AI agents are becoming digital middle managers before they become autonomous workers

The dominant story about AI agents in business has been a story about replacement. Buy an agent, retire a role, book the saving. Two years of enterprise deployment have produced something stranger and more consequential: the agent that most companies actually run in production does not do the work, it distributes it. It reads a request, breaks it into pieces, decides which tool or which specialised sub-agent handles each piece, watches for completion, compiles what came back, and pushes anything ambiguous to a human. That is not the job description of a worker. It is the job description of a supervisor.

The agent that assigns work arrived before the agent that does it

This distinction gets lost in vendor language, which prefers to describe agents as digital employees. The architecture tells a different story. Anthropic’s own published account of its Research system describes an orchestrator-worker pattern in which a lead agent analyses the request, forms a plan, spawns subagents with separate context windows, and synthesises their returns. The lead agent never runs a search itself. Its entire contribution is decomposition, delegation, monitoring and synthesis. Strip the software vocabulary away and you are looking at a team lead.

The same shape appears across the tooling that enterprises bought in 2025 and 2026. Coding tools spawn specialist subagents for backend design, review and testing. Customer operations platforms route by intent and confidence, handling the routine and handing off the rest. Incident response systems run a coordinator that queries clusters, applies a runbook and escalates when the signal is unclear. In each case the layer that got automated first was the layer that moved information and assigned responsibility, not the layer that produced the output.

That ordering is not an accident of product design. It follows from what current models are reliably good at and what they are still bad at. Decomposing a fuzzy request into discrete steps, matching steps to tools, tracking state across a workflow and summarising results are tasks with tolerant error bars. If the plan is imperfect, the next iteration corrects it. Executing a consequential action once, correctly, with no supervisor behind you, has a much tighter tolerance. A refund issued in error is not fixed by a better plan on the second attempt.

So the market did the rational thing, mostly without saying so out loud. It put agents where mistakes are recoverable and kept humans where they are not. The result is an organisational arrangement almost nobody planned: a coordination layer made of software, sitting between human executives who set objectives and human specialists who handle exceptions. Companies did not decide to replace middle management with AI. They bought orchestration tooling, and orchestration is what middle managers do.

The consequences run further than headcount. When a model assigns your work, the assignment carries no relationship, no memory of your last three months, no read on whether you are overloaded. When a model writes the status report your director reads, the report reflects what the model could observe in logs, not what the team knows. When a model decides which cases escalate, it sets the boundary of what humans ever see. Each of these was previously a human judgement embedded in a person who could be questioned, promoted, argued with or held responsible.

There is a second-order effect worth naming early. The tasks that agents now perform were the tasks that trained the next generation of leaders. Running a small team, chasing status, translating strategy into assignments and learning which exceptions matter is how people learned to run larger teams. Automating that apprenticeship does not remove the need for senior judgement. It removes the path to acquiring it.

None of this means the autonomous-worker scenario is wrong. Capability curves are steep and the direction of travel is clear enough. It means the intermediate state is the one companies are living in now, and the intermediate state has its own logic, its own risks and its own accounting. The question that matters for the next three years is not whether agents will replace workers. It is what happens to a company whose coordination runs on software while its accountability still runs on people.

Defining the digital middle manager in precise terms

Loose vocabulary has done real damage to this subject. “Agent” now covers everything from a scripted chatbot to a system that plans, calls tools, revises its own approach and acts on live infrastructure. Gartner put a number on the confusion: of the thousands of vendors marketing agentic products, the firm estimated only around 130 were selling something that met the definition, with the rest engaged in what it called agent washing, rebranding assistants, chatbots and robotic process automation as agents. Any analysis of organisational effect has to start by saying which thing it means.

An AI agent, used strictly, is a system that pursues a goal over multiple steps, chooses its own next action, calls external tools or other systems to take those actions, and adjusts based on what comes back. The defining property is not intelligence. It is discretion over sequence. A workflow that always runs steps one through five in order is automation. A system that decides whether step three is needed at all is an agent.

A digital middle manager, as used here, is a narrower thing: an agent whose primary output is the allocation and supervision of other work rather than the work itself. Four functions define it.

Assignment. It decomposes an objective into tasks and matches each task to an executor, whether that executor is a tool, a subagent, a workflow or a person.

Coordination. It maintains state across the tasks, handles dependencies and sequencing, and reconciles what comes back from parallel branches.

Monitoring and reporting. It tracks progress against the objective and produces a summary that someone upstream reads instead of reading the underlying detail.

Escalation. It decides which situations exceed its authority or confidence and routes those to a human, with whatever context it chooses to pass along.

That last function is the one that makes the label more than a metaphor. A system that only distributes work is a load balancer. A system that decides what its superiors get to see is exercising managerial discretion. The escalation threshold is where an agent stops being infrastructure and starts being an intermediary with power.

It is worth separating this from three adjacent things that get conflated with it.

The first is the AI-assisted manager: a human manager using models to draft reviews, summarise threads and prepare updates. That is augmentation of an existing role, and it is now common. It changes how a manager spends time. It does not move the coordination decision out of the human.

The second is the agent-managed agent, where an orchestrator supervises only other software. This is the pure technical case, familiar from multi-agent coding systems, and it raises engineering questions about context, cost and failure propagation rather than organisational ones.

The third is the hybrid, and it is the case that actually matters. Here an agent coordinates a mixed pool of software executors and human executors. A support orchestrator that resolves eight cases itself and queues two for a specialist has, functionally, assigned work to a person. A marketing coordinator agent that drafts six pieces and flags one for legal review has put an item in a lawyer’s queue. The moment an agent’s output becomes an input to a human’s working day, the agent is participating in management whether or not anyone has written that down.

Berkeley’s California Management Review described the governance version of this arrangement in March 2026, framing the shift as a move from human-in-the-loop approval towards human-on-the-loop supervision, where people define objectives, constraints and escalation thresholds while agents operate inside them. That framing is accurate as engineering. It is also an admission: setting objectives, constraints and thresholds for a population of executors, then reviewing exceptions, is precisely what a manager two levels up does. The humans have not left management. They have been promoted into a supervisory position over a workforce that includes software, and they now carry the span that comes with it.

The precision matters because the policy questions differ sharply by category. An augmented manager raises questions about skill and time. A software-only orchestrator raises questions about reliability and cost. A hybrid coordinator raises questions about authority, accountability, employment law, oversight duties and the design of the human roles that remain. Most enterprise deployments in 2026 are hybrids, and most enterprise governance was written for the first two categories.

Orchestrator-worker architecture and its organizational shape

The technical pattern behind the digital middle manager has a name and a documented cost profile. In the orchestrator-worker design, a lead model receives the objective, produces a plan, and spawns worker agents that each get a self-contained task description, an output format and a fresh context window. Workers do not talk to each other. Every decision about what happens next lives in the orchestrator, which collects returns and assembles the answer.

