Over 40% of Agentic AI Projects Face Cancellation by 2027

Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, and inadequate risk controls. A new analysis argues the root cause is not weak models or immature products but something older: companies are deploying a digital workforce without the management system they spent a century building for people.

The piece, published as a thought-leadership essay on Unite.AI, draws a sharp contrast between how firms onboard human workers and how they onboard software agents. Ask a company what a new accounts payable analyst may do, the author writes, and you get precise answers: which systems she works in, which vendors she handles, and a $10,000 approval limit above which her manager signs off — all documented in a delegation-of-authority table that internal audit checks annually. Ask the same company what its new invoice agent may do, and "you'll often get a screenshot of a prompt."

Why a Prompt Cannot Do the Job

A prompt describes intent — what the agent is for. It rarely states what the agent may never do, where its limits sit, or when it must stop and hand a decision to a person. Even when a prompt includes such limits, nothing enforces them. A line telling an agent not to issue refunds over $500 is, in the author's words, "a request to a probabilistic system." No auditor would accept "we asked the analyst nicely" as a control for a human employee, the argument runs, so it should not pass for software either.

The security community already has a name for the failure mode. The OWASP Top 10 for LLM Applications lists Excessive Agency as a core risk, rooted in excessive functionality, excessive permissions, or excessive autonomy. The OWASP guidance prescribes giving the agent only the tools it needs, scoping its permissions, requiring human approval for high-impact actions, and enforcing authorization in downstream systems rather than trusting the model to police itself.

That last point matters most, the author argues. The grant of authority has to live where the action happens: in the agent's own service identity, its tool permissions, and the spend cap at the API gateway. Running agents on a shared service account is "like five people sharing one badge" — when something goes wrong, the audit log names the service account, and the company is left guessing which agent acted.

What Do the Cancellations Actually Mean?

Gartner attributes its 40%-plus cancellation forecast to escalating costs, unclear business value, and inadequate risk controls. The author reads those causes the way a chief operating officer would, while noting "Gartner doesn't frame it this way; that's my reading":

• Costs escalate when nobody set a budget.
• Value stays unclear when nobody wrote down what the work was supposed to produce.
• Risk controls fall short when there are no limits, no reviews, and nobody clearly accountable.

"It's the same thing that happens when people are set loose without a management system, and that problem is a lot older than AI," the author writes.

Formal frameworks recognize the gap but do not close it. The NIST AI Risk Management Framework (the U.S. standards body's guidance structure for AI risk) treats Govern as the function running through Map, Measure, and Manage, and its Generative AI Profile extends that into generative systems. What frameworks cannot supply, the author argues, is "the working machinery, the grants and tests and reviews that a team actually runs on a Tuesday." Without those, "governance stays a PDF on a shared drive."

How Old Management Tools Map onto Agents

The essay proposes translating a century of personnel management practice into agent deployment, starting with the job description — which for an agent becomes an authority grant. Before an agent touches a live system, someone should be able to write one page covering:

• what the agent may do;
• what it may never do;
• its approval thresholds;
• which human owns it;
• who can widen its limits.

In the RACI matrix (the responsibility-assignment chart splitting tasks into Responsible, Accountable, Consulted, and Informed), the accountable party must be a person. "If you can't write that page, the role isn't ready to fill," the author writes, "and you'd say the same about a human hire."

Two classical delegation-of-authority rules carry over directly. First, you cannot delegate authority you do not hold, so a sub-agent should never receive a wider grant than the agent that spawned it. Second, segregation of duties still applies: an agent that can both create a vendor and pay that vendor is the same audit finding it would be for a person.

What Would a Real Hiring Test Look Like?

Current agent evaluation mostly resembles testing a calculator — checking whether the answer is right. A test for a worker, the author argues, would check whether the agent stayed inside its grant, asked for approval when required, escalated when the situation exceeded its brief, and stopped when it should have.

To that end, the author is building a benchmark of 50 scenarios around exactly these failures: crossing approval limits, acting on stale data, following injected instructions that widen scope, and keeping access after a role change. The benchmark has so far run only against scripted agents to validate the scenario designs, so no model results exist yet. The surprise, the author notes, is how ordinary the scenarios are — "the normal ways employees go off-brief, rewritten for software." Most public leaderboards still score task completion, and very few score whether the agent respected its authority.

Probation and promotion also translate. People start narrow and earn wider scope as their judgment proves out; agents can earn their limits the same way, through a record of staying in bounds, escalating well, and stopping cleanly — a record that can equally justify narrowing a grant.

Agents add one wrinkle people do not. When a vendor upgrades the underlying model, "you've effectively got a new hire wearing the old badge." The author would treat that as a change event and re-test before the grant carries over.

Termination must be rehearsed before it is needed. The drill questions are concrete: if you had to stop this agent and pull its access within the next hour, could you? Who holds the authority to make that call at 2 a.m.? What breaks downstream, and which in-flight commitments must someone unwind by hand? "If nobody has run that drill, you're hoping the kill switch works."

Where Accountability Lands

The human-agent comparison breaks down at responsibility. An employee can be held responsible; an agent cannot. That, the author argues, is precisely why the grant must be enforced in systems and why every agent needs a named owner: "Someone ends up accountable either way. Usually it's whoever signed off, whether they knew they were signing or not."

When an incident occurs, the post-incident review will ask the same questions it asks about people: What was the agent allowed to do, and where is that written? Who approved widening its access? How long did it take to stop? Who owned it? If the honest answers are "a prompt," "nobody remembers," "hours," and "unclear," a better model would not have saved the project.

Where the Advantage Ends Up

Models are becoming rented inputs, swapped and upgraded on a vendor's schedule, which means two companies can run the same model and end up in very different places. One has agents with budgets, limits, owners, and an audit trail for every consequential action; the other has "an expensive pilot headed for someone's cancellation statistics."

The differentiator is the management system around the model — built slowly, and mostly by people who have run organizations before. The essay closes with the question every deployer should be able to answer in writing: if your newest agent exceeded its authority tomorrow, would anything in the company notice, and could you show an auditor where the boundary was?