"AI rollout" hides a decision. The platforms an organization is choosing between don't come in a purely assistive version anymore — agents and connectors ship in the box, behind admin settings. So the launch question is not whether you're doing agents. It is which level of autonomy each use case gets, and what it takes to move one up a rung.
The autonomy ladder (the industry's three rungs)
| Rung | What the AI does | Where the risk lives | Typical first uses |
|---|---|---|---|
| Rung 1 · Assistive ("chat as advice") | Reads, retrieves, drafts, suggests. A human holds the keyboard; nothing has write access. | Data exposure and unverified output — not actions. Governed by access tiers and verification norms. | Drafting, summarizing, research, analysis support — broadly, across every function. |
| Rung 2 · Propose & approve (human-in-the-loop) | Prepares the action — the email, the record update, the journal entry — and waits. A human approves each execution. | Approval fatigue: review capacity must scale with proposal volume or sign-off becomes rubber-stamping. | Ticket responses, CRM updates, reconciliations — high-volume work with a natural checkpoint. |
| Rung 3 · Bounded autonomy (human-on-the-loop) | Executes within defined boundaries: spend limits, scope limits, thresholds above which a human must look. | Uncontrolled actions and silent model changes. Requires pre-set escalation thresholds, a named error owner, kill criteria, standing regression evaluation. | Ticket triage and resolution, IT operations, bounded back-office workflows — where failure is recoverable. |
What's dying is the calendar, not the sequence
The old pattern staged autonomy by era: the whole company lives at Rung 1 for a year, then graduates together. Competitive pressure is killing that — and the replacement is not agent-first everything. It is risk-gated staging at the use-case level: each use case climbs the ladder on its own evidence, gated by its own tier. A company can run Rung 3 in ticket triage and Rung 1 in financial reporting on the same day. That is not incoherence; that is the design. The functions that go agentic first — service, engineering, sales ops, finance ops — share one property: success is obvious and failure is recoverable. That property, not departmental boldness, is what qualifies a use case to climb.
Why the gate matters (what the 2026 evidence says)
The pressure is real. Only ~17% of organizations have deployed agents; over 60% expect to within two years. Roughly 40% of enterprise apps are forecast to embed task-specific agents by end of 2026, up from under 5% in 2025.
So is the failure rate. Gartner expects 40%+ of agentic AI projects canceled by 2027. MIT found ~95% of GenAI pilots produced no measurable P&L impact. Deloitte: ~3 in 4 enterprises expect agentic AI within two years; only ~1 in 5 has mature governance for it.
The consistent diagnosis across surveys: adoption has outrun readiness. Agentic AI fails not because models are weak but because actions are uncontrolled. Governance is not the brake — decision boundaries, monitoring, audit trails, and escalation paths are what make scaling possible at all.
The operating rule
Go agent-first per use case, wherever failure is recoverable — and the tier tells you where. In practice: the admin console is the policy. Launch assistive-by-default with the agentic surface explicitly gated; treat enabling any Rung 2 or Rung 3 capability as a use case that passes through the tiering framework — evaluation on your own data before pilot, thresholds and a named error owner before autonomy, regression evaluation after. Speed and caution stop competing when they are allocated per use case instead of per era.
Companion to Risk Tiering for Employee AI Use, which defines the tiers and gates this sheet refers to. Sources paraphrased from Gartner (2026 agentic-AI hype cycle and forecasts), MIT (2025 GenAI pilot study), and Deloitte's 2026 global survey. Rung labels follow common industry usage: assistive / human-in-the-loop / human-on-the-loop.