Anthropic reported that this arrangement beat a single-agent configuration of Claude Opus 4 by 90.2% on its internal research evaluation, at roughly fifteen times the token consumption of a normal chat exchange. Both halves of that result deserve attention. The performance gain is real and large. The cost multiple is also real and large, and it is the reason most companies do not run orchestrated agents on routine work. Orchestration buys parallel breadth and pays for it in tokens, latency and complexity.

The engineering guidance Anthropic published is unusually revealing about the managerial character of the problem. Vague instructions caused subagents to misread the task or duplicate each other’s searches. The fix was not a better model. It was better delegation: each subagent needed an objective, an output format, guidance on which tools and sources to use, and clear task boundaries. Anyone who has run a team recognises that list. It is what separates a briefing from a wish.

Practitioners now catalogue a family of related topologies, and the differences map cleanly onto organisational forms. A single-agent loop is an individual contributor with tools. Orchestrator-worker is a team lead with direct reports who do not coordinate among themselves. The supervisor pattern adds a layer, so a lead delegates to sub-leads that delegate further, with the top layer unaware of the lower delegations. A hierarchical arrangement extends that into multiple tiers. Swarm and mesh designs let any agent call any other, which is a matrix organisation with all the ambiguity that implies. Pipelines are assembly lines. Router patterns are dispatchers. Paired generator-and-critic designs are the author-and-reviewer relationship formalised in code.

Each choice trades control against flexibility in the same way it does with people. Constrained topologies are easier to reason about, easier to audit and easier to debug, because the isolation boundary is explicit and information flow is predictable. Open topologies handle novel situations better and become nearly impossible to explain after the fact. The reason enterprise deployments have converged on orchestrator-worker and supervisor patterns rather than swarms is not that swarms perform worse on benchmarks. It is that an unauditable coordination structure is unusable in a regulated business, no matter how well it performs.

The isolation boundary deserves its own note, because it produces an organisational property with no clean human analogue. In the strict orchestrator-worker design, a worker agent does not know the other workers exist. It cannot check whether its piece contradicts a sibling’s piece. It cannot notice that the plan it was handed is wrong, because it never sees the plan. All cross-checking happens in one place, in the orchestrator, at synthesis time. In a human team, a developer who receives an incoherent ticket asks about it. Peers notice contradictions in the corridor. That informal error correction is absent by design in isolated worker architectures, and its absence has to be compensated for somewhere else.

The compensation usually takes the form of an explicit verification stage: a reviewer agent, a policy check, a separate citation pass, a schema validator. This is where the organisational reading becomes practical rather than cute. Companies deploying multi-agent systems keep rediscovering that they need quality control as a distinct role, not as a property of good workers, and they rediscover it after the first production incident rather than before.

Anthropic’s own guidance on where the token cost is justified points the same direction as sober enterprise practice: this architecture earns its price on high-value, complex tasks that need specialised knowledge or that exceed what one context window can hold. For everything else, a single agent with tools is cheaper and easier to supervise. That is also true of human organisations. Adding a coordination layer to a small, well-understood job makes it slower and more expensive. The mistake companies make with agents is the same mistake they make with people, and it now costs money per token.

Coordination was always the cheapest part of management to automate

Management is a bundle of activities that got bundled for historical reasons, not because they belong together. A middle manager assigns work, chases status, reviews output, translates strategy downwards and results upwards, allocates budget, hires, coaches, mediates conflict, defends the team’s interests upwards and carries responsibility when something goes wrong. These activities have wildly different automation profiles, and treating the bundle as a single job has obscured what is actually happening.

One widely cited breakdown of the typical middle-management week puts roughly 60% of it in four buckets: reporting, coordinating, reviewing and translating. All four are information-movement tasks. All four are, in the technical sense, well specified: there is a source, a destination, a required format and a completion condition. Information movement between defined endpoints is the single most automatable category of white-collar work, and it happens to be the historical justification for the management layer.

The layer existed because information did not move on its own. A director could not read the working state of forty people, so they read six summaries from six managers who each read the state of six or seven people. Span of control was set by cognitive bandwidth, and the pyramid was the shape that bandwidth constraint produced. Remove the constraint and the shape has no structural reason to persist.

Delayering is not new, which is worth saying plainly because the current wave is often presented as unprecedented. Firms cut management levels aggressively through the late 1980s and 1990s, most famously at General Electric under Jack Welch, compressing something close to a dozen layers between chief executive and factory floor down to four or five while widening each remaining manager’s span. The Institute for Employment Studies documented that wave at the time. Talk of flattening the pyramid is roughly forty years old.

What is different now is the mechanism and what it does to the residual work. The 1990s wave removed managers and redistributed their coordination burden onto the survivors, which is why spans widened and why manager burnout became a persistent finding. The current wave removes managers and hands the coordination burden to software. That is a genuinely different arrangement, and it explains an otherwise contradictory pair of data points: spans of control keep widening while surveys keep reporting that leadership alignment has degraded. A manager with twenty-five reports and an agent that produces the status summary has solved the reporting problem and not solved the alignment problem, because alignment was never in the reporting bucket.

The parts of management that resist automation are the parts that were never information movement. Deciding who deserves a promotion when two candidates are close. Telling someone their work is not good enough in a way that improves it rather than ending it. Absorbing political pressure so a team can finish something. Judging whether a stated deadline is real. Knowing that a normally reliable person is having a bad quarter for reasons that are none of the company’s business. These are relational and evaluative acts, and they are expensive precisely because they cannot be specified.

The uncomfortable implication is that the automatable 60% was also the visible 60%. It was what showed up in calendars, tickets and dashboards, and it was what justified the headcount in a budget review. The residual 40% is real work with poor telemetry. When a chief financial officer looks at a management layer whose measurable output is now produced by software costing a few hundred dollars a month, the layer looks like overhead. The argument for keeping it depends on evidence the organisation does not systematically collect.

That asymmetry, not model capability, is the strongest force behind the current restructuring. Agents did not have to be good at management. They had to be good enough at the measurable part of management to make the unmeasurable part indefensible in a spreadsheet.

Adoption data points to supervision rather than substitution

The available numbers on agent deployment are messy, inconsistently defined and heavily marketed. Read carefully, they still point in one direction: agents are being deployed into coordination roles, and the coordination role is where adoption has actually stuck.

The clearest signal comes from how organisations describe what their agents do. A 2026 survey of engineering leaders, IT executives and technical decision-makers found that more than half of respondents, 57%, were using agents for multi-stage workflows rather than single-step tasks, while 16% had reached cross-functional or end-to-end processes spanning multiple teams or business functions. Multi-stage workflow handling is coordination by definition. The 16% figure is the more striking one, because a process that spans teams is a process that previously required a manager to hand it across a boundary.

