools, is the easy part of this work now. The hard part, the part that determines whether it survives a security review, is the same set of questions every automation project has faced, made sharper because the system is making judgment calls rather than following a fixed script:
- What is the blast radius if the agent takes the wrong action, and is that action reversible?
- Does the agent operate with its own identity and permissions, scoped to only what the task requires, or does it inherit a broader set of access than the task justifies?
- Is there a human in the loop for actions above a defined risk threshold, and who is that human accountable to?
- Can you reconstruct, after the fact, exactly what the agent did and why, in a form that satisfies an audit rather than a debugging session?
If those four questions do not have answers before an agent touches production data or production systems, the rollout is not ready, regardless of how well the demo went.
Where this shows up in practice
The engagements where agentic AI stalls are rarely stalled by model capability. They stall because the identity and access model was designed for humans clicking through an interface, not for a system making autonomous decisions at machine speed. Retrofitting scoped permissions and approval gates after an agent is already in a business process is significantly harder than designing for it up front, and it is the step teams skip when the pressure is to show adoption numbers.
The guardrail-first sequence
On the engagements I run, agentic AI governance gets scoped alongside the first pilot, not after it: a defined risk tier for the actions the agent can take, an identity model that grants only what that tier requires, an audit trail built in from day one, and an explicit human checkpoint for anything above the lowest risk tier.
That sequencing does not slow adoption down as much as it looks like it will. It prevents the far more expensive version of slow, which is a pilot that gets pulled after an incident and takes the whole program’s credibility with it.