Some 95% of executives say their organisations have already experienced negative consequences from enterprise AI use, with direct financial loss as the most common outcome.
Agentic AI compounds that risk dramatically. Agents that can read, write, trigger workflows and initiate transactions under a single broadly permissioned identity are not a capability advantage. They are a governance liability. The good news is that the framework to deploy agents safely already exists. Most organisations simply are not using it.
In my years advising enterprise technology leaders across telecommunications and financial services, the agentic AI conversation follows a predictable pattern. An executive sponsors a proof of concept. The technical team builds an agent that can access multiple systems, reason across data sources and take action autonomously. It works impressively in the demo. And then the governance and risk teams look at what the agent can actually do, what it can read, write, delete and trigger, and the deployment stalls.
The problem is almost never the AI. It is the architecture around it. Specifically: agents being granted access far beyond what any single task requires, operating without meaningful boundaries, and with no systematic framework for classifying how much autonomy is appropriate given the risk profile of what they are doing.
KPMG’s Q4 2025 AI Pulse Survey confirms this is not a local challenge: 65% of enterprise leaders globally cite agentic system complexity as their top deployment barrier, and 75% identify security, compliance and auditability as their most critical agent requirements.
The super-agent problem
The failure mode I see most frequently in enterprise agentic AI has a name: the super-agent. An agent built to do everything, read customer data, update records, send communications, initiate transactions, trigger downstream workflows, all under a single broadly permissioned identity.
It is the AI equivalent of giving every new employee master keys to every room in the building and assuming they will only open the doors they need.
The principle of least privilege in agent design is, at its core, a POPIA architecture requirement.
Super-agents have two structural flaws that directly translate into governance failures. The first is super-agency: the agent has the freedom to interact with any system it can reach, with no meaningful boundaries on scope. The second is over-privilege: the agent is granted access rights far beyond what any specific task actually requires.
Together, these create systems that are unpredictable, unauditable, and, in regulated industries potentially non-compliant. Infosys’s August 2025 research found that 86% of executives aware of agentic AI believe it poses additional risks and compliance challenges precisely because of this dynamic.
The blast radius of a misconfigured super-agent is the entire system it can reach. The blast radius of a focused, least-privilege agent is exactly one task. The governance choice is made at design time, not deployment time.
A better architecture: The risk-capability quadrant
The alternative is not less capable AI. It is more purposefully designed AI. The framework I apply with enterprise clients starts from a simple principle borrowed from software engineering: high cohesion.
Each agent should be tightly focused on a single task, granted only the access that task requires, and designed to hand off cleanly to the next agent in a governed workflow. Not one super-agent doing everything, a coordinated team of focused agents, each doing one thing well.
Classifying agents before building them is the critical starting point. A two-dimensional risk-capability quadrant provides the practical tool. On one axis: risk level − how much damage could occur if this agent behaves unexpectedly? Does it access sensitive, personal, or financial data? Can it take irreversible actions? On the other axis: capability level − how much autonomous reasoning does this agent require? Is its behaviour predetermined and scriptable, or does it dynamically decide what to do, which tools to use and what actions to take?
The quadrant produces four distinct agent profiles, each with a different governance requirement. Low-capability, low-risk agents, a knowledge base retrieval bot − can be treated like traditional software: persistent, with static credentials, governed through existing controls.
High-capability, high-risk agents, an accounts payable automation that reasons over financial records and initiates payments, require ephemeral design, dynamic access controls evaluated at every tool call, and a mandatory human checkpoint before any consequential action.
KPMG’s survey data confirms this is becoming standard practice: 60% of leading enterprises now restrict agent access to sensitive data without human oversight.
The South African GRC imperative
South Africa’s regulatory environment makes the governance framework above not merely good practice but a compliance obligation. POPIA requires that any automated processing of personal data be purposeful, proportionate and accountable.
An agent granted access to customer records beyond the scope of its specific task is not compliant − regardless of whether it uses that access. The principle of least privilege in agent design is, at its core, a POPIA architecture requirement.
The SARB and FSB add additional layers for financial services deployments. Agents initiating or influencing credit decisions, payment instructions, or regulatory submissions must meet the same accountability and explainability standards as human-initiated actions.
The audit trail that a well-governed agentic architecture produces every agent action logged with what triggered it, what data was accessed, and what decision was made, is precisely what these regulatory frameworks require. Building that trail from the start is not administrative overhead. It is the difference between a deployable system and one that cannot leave the proof-of-concept phase.
Governance is not the brake. It is the engine. The most important reframe I make with every client is this: ungoverned agentic AI does not move faster. It moves confidently toward value-destroying events, regulatory penalties, data breaches, failed audits and erosion of customer trust.
Research from the Cloud Security Alliance confirms governance maturity is the single strongest predictor of AI readiness. IDC projects agentic AI spending will exceed $1.3 trillion by 2029 − the organisations capturing that value are those that treat governance as a design input, not an afterthought.
The question to ask before the next agent goes live
Before any new AI agent deployment reaches production, I recommend every South African technology and risk leader ask six questions:
- What is the single task this agent needs to accomplish?
- What is the minimum data access required?
- What actions does it need and which should be explicitly denied?
- What is its risk-capability classification?
- Does it require a human checkpoint before consequential actions?
- And what does the audit trail look like?
If your team cannot answer all six with confidence, the agent is not ready for production. Not because AI is not capable − but because governance is what converts capability into sustainable value.
The 40% of agentic AI projects that fail do so not because the technology does not work. They fail, as IDC’s research confirms, because the foundations were not in place. How many of your current agentic AI initiatives have those foundations in place?
* Eugene Perumal is a strategy and architecture principal with over 20 years' experience in enterprise technology across telecoms and financial services, including senior roles at Vodacom Group and Absa Group. He holds Master’s degrees and certifications in enterprise architecture, AI governance, cloud and analytics. He writes on enterprise AI strategy, ROI measurement and the shift to agentic AI deployment.
Share
