One agent is not one risk level

A trade publication ran a piece this morning titled Autopsy of an Agent Incident. The word to notice is autopsy. Not benchmark, not demo. A postmortem.

It hangs off a Gartner prediction from May: by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps identified only after production incidents occur.

Read that last clause twice. Identified only after production incidents occur. Nobody in that 40% shipped an agent they thought was dangerous. They shipped one whose limits had never been tested, and the test ran in front of a customer.

The fix on offer

Gartner’s recommendation is sound. Stop treating governance as a switch with two positions. Senior Director Analyst Shiva Varma calls the binary approach the root cause: identical controls on every agent, so the simple ones get strangled and the powerful ones run loose. Autonomy and scope should be scored separately. Four rungs come out of it. Read-only display. Read-only advice. Act with approval. Execute alone with exception review. Controls scale with the rung.

Right idea. For a support inbox, still too coarse.

Where the rung breaks

Picture one week of a small company’s support email. Where is my order. Do you ship to Canada. What is in this product. Change the address on order 4471. Cancel my plan. Refund the last three charges, I was billed after I cancelled. My account is locked and I need it open by noon.

One agent. One set of credentials. One rung.

So which rung? Put it on execute and the refund question now carries the same standing as the shipping question, because the tier belongs to the agent and the agent handles both. Put it on act-with-approval and somebody approves an answer about Canada shipping forty times a day. That is the over-restriction Gartner warns about. Delivery slows, and people quietly route around the thing.

The two failure modes are not really two. They are one mistake seen from either end. The unit being governed is bigger than the unit carrying the risk. An agent is not a risk level. A topic is.

That is the bet we made. In IMCeleste, autonomy is set per topic. Shipping questions can send on their own while refunds still wait for a person, same inbox, same day, same agent. Move a topic up when it earns it. Drop it back with one click. When a call goes wrong, it is one topic wide instead of one company wide.

The other half of the sentence

Tiering fixes what your controls are. It does nothing about when you find out you set them wrong, and “identified only after production incidents” is a sentence about discovery. Your first tier assignment is a guess about traffic you have not seen yet. No amount of tier design fixes a guess.

You can go get the traffic first.

That is what practice mode is for. The agent reads real incoming tickets, writes a real reply, and sends nothing. You compare its draft against what your team actually sent. Run that for two weeks and you are holding a stack of the agent’s decisions on your customers and your policies and your weird edge cases, none of which reached anybody. The gaps Gartner says surface in an incident surface in a review instead.

A support veteran on a webinar about agent guardrails put the same rule in one line: copilot first, read the responses, improve the agent, and only then let it run alone. The examples on the screen were the reason. One was the coding agent that wiped a company’s production database in about nine seconds, backups included, after being told in its instructions never to guess.

Which points at the last piece. A tier has to be enforced by something that is not the model. Instructions are not a boundary. In our stack the agent proposes an action and deterministic code decides whether it is allowed, checking the topic’s autonomy level, the owner’s limits, and the tool’s risk class. A refund inside the cap goes through unattended. A dollar over the cap is held. The model gets no vote, and that is the whole point.

Small enough to be wrong about

Gartner’s 40% is a forecast about a discovery method. Those companies will learn where their agent’s authority should have ended by watching it go somewhere it should not have gone. The alternative is not more caution. It is moving the discovery earlier, and keeping the governed thing small enough that being wrong about it stays cheap.

See how the graduation works, or read what holds the agent inside its limits.