Why Better Data Alone Isn’t Enough for AI Agents

For years, one of the most common pieces of advice for enterprise AI has been to get the data right first. The logic is straightforward: if a system is going to make useful decisions, it needs accurate, accessible information to work with.

That statement remains true today, but it is becoming incomplete as AI agents move from answering questions and generating content to taking action on behalf of employees and organizations. Data can tell an agent what is true about a customer, transaction, claim or request, but it doesn’t necessarily tell it what should happen next – nor what the consequences of taking an action would be. That distinction matters when an agent is no longer simply providing an answer, but approving a request, updating a record, contacting a customer or moving a case forward.

Enterprise employees are expected to learn to operate within a structure that includes approval chains, business rules, dependencies, exceptions and escalation paths – agents need a way to do the same. With Gartner predicting that 40% of enterprise applications will include task-specific AI agents by the end of 2026, up from less than 5% in 2025, agents’ knowledge gaps will only become harder to ignore. 

Gartner also predicts that by 2028, 80% of tangible ROI from agentic AI will come from specialized, domain-specific agents. Specialization is important, but it only solves part of the problem. Knowing a particular domain does not automatically tell an agent where its responsibility begins and ends, how its task fits into a larger process or who should take over when something falls outside its remit. For agents to become reliable participants in enterprise work, they need both workflow process context and business data.

Good Data Doesn’t Tell an Agent What Happens Next

Consider a loan application, where an agent might have access to an applicant’s financial history, employment information and other relevant records. That information can help it understand the application, but it doesn’t tell the agent how the organization handles it.

Which checks need to happen first? What changes when an applicant meets one condition but not another? What information is mandatory before the case can proceed? Which decisions can happen automatically, and which need to go to an underwriter?

Most enterprise work is full of these conditional paths. A process might move automatically when certain criteria are met, stop while it collects additional information, or take a completely different route when an exception occurs. The appropriate next action depends not only on the information available, but on where the work currently sits and what has already happened.

This changes what reliability means for an enterprise agent. An accurate answer isn’t enough if the next action is wrong. An agent can correctly interpret the information in front of it and still move a case to the wrong stage, skip the required approval or act before a dependency has been completed.

McKinsey recently shared insights into its work with a medtech company that discovered the AI platform it was using couldn’t support several of its core workflow rules. Rather than delay its launch date to address those gaps, the company continued as planned and ultimately left an estimated 30% of the AI’s intended value unrealized. This example underscores the need for enterprises to account for the process surrounding the task, not just the information needed to complete it. 

Match the Guardrails to the Decisions an Agent Can Make

As agents become capable of acting, governance also needs to become more specific. An agent that retrieves a policy document does not present the same level of risk as one that changes a customer’s account, approves a payment or initiates a transaction. Yet organizations can easily fall into one of two extremes: letting agents act too freely or requiring human approval for nearly everything.

Controls around an agent should reflect the decisions it can make and the potential consequences. A low-risk, repetitive action may be appropriate to complete independently. Another action might require approval above a certain value. An unusual case may need to be escalated immediately to an employee.

Human oversight is most useful when it is intentional. If a person must approve every routine step, much of the benefit of introducing an agent disappears. But removing checkpoints from decisions that genuinely require judgment or accountability creates a different problem.

IBM Research has advocated for explicit rules around the actions agents are permitted to take and the points at which human oversight is required. Those controls also need to account for the process the agent is participating in. An agent’s authority doesn’t necessarily remain static from the beginning of a case to the end. What it can safely do may depend on the stage of the process, the information already verified, the decisions previously made and the consequences of the next action.

That means organizations need to build governance into the workflow itself. Instead of assigning an agent a broad permission set and relying on it everywhere, they can define where it’s allowed to act independently, where additional conditions must be satisfied and where responsibility must pass to a person. The question then becomes less about whether an agent is autonomous and more about where autonomy makes sense within a process.

Agents Have to Work with the Business That Already Exists

Process context becomes even more important when an agent must interact with the rest of the enterprise. Organizations are not starting with a blank slate. A single customer request might already move between a CRM, document repository, case management platform and ERP system, while involving employees from several departments.

Dropping an agent into one part of that environment does not automatically make the overall process more efficient. An agent might complete its individual task perfectly, but if an employee then must copy its output into another application, determine who needs it next or manually restart the process elsewhere, the bottleneck has simply moved.

This is why enterprises need to think about agents as participants in a larger process rather than isolated tools. What triggers the agent? What information does it receive? What is it responsible for? Where does the work go after it has finished? And what happens when it cannot complete its task?

Those questions become even more important as organizations introduce multiple specialized agents. Deloitte has identified orchestration as a key requirement for businesses moving toward multiagent systems, where different agents can take on distinct roles and coordinate work. Enterprise orchestration must extend to how agents communicate and coordinate with one another, not just how they operate individually. Without that oversight, agents risk acting on incomplete context, triggering conflicting actions or bypassing established business rules and approval processes. Agents still operate inside organizations filled with existing applications, employees, business rules and processes that may run for days, weeks or months.

Start with the process that needs to be completed and determine where agents, people and existing systems each fit within it. An agent might handle one step independently, another agent might perform a specialized check, an employee might make a judgment call and an existing system might execute the final transaction. What matters is that work can move between participants without losing context along the way.

Autonomy Requires Structure

Giving agents more structure doesn’t mean every action needs another layer of restriction. In fact, the opposite can be true. Clear processes can give organizations more confidence about where agents can operate independently because the boundaries, exceptions and escalation points have already been defined. An agent does not need unlimited freedom to deliver meaningful value. It needs enough responsibility to move work forward, enough context to know what comes next and a clear understanding of when responsibility belongs somewhere else.

Better data will continue to make agents more capable. But capability alone doesn’t make an agent useful inside an enterprise. The real test is whether it can take the right action, at the right point in a process, within the boundaries the business has established.