Gartner’s forward projections describe the same movement in decision terms. The firm expects at least 15% of day-to-day work decisions to be made autonomously through agentic AI by 2028, up from close to zero in 2024, and 33% of enterprise software applications to include agentic capability by the same date, up from under 1%. Day-to-day work decisions is a broad phrase, but the decisions that occur at that volume and cadence are overwhelmingly allocation and routing decisions: which queue, which owner, which priority, which threshold. Those are the decisions a supervisor makes hundreds of times a week.

The demand signal is equally telling. Gartner reported that client inquiries relating to multi-agent systems rose by 1,445% between the first quarter of 2024 and the second quarter of 2025. Enterprises were not asking how to build a better single agent. They were asking how to coordinate several, which is a management question dressed as an architecture question.

Set against this is the sobering half of the picture, and it deserves equal weight. Gartner also projects that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. Its January 2025 poll of 3,412 webinar attendees found 19% reporting substantial investment in agentic AI, 42% conservative investment, 8% none, and 31% either undecided or waiting. Deloitte’s survey of around 1,800 executives across Europe and the Middle East found only 6% achieving payback on AI investment inside a year, with most reporting two to four years. Kyndryl found 61% of chief executives feeling more pressure to demonstrate AI returns than a year earlier.

These findings are not in tension with the coordination thesis. They support it. The projects that fail are the ones sold as replacement, where an agent was expected to own an outcome end to end and could not. The projects that survive tend to be the ones where the agent owns the routing and a human owns the outcome. Gartner’s own diagnosis pointed at governance, ownership, data access and unclear value rather than at model capability. Failure by management, not by machine.

Vendor case figures should be read with corresponding care. Salesforce’s internal analysis of its Agentforce deployment at Reddit has been reported as producing an 84% reduction in case resolution time and more than $100 million in annual operational savings. JPMorgan’s LLM Suite has been credited with 83% faster research cycles for portfolio managers and the automation of over 360,000 manual hours a year. Both sets of figures originate with the deploying organisations or their vendors rather than with independent audit, and the underlying definitions are not always specified. They are useful as evidence that large organisations are running these systems at volume. They are not usable as benchmarks.

One structural indicator carries more weight than any headline percentage, because it is a hiring decision rather than a projection: organisations are creating dedicated roles to own agent populations. Compiled 2026 industry data indicates that a majority of enterprises now name an agent owner or an agentic operations lead, up from a small minority two years earlier, and that ownership maturity correlates with the small subset of organisations that actually reach production. A company that has appointed someone to manage its agents has conceded that its agents need managing, which is a different proposition from the one on the sales deck.

The pattern that emerges from all of it is unglamorous. Agents entered the enterprise as coordinators, most of the failures came from asking them to be more than that, and the organisations getting value have responded by building a human management structure on top of the agent management structure. That is two layers of management where the pitch promised none.

The reporting function moves from managers to models

Reporting was the first managerial function to go, and it went quietly because nobody defended it. Nobody enjoyed writing weekly status updates and nobody enjoyed reading them. When a model could read the tickets, the commits, the call logs and the pipeline state and produce a competent summary, the case for a human doing it collapsed within a quarter.

The change looks purely procedural and is not. A status report written by a manager is an act of interpretation with a name attached. The manager decides what to include, what to leave out, how to characterise a slipping deadline and whether to flag a risk now or wait for more information. Those choices carry professional consequences for the person making them. A manager who buries a problem three weeks in a row and is then found out has damaged their standing. The reliability of human reporting rested less on accuracy than on accountability: someone’s reputation was attached to the framing.

An agent-generated report has different properties. It is more complete on anything the systems record, more consistent in format, faster, and available on demand rather than weekly. It is also blind to everything outside the telemetry, and it has no stake in being right. A model summarising a project reports that the test coverage target was met. It does not report that the tests were written to satisfy the metric, because that judgement lives in the head of an engineer who did not write it in a ticket.

This produces a specific and predictable failure: the upward information channel becomes broad and shallow. Executives receive more data about more projects with less signal about which ones are actually in trouble. The soft warning that a competent manager delivers in a corridor conversation before it appears in a document has no equivalent in an automated pipeline.

Harvard Business Review research from June 2026 by Oxford’s Matthias Holweg and Babson’s Thomas Davenport gave the compounding version of this problem a name: knowledge decay. When employees use AI to produce work that reads as polished but contains errors or lacks substance, colleagues downstream spend time verifying, correcting or redoing it, and as those errors propagate across teams the organisation’s collective knowledge base degrades. Applied to management reporting, the mechanism is sharper still, because the reports feed decisions rather than sitting in a drive. A summary that is 95% right and confidently wrong on one item is worse for a resource allocation meeting than a summary that is 80% right and visibly uncertain.

There is a second effect on the humans who remain. When the summary is generated, the manager’s role shifts from author to editor, and editing an artefact you did not construct is a weaker form of understanding than building it. The manager who wrote the report knew the project because writing forced them to look. The manager who approves a generated report knows what the report says.

Some organisations have responded well, and the pattern is worth copying. They treat the generated summary as the floor rather than the deliverable, and require the human owner to add a short, explicitly personal section: what is not in the data, what worries them, what they would change. The generated part answers what happened. The human part answers what it means and who is uneasy about it. That structure keeps the labour saving while preserving the interpretive layer that made reporting useful in the first place, and it puts a name back on the judgement.

Task assignment as a technical act with managerial consequences

Assignment looks like the most mechanical thing an orchestrator does. A request arrives, it is decomposed, pieces are routed. Nothing about it feels like management until you look at what the routing decision encodes.

Every assignment answers three questions at once. Who is capable of this. Who is available for this. Who should be the one doing this. The first two are tractable from data. The third is a judgement about development, fairness, workload and the shape of someone’s job, and it is the reason competent human managers spend real time on allocation rather than treating it as dispatch.

Agent routing systems, as currently built, answer the first two questions well and do not answer the third at all. Routing logic ranks by resolution probability, latency, cost or policy compliance. It has no concept of whether a person has had three hard cases in a row, whether a junior needs a stretch assignment, or whether a particular specialist is being quietly overused because their success rate makes them the model’s preferred destination. A routing function that maximises resolution rate will systematically send the hardest work to the most capable person, which is rational for the queue and corrosive for the person.

This is not a hypothetical failure mode. It is a well-documented consequence of algorithmic work allocation in logistics, ride-hailing and content moderation, arriving now in knowledge work through a different door. The difference is that in those earlier settings the allocation system was recognised as a management system and attracted scrutiny accordingly. An orchestration layer inside a customer operations platform is procured as software.

