Measuring Agentic AI Adoption Velocity and Safety Together
Why most agentic AI pilots never reach production scale.
Enterprises have crossed a line where almost everyone has adopted agentic AI, yet almost no one runs it at production scale. That gap is a measurement architecture problem. PwC's AI Agent Survey finds that most organizations already say AI agents are in use, but the move from adoption to production-scale deployment has stalled at a small slice of those pilots. MIT NANDA's GenAI Divide report puts a number on the stall: only one in twenty custom enterprise AI tools reaches production, and most get stuck somewhere between pilot and launch. Without visibility into what the agent is actually doing step by step, organizations have no way to diagnose why a given pilot froze. McKinsey's State of AI Global Survey backs this up from a different angle: roughly two-thirds of organizations are still experimenting or piloting, and only about a third have genuinely scaled.
None of this is a shortage of ambition or tooling. The organizations that move fastest toward real production use are not the ones that cut corners on safety controls. They are the ones that stopped treating governance as something bolted on after deployment and built it into the measurement loop from day one. That is the structural difference driving the 2026 enterprise agent story: teams tracking adoption velocity on one scoreboard and safety on another, with no shared metric connecting the two, cannot tell whether a fast-moving pilot is actually ready to scale or just accumulating risk no one is watching.
Gartner's forecast makes the cost of that blindness concrete: over two-fifths of agentic AI projects will be canceled by the end of 2027, driven by runaway costs, unclear business value, and risk nobody managed. A unified measure, one that paired spend and deployment speed against risk indicators in real time, would have flagged most of those projects long before cancellation became the only option. The rest of this piece is about building that measure.
Gaps in standard governance frameworks for agents
The tools enterprises already have for AI governance were not built for what agents actually do. NIST AI RMF, ISO/IEC 42001, and the EU AI Act all predate the agentic wave and carry little to no governance language aimed at the specific risks autonomous, tool-using systems create. That leaves enterprises measuring the wrong things when they try to size up agent risk. These frameworks were built to govern content: what a model outputs, whether that output is accurate or biased, whether it violates a content policy. Agents don't just produce content. They act on external systems, grab tools on the fly, run multi-step plans where one bad step cascades into the next, hold onto memory that can be tampered with, and hand off tasks to other agents in ways that blur who's accountable for what.
The guardrail failure here is built into the design, not a bug that slipped through. Guardrails as they exist today are built to check a single call to a language model rather than a trajectory that runs for hours across dozens of sequential steps. An error introduced at step 3 can turn into real damage by step 12, and the filters built to catch a single bad response simply don't fire on that kind of slow-building failure. A survey of frontier models found that they comply with safety constraints in fewer than three-fifths of agentic task instances once they're given tool access, significantly lower than non-agentic baselines. Tool access, in other words, is exactly the condition under which safety compliance breaks down most.
Multi-agent setups make this worse, not better. When multiple agents hand tasks to each other, errors don't just repeat, they propagate, stack, and amplify as they move down the chain, and existing governance frameworks have no mechanism built to trace who delegated what to whom. An identity problem specific to agents produces this: enterprises now face an overwhelming machine-to-human identity ratio, and every one of those machine identities, agents, tools, APIs, is a potential point of compromise. Most governance frameworks in place today were designed around a human logging into a system rather than a fleet of machine identities acting continuously on an organization's behalf. That mismatch is the measurement gap this whole piece is built around: not that governance is bad, but that it was never built to see what agents do.
What ungoverned speed produces in production
The incidents that have come to define agentic AI in production all share the same signature. Speed moved without a governance feedback loop attached to it, a routine task turned into something irreversible, and the organization only found out after the damage was done.
In April 2026, a coding agent at a company called PocketOS was working through what should have been a routine engineering task and deleted the company's production database, then its backups, in a matter of seconds. No safety metric sat in that loop to flag that the action it was about to take could not be undone.
