Ask why your AI program has not scaled past its first few wins and you will hear about integration, data quality and change management. All real, all fixable, none binding.
The binding constraint is that you cannot explain what the systems already running actually did. And unlike the others it gets more expensive every month you wait, because evidence you did not capture cannot be captured later. Companies are already saying so where they are legally obliged to be candid.
The disclosure that does not match the demo
On March 6, 2026, Workday filed its annual report with the SEC. In the risk factors, the company told its own investors that "the use of new and evolving technologies... including generative and agentic AI capabilities, may result in reputational harm and increased litigation."
Workday sells agentic AI to finance and HR teams. In the one document it carries legal liability for, it calls that technology an exposure.
Not hypocrisy, and not an outlier. A full-text search of SEC filings returns 991 hits for "agentic AI" across 10-Ks, 10-Qs and 8-Ks in twelve months. Filed language is drafted by counsel, certified personally by the chief executive and chief financial officer, and creates liability if it is wrong. Marketing language creates a pipeline. When the same companies describe the same technology in two incompatible registers, believe the filings.
And a pattern appears across them. The disclosed risk is almost never that the model will not be smart enough. It is that the company cannot explain or reconstruct what the system did.
Two curves, running at different speeds
The dominant framing treats this as a capability race. Which model, which vendor, how fast it returns. That measures the wrong curve. There are two.
The first is deployment, meaning how much of your process an agent touches. The second is control maturity, meaning whether you know who owns each agent, what it is permitted to touch, what forces it to escalate and what evidence it leaves behind.
Most organizations are climbing the first curve at a speed unusual even by enterprise software standards. The second is close to flat.
The second curve is now the ceiling on the first, and almost nobody is measuring it.
Measuring it is not complicated, which is the frustrating part. Four questions per agent, answerable in a spreadsheet. Who owns it, what it is permitted to touch, what forces it to stop, and what it leaves behind. A score out of four, per agent, tracked monthly. That is a control-maturity metric, it takes an afternoon to build, and almost no organization running agents today can populate it.
Why this is not survey noise
Most numbers about this gap come from vendor-commissioned surveys, and the vendors sell the remedy. Two things make that objection insufficient, and neither is a survey.
Nobody writes a risk factor to sell software. And academic benchmarking has no stake in this market at all. The best model on the Finance Agent Benchmark reached 46.8 percent accuracy at $3.79 per query, and a consistency paper found agent success dropping from roughly 60 percent on a single run to 25 percent across eight.
Sit with that second figure. It is a reproducibility finding rather than a capability finding, and reproducibility is what a control depends on. A process that succeeds six times in ten once, and two and a half times when repeated, cannot be governed by testing it. Joe Brinkley of Cobalt named the mechanism in CIO.com's July investigation: "These systems do not run on fixed code paths. They use nondeterministic reasoning across a web of different APIs. Traditional logs only catch isolated events."
Where the gap actually opens
Walk one transaction through. Take an invoice, though the shape holds anywhere software now acts.
Four layers, and not the same kind of work. Interpretation reads the document and decides which vendor and which order, and models are good at it now. Determination answers whether a 2.4 percent variance is inside tolerance for this vendor, or whose signature a $61,000 invoice needs when the threshold sits at $50,000. Those are not language problems. They are business rules, and a controller owns the answers. Execution moves the subledger and moves cash, and from that moment the question stops being whether it was right and becomes whether you can show what happened. Exceptions are the duplicates, the short shipments, the vendor who changed remittance details by email, and they are where most human hours actually go.
The failure mode is easy to state. Organizations attach an agent to interpretation, get a real result, and let its output flow into execution with no determination layer a person owns. The rules end up spread across a prompt, a model's judgment and some undocumented configuration, and nobody can point at the rule that produced a given outcome.
That is most of the distance between running AI somewhere and running it at scale, and the distance is measurable. Forrester found 67 percent of finance teams already running AI in accounts payable against 39 percent with an operating model built to scale it.
The alternative is not slower, it is separated
Four layers, four different owners. Naming them is most of the work, and it is work a business owner does rather than a vendor.
The system may interpret freely. Reading, extracting, classifying, flagging. No permission needed, because nothing here changes a financial state and the cost of an error is a second look.
It may execute only inside rules somebody wrote down. The tolerance, the threshold, the approval limit, stated in language the person accountable for it can read and correct. Not tuned in a prompt. Published, versioned, and testable, so the rule that ran on Tuesday can be produced on request.
It must escalate anything outside those rules to a named person. Named, not a queue. An exception route with no owner is a slower version of the original problem, and it fails the same way. Nobody can say afterward who decided.
And every run records which version governed it. The cheap step everyone skips. Stamp the process version on the run and the reconstruction question answers itself, forever. Skip it and you buy the expensive answer later, under deadline.
Notice what that separation does to the reproducibility problem. You stop needing the model to be consistent, because consistency is no longer where the control lives. The model can vary run to run and the gate cannot, which is the only arrangement that survives a 60 percent figure becoming 25 percent under repetition.
It also compounds. The rules, the escalation paths and the version stamping are reusable, so the second process costs less than the first. This does not trade speed for safety. It trades an expensive rebuild for one piece of authoring.