The second consequence of automated assignment concerns the specification of work, and it is where the technical and managerial readings converge exactly. Berkeley’s MAST taxonomy of multi-agent failures, built from more than 1,600 annotated execution traces across seven frameworks with strong inter-annotator agreement, found that the largest cluster of failures originates in system design and specification rather than in model capability. Analyses of the annotated distribution put roughly two fifths of failures in that category, around a third in inter-agent misalignment, and about a fifth in inadequate verification. Within the design cluster, the most common individual modes include disobeying the task specification, repeating steps already completed and failing to recognise when the task is finished.

Read that as an organisational finding rather than an engineering one. The dominant reason coordinated agent systems fail is that the work was badly briefed, the roles were badly bounded and nobody defined what done looks like. That is the classic failure of a weak manager, reproduced in software at higher speed and lower cost, and it will not be fixed by a stronger model because the missing information was never supplied.

Human workers absorb bad briefs. A developer handed an incoherent ticket asks a question, guesses sensibly, or quietly does the thing that obviously needed doing. This tolerance is so ordinary that organisations forget they depend on it. Isolated worker agents do not have it. They receive a self-contained description and act on it, and if the description is wrong the work is wrong with full confidence and no friction. The tolerance that made sloppy management survivable is absent.

Which produces a paradox that deployment teams hit within weeks. Adopting agents to reduce coordination effort requires a step change in the quality of coordination inputs. Task boundaries have to be explicit. Output formats have to be defined. Termination conditions have to be stated. Tool and data access has to be scoped. Companies with mature process documentation get value from agents quickly. Companies whose processes lived in people’s heads discover that the agents have exposed the gap rather than filled it.

There is a practical asymmetry in how to respond. Improving the specification is cheap relative to improving the model, and it transfers: a well-defined task boundary works with next year’s model too. Teams that treat their agent briefs as durable organisational assets, versioned and reviewed like code, get compounding returns. Teams that treat prompts as disposable configuration rebuild the same understanding every quarter.

Escalation becomes the main interface between humans and agent systems

Escalation is where the digital middle manager exercises the most consequential discretion, and it is the least examined part of most deployments. The threshold that decides which cases reach a human is a policy decision with the properties of a budget: set it low and you drown the humans, set it high and problems reach customers before anyone notices.

The tiered model has become standard practice, and the reasoning behind it is sound. A blanket requirement for human review of every agent action is unworkable once a system takes thousands of actions an hour. What functions instead is automated action within defined limits, escalation logic that routes high-stakes or anomalous cases to human reviewers, and continuous monitoring that surfaces drift before it becomes an incident. Guidance from both governance frameworks and vendors converges on the same trigger set: decisions touching regulatory compliance, financial outcomes, legal exposure or customer trust, plus any situation involving low confidence, incomplete context or circumstances outside the agent’s training and rules.

The subtlety, and the danger, is that the agent evaluates its own confidence. A system that knew reliably when it was wrong would not be wrong very often. Research on agent reliability has shown measurable gains from adding independent trust scoring on top of agent output, with work on the τ²-bench customer-service benchmark reporting failure-rate reductions of up to half when low-trust messages triggered either a human handoff or a regenerated response. The finding is encouraging and its implication is uncomfortable: the escalation decision works better when it is taken away from the agent making the work product. Separation of duties, arrived at empirically.

Escalation design also determines what the human on the receiving end can actually do. Handing a person a flagged case with no history is a different job from handing them a case with the full interaction preserved, the actions already taken, the policy consulted and the specific reason for the flag. The first produces slow, defensive decisions. The second produces fast, confident ones. Systems that preserve full context on handoff report materially better outcomes, and the reason is not mysterious: the human is being asked to make a judgement, and judgement requires the material.

Time pressure has changed character too. When AI systems produced recommendations, a reviewer could take an afternoon. When agents take actions across live systems, the intervention window compresses to seconds, and the consequence of a missed intervention is a wrong payment, an unauthorised data access or a misconfigured system rather than a bad suggestion. Practitioners in identity and access management have begun arguing that oversight needs an execution-pause capability, approval routing to authorised humans, time-boxed decision windows and logging of every intervention, because without an enforcement mechanism a human-in-the-loop checkpoint is decorative.

There is an organisational failure mode here that has nothing to do with technology. Escalation thresholds are usually set once, at deployment, by whoever built the integration, and then not revisited. Nobody owns the number. Six months later, volumes have changed, the agent has been given new tools, the policy has been updated, and the threshold reflects assumptions that no longer hold. A threshold with no owner is a management decision that has been abandoned rather than delegated.

The organisations handling this well treat the escalation rate as a governed metric with a target range, a named owner and a review cadence, and they watch two numbers rather than one: the proportion of cases escalated, and the proportion of escalated cases where the human changed the outcome. A low escalation rate with a high override rate means the threshold is too high and problems are getting through. A high escalation rate with a low override rate means humans are being used as a rubber stamp and the cost is being paid for nothing. Both are visible in a week if anyone is looking.

Exception handling turns into the human job description

When agents absorb the routine, what remains for humans is the residue: the cases that were flagged, the situations without precedent, the decisions with consequences the system was not permitted to accept. This is a coherent job, and it is not the job most of these people were hired to do.

Exception work has properties that make it hard in ways routine work is not. Every case is unfamiliar by construction, because familiarity is what got the other cases automated. The volume is unpredictable, arriving in bursts tied to product launches, outages, seasonal patterns or upstream changes. There is no rhythm to settle into. The easy cases that used to provide recovery time between hard ones are gone, and what is left is a queue composed entirely of the difficult.

This is the well-documented pattern that Lisanne Bainbridge described in 1983 as the ironies of automation, and four decades of aviation and process-control research have not improved on her formulation. Automating the routine parts of a task leaves the human with the parts the automation cannot handle, which are the hardest parts, and it removes the routine practice through which the human maintained the skill to handle them. The operator is left responsible for exactly the situations they have had the least opportunity to prepare for.

The consequences for staffing are concrete. A support organisation whose agents resolve 80% of contacts does not need 20% of its previous headcount. The remaining contacts take longer, require deeper product knowledge, involve more escalation to engineering and legal, and produce more emotionally difficult conversations, because the customers who reach a human have usually already failed to be helped. Teams that sized on volume alone have consistently discovered this after the fact.

Skill requirements move upwards in a way that breaks recruitment. The entry-level version of the role has been automated, so there is nowhere to start. The remaining role demands judgement that was previously acquired by working through hundreds of ordinary cases. Organisations are attempting to hire directly into a position whose training path they deleted, and they are finding the candidates do not exist at the price the budget assumed.