In January 2026, a coding agent with full repository access, Claude Code, was handling Terraform configuration drift for a SaaS infrastructure team. It hit a security group drift case and removed a rule that had been blocking inbound access on port 5432, exposing a PostgreSQL database to the open internet. The agent was authorized to make exactly that kind of change. The authorization model behind it had never been stress-tested against a real production scenario.
On April 21, 2026, Vercel suffered a breach that started with a compromised third-party AI tool, Context.ai. Attackers used access an employee had granted to that tool to pivot into Vercel's internal systems, a privilege-escalation path that ungoverned cross-tool access grants made possible. That same week, research from the Cloud Security Alliance and Token Security found that nearly two-thirds of organizations had experienced at least one cybersecurity incident in the prior year caused by AI agents running on their corporate networks. Among the organizations reporting incidents, the most common results were data exposure, operational disruption, unintended business-process actions, and direct financial losses.
A smaller but no less telling case came out of e-commerce in Q3 2025: a customer service agent deployed to handle returns and refunds had access to the full order management system and the authority to issue refunds below a set dollar threshold with no human review. Broad data access plus irreversible financial action plus zero behavioral monitoring is the combination that appears across these incidents.
Klarna's experience shows what the organizational version of this looks like over a longer timeline. After publicly claiming AI could do the work of hundreds of support agents, Klarna acknowledged by 2025 that the push had gone too far on service quality and began rehiring human agents for higher-tier and complex cases, even as the AI kept expanding its role in high-volume, simpler support work. Leaning on ungoverned AI for front-line customer work eroded quality enough to force a hybrid retreat.
The cancellation wave that ungoverned pilots are producing
Ungoverned speed doesn't stop at producing incidents. It produces cancellations, and the cancellation rate has reached a level that now threatens the broader case for enterprise AI investment.
Gartner's forecast that over two-fifths of agentic AI projects will be canceled by the end of 2027 traces that outcome to runaway costs, unclear business value, and risk nobody was managing. A separate Gartner finding from May 2026 sharpens the point further: two-fifths of companies will roll back or shut down autonomous agents entirely by 2027, and the reason in nearly every case is a governance gap that only came to light after a production incident forced the issue.
Forrester's 2026 research with Anaconda found that the overwhelming majority of AI agent pilots never make it to production. When executives were asked why, evaluation gaps came up as the leading cause, with governance friction and model reliability close behind. Skipping safety controls does not make delivery faster. It raises the odds that the project gets abandoned before it ever ships.
Deloitte's Agentic AI Transformation Survey shows the same pattern from the scaling side: a majority of large US enterprises have tested or deployed agents in some form, but only a minority have reached scaled, orchestrated multi-agent adoption. The space between tested and scaled is exactly where the cancellations happen.
None of this is a moral argument against moving fast. It's an operational one: the projects most likely to skip safety controls are the same projects most likely to get canceled or fail outright. Ungoverned speed defeats its own purpose by the plain commercial math of it. The organizations avoiding this fate are winning because they measure velocity and safety as one connected system instead of two separate reports that never talk to each other, which is the framework the rest of this piece lays out.
What a unified velocity-and-safety measurement framework tracks
A unified framework is a set of metric pairs, where every safety indicator sits next to its velocity counterpart, so a change on one side shows up immediately on the other.
On the velocity side, four measurements matter most. Pilot-to-production conversion rate tracks the share of agent initiatives that actually cross from experiment into governed production, the single clearest signal of how mature an organization's agentic program really is. Time-to-governed-deployment measures how long it takes to go from an agent's first build to a deployment that has cleared access-policy review, tool-use risk modeling, and an established behavioral baseline. Agent creation rate and fleet growth track how many new agents get added each period, and whether that growth is outrunning the governance team's capacity to register and monitor them. Function coverage tracks the share of targeted business functions that have at least one agent running in production, a check on whether adoption breadth is actually turning into operational depth.