The debt you cannot pay down
Here is the mechanism that makes delay different from ordinary technical debt, and it is the part most leaders have not priced.
Per Avalara's July 2026 survey, 28 percent of finance organizations running agents in production require documented audit logs, 92 percent of leaders are under pressure to prove a return, and 7 percent say governance is prioritized over speed. Schellman found 74 percent of enterprises believe they are audit-ready for AI and 27 percent of those actually are.
Put those together. Most organizations are adding scope under return pressure, without capturing evidence, while believing they are covered.
Ordinary technical debt can be paid down. Missing evidence cannot. When an auditor asks in eighteen months why a payment was released, you cannot generate a record for a decision nobody recorded. Reconstruction comes from memory and email threads, under deadline, across every period you ran uninstrumented.
So each agent deployed without an audit trail does not add to a queue. It widens a window of periods you will never explain.
The same gap sits outside finance, and it is less visible there
Finance is the sharpest proving ground because everything lands in the ledger. The exposure elsewhere is larger precisely because it does not.
A sales agent granting a payment-term concession has changed the transaction price, and if it puts collection in doubt it can determine whether that revenue is recognized at all. A procurement agent releasing a non-cancellable purchase order has created a purchase obligation. Both look like customer experience decisions, and both reach the general ledger without the reasoning attached.
Agents also operate on borrowed standing credentials, at machine speed, so the blast radius is not bounded by the workflow you designed. It is bounded by everything those credentials can reach.
Which makes the fix a go-live condition rather than a remediation project. Every agent gets its own identity, scoped to what its process touches and revocable on its own, plus an action trail that survives the agent being switched off. Shared standing credentials are the cheapest thing on this list to fix and the most expensive to discover you needed.
The test to run before the next deployment
One question, and it does not require a consultant.
For every agent you currently have in production, could a new hire, reading only your written documentation, correctly state three things. Who owns this agent, every exception type it can encounter and who is accountable for each, and what audit trail it leaves behind.
If the answer is no for any live agent, that agent is not ready for expanded scope, however well it has performed. Treat undocumented as a stop-ship condition rather than a backlog ticket. Good performance to date tells you about the cases the agent has already seen. It tells you nothing about the ones it has not.
None of this slows adoption. It is what makes the second deployment cheaper than the first, because the rules, the escalation paths and the evidence structure are reusable.
The organizations that scale this will not be the ones that picked the best model. They will be the ones that can answer three questions about every agent they run. Who owns it, what can it touch, and can you prove what it did.
That is answerable this week. Most people have not asked.
Sources
Workday annual report on Form 10-K, filed March 6, 2026, SEC accession 0001327811-26-000014. Verified at primary source. The filing reads "The use of new and evolving technologies in our offerings at Workday, including generative and agentic AI capabilities, may result in reputational harm and increased litigation," which the article quotes with the clause "in our offerings at Workday" elided.
SEC EDGAR full-text search, "agentic AI," across 10-Ks, 10-Qs and 8-Ks. The 991 figure dates from early August 2026. Re-run on 23 August 2026 the same query returns 1,075, so the number drifts upward and should be re-checked and dated at publication rather than quoted as fixed.
Revenue and commitment treatment. Under ASC 606 and IFRS 15 revenue is recognized when control of the good or service transfers to the customer, not when payment falls due, so payment terms do not move recognition timing on their own. What they do move is the transaction price, through the significant financing component and price concession provisions, and whether the collectibility criterion is met at all, which is a condition of a contract existing. IFRS 15 verified at ifrs.org. Purchase obligations arising from non-cancellable commitments are addressed by ASC 440, Commitments. The wording in this article was tightened to match those standards rather than assert a timing change they do not support.
Consequences attached to filed language. Sarbanes-Oxley section 302, codified at 15 U.S.C. 7241, requires the principal executive and principal financial officers to certify each periodic report, which covers Item 1A risk factors and not only the financial statements. Liability for false or misleading statements in filed documents arises under Securities Exchange Act section 18(a), codified at 15 U.S.C. 78r. Both verified at primary. Auditors are deliberately not claimed here. Risk factors are not audited, and the auditor duty over other information is to read it for material inconsistency with the financial statements rather than to audit it.
CIO.com, July 21, 2026. Source of the Joe Brinkley quote and the standing-credentials mechanism. The investigation's survey figures were dropped from the article on purpose, since a section arguing the evidence is not survey noise should not rest on a survey.
Finance Agent Benchmark, arXiv:2508.00828. Source of the 46.8 percent best accuracy at $3.79 per query. Consistency finding from arXiv:2511.14136, source of the drop from roughly 60 percent on one run to 25 percent across eight.
Forrester Consulting for Basware, July 2026, reported via CPA Practice Advisor, July 28, 2026. Source of 67 percent running AI in accounts payable and 39 percent with an operating model to scale.
Avalara survey, July 2026, via CFO Dive. Source of the 28 percent requiring documented audit logs, 92 percent under return pressure and 7 percent prioritizing governance over speed. Schellman State of AI Governance Report 2026, via CPA Practice Advisor, July 29, 2026, source of the 74 percent believing they are audit-ready against 27 percent who are. Both are vendor-commissioned, treated here as magnitude rather than foundation.