Managerial functions and where agents currently sit

The distribution in the table reflects observed deployment patterns across enterprise agent platforms in 2026 rather than a vendor roadmap. The pattern worth noting is that agents have taken the columns with clear inputs and outputs, and the residual human column is dominated by judgement calls with weak telemetry and no natural training path.

Compensation structures have not caught up. A role that consists entirely of hard cases with authority to override an automated system is more demanding than the role it replaced and is frequently paid on the old band, because the job title did not change. This is a retention problem waiting to be discovered by companies that measure the cost of the agent deployment and not the cost of the turnover it produced.

There is a design response that works, and it is cheap relative to the alternatives. Deliberately route a proportion of routine cases to humans even though the agent could handle them. The purpose is not throughput, it is calibration: practice on ordinary cases maintains the judgement needed for hard ones, and it gives reviewers a live sense of what normal looks like, which is the only reliable basis for recognising abnormal. Aviation reached this conclusion decades ago and built simulator regimes around it. Enterprise agent deployments almost never budget for it, because from a pure throughput view it is waste, and from a competence view it is the training system.

Span of control widens once coordination is subsidised

The most measurable organisational effect of agent coordination is span of control, and the numbers move fast enough to be worth stating precisely.

Gallup first measured average span of control in 2013 at roughly eight direct reports per manager. By 2024 it stood at 10.9. By 2025 it had reached 12.1. Some analyses project a trajectory towards roughly 25 by 2028. Bayer’s restructuring under its shared-ownership operating model has been reported to have compressed eleven or twelve layers to six or seven, with average span reaching about fourteen and some managers carrying as many as ninety direct reports, alongside the elimination of roughly 5,500 roles concentrated in management and a reduction of the internal rulebook by 99%. MIT Sloan research covering companies deploying agentic AI at scale reported spans reaching as high as fifteen in some divisions against a historical norm nearer seven.

The mechanism is straightforward. Span of control was limited by the coordination and information load a single manager could carry. Subsidise that load with software and the ceiling rises. A manager who no longer chases status, compiles reports, assigns routine work or handles first-pass review can nominally supervise two or three times as many people.

The word doing the work in that sentence is nominally. Research on management quality has consistently found degradation beyond roughly eight to ten direct reports, and the reason is not administrative load. It is attention. Coaching, evaluation and early detection of individual difficulty scale with the number of people, and agents do not perform any of those functions. A manager with twenty-five reports and excellent tooling has full visibility into work state and almost none into people.

The survey evidence tracks this exactly. Korn Ferry’s poll of 15,000 professionals found 41% saying their organisation had cut management layers in the previous year, 44% in the United States, and 43% reporting that leadership alignment deteriorated afterwards. Live Data Technologies data reported by the Wall Street Journal showed manager headcount down 6.1% between May 2022 and May 2025, with executive-level roles down 4.6%. Middle-manager burnout runs higher than for any other employee group, with around 45% reporting it in 2025, and one survey by Simon Sinek’s Optimism Company put extreme burnout and disconnection at 75%, with more than a quarter actively planning to leave.

Those findings sit uncomfortably together and the resolution is specific. The coordination burden has genuinely fallen. The relational burden has risen with the span. Managers report being stretched not because they are doing more information work but because they are responsible for more people while having less contact with each of them. Korn Ferry analysts have noted that abrupt flattening produces confusion and dissatisfaction that eventually shows up in productivity.

There is also a straightforward organisational-design error being repeated at scale. Span of control was never a single number; it depended on task variability, interdependence and the experience of the team. Widening it uniformly because a dashboard says coordination is handled treats a heterogeneous problem as homogeneous. A team of twenty senior specialists running well-understood processes can be supervised by one person with good tooling. A team of twenty junior staff learning a variable job cannot, and no orchestration layer changes that, because what the juniors need is the thing the agents do not supply.

The flattening numbers and what they do not prove

The most quoted figure in this whole discussion deserves careful handling. In October 2024 Gartner forecast that through 2026, 20% of organisations would use AI to flatten their structure, eliminating more than half of their current middle-management positions. The prediction has been repeated so often that it now circulates as an established fact about the present rather than a forecast about a subset of firms.

Read the claim precisely. It concerns one organisation in five, not the market. It concerns positions within those organisations, not the occupation as a whole. It is a projection issued before the current generation of agent tooling shipped. Against it sits an inconvenient counterweight: the United States Bureau of Labor Statistics still projects management occupations to grow faster than average this decade. Both can be true. Concentrated elimination in some firms is compatible with aggregate growth driven by others.

Attribution is the harder problem. Manager headcount fell 6.1% over three years, and 2022 to 2025 covers a post-pandemic correction, an interest-rate shock, the unwinding of a hiring boom and a broad cost-cutting cycle across technology and professional services. Amazon cut 14,000 corporate roles in 2025 and cited AI-enabled leaner structures. That citation is a claim by a company with an interest in framing a reduction as strategy rather than retrenchment. Companies have strong incentives to attribute layoffs to AI, because “we restructured around new technology” reads better to investors than “we over-hired”.

Where the evidence is genuinely stronger is at the entry level, and the methodology there is unusually careful. Work by Erik Brynjolfsson, Bharat Chandar and Ruyu Chen at the Stanford Digital Economy Lab, using ADP payroll records across a balanced sample of firms, found employment declines concentrated among workers aged 22 to 25 in the occupations most exposed to AI, including software development, customer service and clerical work, with a relative decline of roughly 13% against comparison groups. Employment for older workers in the same occupations, and for workers of all ages in less exposed occupations, held stable or grew. Adjustment came through employment rather than pay. Declines concentrated in occupations where AI is more likely to automate than to augment.

The authors have been notably disciplined about their own findings. In a February 2026 update they addressed whether interest rates offer a better explanation and found that more AI-exposed occupations are, on average, less sensitive to interest rates. On timing, they reported that with the broadest set of controls the decline in AI-exposed occupations becomes statistically detectable only from 2024, and that earlier declines were probably driven at least partly by other factors. One of the authors described the appropriate response as Bayesian: the results shifted his own estimate of AI’s contribution to the entry-level hiring slowdown, without settling the question.

That is the honest state of the evidence. Entry-level employment in AI-exposed occupations is measurably weaker, the middle-management picture is real but confounded, and the causal share attributable to agents specifically rather than to AI tooling generally is not established.

Which does not make the structural argument weaker, only more specific. The forces reshaping the management layer are not primarily about whether agents can do a manager’s job. They are about cost pressure finding a justification, about coordination becoming cheap enough that the layer looks optional in a spreadsheet, and about a genuine long-run change in what the layer’s residual work consists of. Those forces would be operating even if every AI project of the past two years had been cancelled, and they would be operating more slowly.