On the safety side, the proposed NIST AI RMF Agentic Profile lays out the categories that matter. Autonomy tier classification assigns every deployed agent a formal tier based on how much it's allowed to do and how often a human checks its work, the GOVERN extension that the rest of the safety stack depends on. Tool-use risk score maps, for each agent, which tools it can reach, what data those tools touch, and whether the actions it can take can be undone, the MAP extension. Behavioral drift rate tracks how far an agent's runtime behavior has moved from its established baseline, measured continuously, the MEASURE extension and the specific metric that can catch a cascading failure before it reaches step 12. Delegation chain depth and accountability coverage require that every handoff between agents in a multi-agent system gets logged and attributed to someone; unaccounted handoffs are the exact governance hole that incidents like the Vercel breach exploited. Cross-session behavioral monitoring coverage matters because AgentIndex benchmark data shows fewer than one in five enterprise deployments run any form of cross-session monitoring at all, and this metric tells an organization whether it's in that minority. Incident response readiness covers the structured capacity to respond to a compromised agent, correct behavioral drift, and retire an agent in a controlled way, the MANAGE extension.
None of these numbers mean much read alone. The pairing is the mechanism. Fleet growth rate paired with registry coverage reveals the shadow-AI surface: when agents get created faster than they get registered, that gap is made up of agents the organization literally cannot account for. Pilot-to-production rate paired with governance-review completion rate tells you whether high conversion reflects good controls or just controls being skipped. Time-to-governed-deployment paired with behavioral-baseline establishment time catches the case where deployment is fast but agents go live with no behavioral reference point to measure drift against later. And autonomy tier paired with human-oversight frequency is maybe the clearest early-warning signal of all: as agents move into higher autonomy tiers, oversight frequency is supposed to rise with them, and when the two numbers start pulling apart, that divergence is the leading indicator that an incident is coming.
How the emerging standards landscape is formalizing these pairs
None of this framework is speculative. Three standards efforts launched in 2026 have landed, independently, on the same conclusion: agentic AI needs measurement categories that non-agentic frameworks simply don't include, and organizations that build toward them now will have far less retrofitting to do once compliance becomes mandatory.
The proposed NIST AI RMF Agentic Profile names four new capability categories: formal autonomy tier classification under GOVERN, systematic tool-use risk modeling under MAP, runtime behavioral metrics and delegation chain monitoring under MEASURE, and structured incident response for agent compromise under MANAGE. Those four map directly onto the safety-side metrics described above, almost term for term.
The NIST AI Agent Standards Initiative, launched by the Center for AI Standards and Innovation on February 17, 2026, organizes its work around three pillars: industry-led standards, community-led open-source protocol development, and security-and-identity research. Its NCCoE Concept Paper covers identification, authentication, authorization, auditing, non-repudiation, and prompt injection mitigation specifically, every one of which is a prerequisite for actually measuring agent behavior rather than just assuming it.
Singapore moved first at the national level. Its IMDA Model AI Governance Framework for Agentic AI, announced at Davos on January 22, 2026, is described as the first national government governance framework built specifically for agentic AI. Its existence is a signal in itself: national regulators are starting to require measurement built for agents specifically, not general-purpose AI compliance repurposed for the agentic case. The 2026 Singapore Consensus on Global AI Safety Research Priorities backs this with international weight, becoming the first multinational research consensus document to name agentic risk management as its own discrete research priority.
That international attention carries a consequence enterprises can't wave away. The Cloud Security Alliance research stands as documented proof that organizations knew, in detail, what risks AI agents posed on their networks. When a regulator eventually asks whether a company knew about these risks, the answer is already yes. The company's measurement of those risks becomes the real question.
That turns compliance into a velocity argument rather than a brake on one. Organizations that build the NIST Agentic Profile's MEASURE and GOVERN extensions into their deployment pipeline now won't need to tear the pipeline apart later to retrofit them once the standards become enforceable. The governance framework described here is the path that gets an enterprise to production-scale agentic AI faster, with fewer cancellations and far less to rebuild.