The forecasting error to avoid is the one that has already been made twice. In the 1990s delayering wave, firms cut the layer, discovered that coordination still had to happen, and rebuilt much of it under different titles within five years. Programme managers, chiefs of staff, business partners and operations leads are, in substantial part, middle management that came back wearing a different badge. The current wave has a better technical answer for coordination than the 1990s wave did. It has no better answer for the parts of the layer that were never coordination.

Four buckets of managerial work, priced separately

Treating management as one job produces bad decisions in both directions. Unbundling it produces a clearer view of what agents have taken, what they have not, and what has been quietly abandoned.

Reporting. Gathering state and communicating it upwards. Fully automatable where the state is recorded in systems, and now largely automated wherever the tooling has been deployed. What survives is the interpretive layer: which findings matter, what the data does not capture, where the presenter’s own uncertainty lies. Organisations that dropped reporting entirely rather than splitting it have lost that layer without noticing, because the artefact still arrives on schedule and looks the same.

Coordinating. Sequencing work, managing dependencies, handling handoffs, resolving resource conflicts. This is the bucket agents handle best, and where the orchestrator-worker pattern maps most directly. The residual human work is exception coordination: dependencies nobody documented, conflicts requiring negotiation with a peer who has different incentives, and the political work of getting another department to prioritise something. Agents route within a system. They cannot negotiate across a boundary they have no standing to cross.

Reviewing. Checking output for quality before it goes further. Partially automatable, and the partition matters more than the percentage. Agents are competent at conformance review: does this match the schema, does it satisfy the policy, does it contain the required elements, does it contradict the source. They are weak at substantive review, which asks whether the approach was right, whether an unstated assumption is wrong, and whether the output is confidently mistaken in a way that reads as correct. The gap between conformance review and substantive review is precisely where the verification burden has landed on humans.

Translating. Turning strategy into assignments going down, and turning ground truth into strategic input going up. This is the least automatable of the four and the least discussed, because it does not appear in a workflow diagram. Translating downwards requires knowing what the executive actually meant, which usually differs from what they said. Translating upwards requires the standing to tell a senior person something they will not enjoy hearing. Neither is available to a system with no relationships and no exposure.

The four buckets have different substitution economics, and the mistake companies make is applying a single ratio across the bundle. If coordination and reporting are 60% of a manager’s week and both are largely automatable, the naive conclusion is that a management layer can shrink by 60%. The actual conclusion is that the layer’s cheap, visible work has been removed and its expensive, invisible work has been concentrated into fewer people with wider spans, which is a different organisation with a different failure profile rather than a smaller version of the same one.

There is a fifth activity that belongs on the list and rarely appears on any org chart: absorption. A functioning middle manager absorbs pressure, uncertainty and blame, holding them long enough for the team below to keep working. When an executive demands an impossible date, the manager pushes back, buys time or takes the hit. Agents absorb nothing. Pressure applied to an orchestration layer passes straight through to whoever is on the other side, undamped and in real time. Organisations that have flattened aggressively report exactly this symptom without always connecting it to the cause: work feels more exposed, deadlines feel more arbitrary, and there is no longer anyone standing between the strategy and the person doing the task.

Accountability does not delegate to software

Companies can hand coordination to an agent. They cannot hand over responsibility for what the agent decides, and the legal system has been unusually quick to make that clear.

The reference case remains small in money and large in doctrine. In February 2024 the British Columbia Civil Resolution Tribunal ordered Air Canada to pay Jake Moffatt CAD 812.02 after the airline’s website chatbot told him he could apply for a bereavement fare retroactively, contradicting the airline’s published policy. Air Canada’s defence argued that the chatbot should be treated as a separate entity responsible for its own actions. Tribunal member Christopher Rivers called that a remarkable submission and held that the airline was responsible for all the information on its website, whether it appeared on a static page or came from a chatbot. The tribunal found negligent misrepresentation: Air Canada owed a duty of care, failed to take reasonable care that its representations were accurate, and Moffatt reasonably relied on what he was told.

Moffatt v. Air Canada is a small-claims decision in one Canadian province and binds nobody. Its influence comes from how obviously correct the reasoning is. A deployer who chooses to put an automated system in front of customers cannot disclaim the system’s output while keeping the cost savings. The case has been discussed in academic work on the responsibility gap in AI systems and in professional guidance across several jurisdictions precisely because the argument the airline made is the argument every deployer will be tempted to make.

The doctrinal position that has emerged since is that liability rests with the organisation that deploys and authorises the agent. Model providers and platform operators shape behaviour, but the deploying entity defines scope, access and oversight, and autonomous execution does not remove organisational accountability for operational impact. In the United States, existing agency law and electronic-transaction statutes provide the machinery: an agent acting within the authority a principal granted it binds the principal, and that framework was written for human and electronic agents long before language models existed. Regulators have also begun mapping the territory, with the Federal Trade Commission issuing information orders in September 2025 to seven companies operating consumer-facing chatbots about how they evaluate safety and handle harms.

Where this becomes genuinely difficult is internal accountability rather than external liability. A customer harmed by an agent’s decision sues the company, and the company pays. Inside the company, someone has to own the decision, and the ownership question is often unanswerable after the fact. The agent applied a threshold set by a platform team, using a policy document maintained by compliance, on a workflow designed by operations, with tool access granted by IT, under an objective written by a product manager who left in March. Every contributing decision was reasonable in isolation and nobody owns the outcome.

This is not a novel problem in complex organisations, but agents make it worse in a specific way. Human decision chains leave interpretive traces: an email arguing for a threshold, a meeting where someone raised a concern, a person who remembers why the rule exists. Agent decision chains leave configuration. A logged action with a timestamp and a policy reference tells you what happened and not why anyone thought it was acceptable.

The response that works is unglamorous and increasingly standard in mature deployments: assign every agent a named business owner, a risk classification and a documented escalation protocol, and treat those three artefacts as conditions of deployment rather than as documentation. Berkeley’s California Management Review framed this as the core of an agentic operating model, arguing that governance has to be built in by design rather than layered on afterwards, so that accountability stays intact as autonomy increases. Palo Alto Networks’ governance guidance makes the same point from the security side, requiring documentation of purpose, authority scope, access permissions, oversight assignment and escalation procedures, with logs and change records retained for audit.

Named ownership does something that no amount of logging achieves. It creates a person whose professional standing depends on the agent behaving acceptably, which restores the accountability mechanism that made human management reporting trustworthy. An agent with an owner is supervised. An agent without one is a liability with a service-level agreement.

Regulatory pressure lands on oversight rather than autonomy

Regulators have not tried to restrict how autonomous AI systems may be. They have targeted whether humans can actually oversee them, which is a more demanding requirement and lands directly on the arrangement this article describes.

Article 14 of the EU AI Act requires that high-risk AI systems be designed and developed, including through appropriate human-machine interface tools, so that natural persons can oversee their functioning while they are in use. Oversight has to aim at preventing or minimising risks to health, safety and fundamental rights, and the measures must be proportionate to the risk, the level of autonomy and the context of use. The obligations for high-risk systems apply from 2 August 2026, with a later milestone in August 2027 for systems already on the market before enforcement.

The text goes further than a checkbox. The person assigned oversight has to be enabled to understand the system’s relevant capacities and limitations, to stay aware of the tendency to over-rely on its output, to interpret what the system produces, to decide not to use it in a given case, and to intervene or stop operation. For certain biometric identification systems the Act requires that a result be separately verified by two natural persons before action is taken, with a carve-out where Union or national law treats the requirement as disproportionate for law enforcement, migration, border control or asylum use.

The clause with the sharpest teeth for enterprise deployments is the one addressing automation bias. The regulation explicitly anticipates the situation where a nominal human reviewer rubber-stamps whatever the system proposes, and treats designing against that outcome as an obligation rather than a courtesy. Commentary from the International Association of Privacy Professionals has noted that the degree to which an organisation followed the provider’s oversight instructions will matter if the technology causes harm and compliance is examined. The obligation splits across the chain: providers must build systems that can be overseen, and deployers must assign oversight to people with the competence, training and authority to exercise it. Both halves have to fit for either to work.

Academic commentary has been blunt about the weakness in the framework, and the criticism is fair. The Act says oversight must be possible without defining what adequate oversight consists of. There is no standard for how much time a reviewer needs, what override rate indicates real scrutiny, or what training qualifies someone to supervise an agent population. Organisations are being asked to demonstrate something the regulation has not specified, and the specification will be built out through guidance, standards work and enforcement over the next several years.

The NIST AI Risk Management Framework in the United States pushes in the same direction through voluntary means, requiring oversight that is trained, measurable and demonstrable. NIST’s National Cybersecurity Center of Excellence published a concept paper in February 2026 on accelerating adoption of software and AI agent identity and authorisation, which signals where the technical standards are heading. Industry groups including the Coalition for Secure AI have published work on agentic identity and access management, and OWASP’s guidance for agentic applications treats identity and privilege abuse as a top-tier risk category.

For a company running orchestration in Europe, the practical reading is specific. If an agent is coordinating work in a high-risk domain, the escalation threshold is now a compliance artefact. Who set it, on what basis, with what review cycle, and can the assigned overseer actually intervene in time. The oversight requirement runs to the architecture, not to the org chart. A system that requires a human approval it gives a reviewer four seconds to consider is not compliant merely because a person clicked, and an organisation that cannot show its reviewers have the competence and the authority to say no has assigned oversight in name only.

Control planes are becoming the HR systems for agents

The clearest institutional evidence that companies now think of agents as a managed workforce is the emergence of tooling built to manage them, and the vocabulary those products use.

Microsoft made Agent 365 generally available for commercial customers on 1 May 2026, priced at $15 per user per month as an add-on and included in Microsoft 365 E7. Its function is described as a control plane for discovering, governing and securing AI agents across Microsoft, software-as-a-service, endpoint and multicloud environments. The feature list reads like a human resources and IT service management stack fused together: a registry of every agent in the organisation, onboarding through IT-controlled workflows with security policy templates applied at creation, least-privilege scoping of which users, data, tools and Model Context Protocol servers each agent may reach, lifecycle rules that expire inactive agents and flag ownerless ones, performance and business-impact tracking, and audit logging of agent actions and interactions.

Translate the feature names and the parallel is exact. Registry is a personnel record. Onboarding with policy templates is induction. Least-privilege scoping is a job description with access rights. Flagging ownerless agents is finding people with no manager. Expiring inactive agents is offboarding. Performance tracking is performance management. Microsoft did not build an HR system for software by accident; it built the tooling the problem demanded, and the problem turned out to have the shape of workforce administration.

The ecosystem framing matters too. Agent 365 supports agents built on Microsoft platforms alongside partner agents, with Salesforce Agentforce and Databricks Genie supported from 20 May 2026, and integration paths through the Agent 365 SDK for frameworks including LangChain, the OpenAI Agents SDK and the Claude Code SDK. June 2026 updates extended visibility into locally installed agents on managed devices through Defender and Intune, added a shadow AI view, and expanded programmatic governance. Local agents that read files, execute code and act on a user’s behalf outside IT visibility are treated as an endpoint risk to be discovered and either quarantined or formally onboarded.

Shadow AI is the term that gives the game away. An unsanctioned agent running on an employee’s laptop with access to company data is functionally an unregistered worker with system privileges, and the organisational response mirrors the response to contractors who were never put through onboarding: find them, assess what they can reach, and either bring them under policy or remove their access.

Microsoft’s own internal account describes running two complementary control planes, one for Copilot and one for agents, on the grounds that agents take on broader responsibilities across services, teams and data boundaries while Copilot surfaces intelligence inside individual workflows. That distinction is a seniority distinction. Copilot assists a person. An agent operates across boundaries a person would need authority to cross.

Independent commentary has read the launch as an admission rather than a product release: agentic AI has already escaped the boundaries of controlled pilots, and the vendor is positioning itself as registry, policy broker and security layer for a class of software multiplying faster than conventional IT governance can track. The June preview features moved towards attack-path management, mapping for each agent the devices it runs on, the MCP servers configured for it, the identities associated with it and the cloud resources those identities can reach. An agent that can read a local repository is one exposure. An agent that can read a repository, call an MCP server, authenticate as a privileged identity and reach production is a different category of exposure entirely.

The strategic point for anyone building an operating model is that the control plane is not optional infrastructure and is not free. It carries a per-seat licence cost, an implementation project, an ownership assignment and an ongoing administrative burden. Organisations that budgeted for agents as a software subscription and not as a managed population are discovering the second cost line after the first audit. The companies that reach production, on the available evidence, are disproportionately the ones that appointed an owner and stood up governance before scaling rather than after.

Identity turns into the real org chart

If you want to know how an organisation is actually structured, the honest answer in 2026 is to look at its identity system rather than its org chart. That is where the real permissions live, and the permission graph has grown faster than anyone’s ability to govern it.

The headline ratios vary widely and the variation is itself informative. Palo Alto Networks’ 2026 identity security survey, based on responses from 2,930 cybersecurity decision-makers and successor to the CyberArk survey series, found machine identities outnumbering human identities 109 to 1, up from 82 to 1 a year earlier, with roughly 79 of every 109 being AI agents. GitGuardian’s State of Secrets Sprawl 2026 put the ratio at 80 to 1. Entro Security research summarised by the Cloud Security Alliance found 144 to 1 in cloud-native environments, up from 92 to 1 in the first half of 2024, while noting an average nearer 45 to 1 across all enterprise environments. One published audit of a large financial institution reportedly found over 4.2 million non-human identities against roughly 50,000 human accounts.

The numbers disagree because nobody has agreed what counts as an identity, which is exactly the governance problem the numbers are describing. A service account, an API key, an OAuth token, a machine certificate and an agent with delegated authority all appear in the same inventory and carry radically different risk. What all the surveys agree on is direction and rate: the population is growing quickly, agents are a rising share of it, and the controls were designed for humans who log in.

The credential picture is the part that turns an identity statistic into an operational risk. GitGuardian recorded 28.65 million new hardcoded secrets in public GitHub commits during 2025, a 34% year-on-year increase, with AI-service secrets rising 81% to about 1.275 million exposed credentials. In the first year of Model Context Protocol adoption, 24,008 unique secrets appeared in MCP configuration files on public GitHub, partly because quickstart guides normalised putting API keys directly into configuration. Internal repositories were found several times more likely to contain hardcoded secrets than public ones, on the assumption that internal means safe. Cloud Security Alliance analysis found that around a quarter of organisations take more than a day to rotate or revoke an exposed credential after detection.

For the orchestration question this matters in a specific way. An agent that coordinates work needs broad access by definition: it has to read the systems it monitors, call the tools it delegates to, and write to the queues it assigns into. A digital middle manager is, in access terms, one of the most privileged entities in the organisation, and it holds that privilege continuously rather than during a shift. The human manager whose function it replaced had access to the same systems but used it at human speed, under human observation, with an audit trail attached to a named employee subject to employment consequences.

Standards bodies have started responding. The NIST National Cybersecurity Center of Excellence published a concept paper in February 2026 on software and AI agent identity and authorisation. The Coalition for Secure AI published work on agentic identity and access management in March 2026. OWASP’s Top 10 for agentic applications lists identity and privilege abuse as a top-tier category. The direction of travel is towards agent identities that are first-class, individually attributable, short-lived and continuously evaluated rather than long-lived service accounts inherited from a deployment two years ago.

The organisational reading is worth stating plainly. Access is authority. An orchestration agent with permissions across finance, operations and customer systems has been granted a scope of authority that, if it belonged to an employee, would require an approval chain, a background check and a documented review cycle. Most organisations granted it through an integration ticket.

Reliability limits explain why agents supervise instead of replace

The reason agents ended up in coordination roles rather than execution roles is not preference. It is a measured property of current systems, and the measurements are specific enough to plan around.

METR’s work on task-completion time horizons provides the cleanest framing. The metric expresses capability in units of human time: the length of task, measured by how long a human expert takes, that a model can finish at a given success rate. The headline finding is that the 50% time horizon has doubled roughly every seven months since 2019, and more recent analysis suggests the doubling time through 2024 and 2025 may have shortened to around four months. GPT-2 measured in seconds. Claude 3.7 Sonnet reached around fifty minutes. GPT-5 was measured at roughly two hours and seventeen minutes with a wide confidence interval. By early 2026, frontier measurements were reported in the range of half a working day.

The second finding is the one that determines organisational design, and it gets far less attention. The 80% time horizon runs four to six times shorter than the 50% horizon. Claude 3.7 Sonnet’s 50% horizon of about an hour corresponded to an 80% horizon of roughly fifteen minutes. The doubling rate is similar for both thresholds, so the gap persists as capability improves rather than closing. A model that succeeds half the time on eight-hour tasks succeeds four times out of five only on tasks measured in the low hours.

METR has been explicit about how the metric should not be read. A 50% time horizon of X hours does not mean tasks under X hours can be delegated. Some tasks, particularly those that are reliability-critical or hard to verify, require success probabilities above 98% before automation makes sense. Doubling the time horizon does not double the degree of automation, because even where the system needs half as many human interventions, it tends to fail in more complex ways that cost more human labour per intervention.

That last point is the crux of the coordination pattern. A system that fails 20% of the time on a four-hour task is unusable as an autonomous worker and perfectly usable as a coordinator, because coordination errors are cheap to detect and cheap to correct while execution errors are neither. If the orchestrator produces a bad plan, the next iteration fixes it. If a worker agent issues a wrong refund, the money has moved.

Benchmark evidence on repeated attempts sharpens the picture further. τ-bench, which simulates customer-service domains with a language model playing the user and requires the agent to follow a written policy, introduced a metric measuring the probability of succeeding on all of k repeated attempts. The reported gap was stark: 61% success on a single attempt against 25% across eight attempts for the same model on retail tasks. Consistency, not peak capability, is what production work requires, and consistency is where the deficit sits.

Policy adherence is the property that makes τ-bench relevant to enterprise deployment specifically. An agent that books the correct flight while waiving a fee the policy says cannot be waived has failed, even though the customer is satisfied and the task looks complete. That is exactly the failure a supervisor exists to catch, and it is the reason organisations in regulated sectors keep humans at the point where policy meets discretion.

Long-horizon degradation adds a further constraint that bears directly on coordination architecture. Analysis of agent failures has found frontier models succeeding near-universally on tasks a skilled human completes in under about four minutes, and under 10% of the time on tasks taking humans more than roughly four hours. Studies of long-context web agents report success rates of 40% to 50% on short-horizon versions of a task falling below 10% when the same task is embedded in a longer interaction history, even where the relevant information technically remains inside the context window. Information being present is not the same as information being used.

That finding is precisely why isolated worker contexts became the dominant design. Giving each worker a fresh context and a bounded task is not an elegance choice, it is a mitigation for measured degradation over long histories. It also explains why the orchestrator has to carry the state: someone has to remember the plan, and the workers cannot be trusted to hold it.

Benchmark numbers deserve a general warning that applies to everything in this section. Agent scores are the most scaffold-sensitive figures in AI, and the same model can post very different results under different scaffolding. Leaderboard positions are inflated by contamination, scaffolding differences and single-run reporting. Independent verification work found that a substantial portion of the original τ-bench airline tasks contained flawed ground truth or ambiguous specifications, prompting researchers to restrict evaluation to a cleaned subset. The correct use of these benchmarks is directional: they establish that reliability lags capability by a wide margin, and they do not establish a service level for your workflow. The only number that matters for a deployment decision is the one measured on your own tools, your own data and your own policies.

Failure modes cluster in coordination, not capability

When multi-agent systems fail in production, the failures are not distributed the way most teams expect. They concentrate at the seams, and the seams are managerial.

The Berkeley work behind the Multi-Agent System Failure Taxonomy is the most systematic evidence available. Researchers collected more than 1,600 annotated execution traces across seven multi-agent frameworks and several model families, developed the taxonomy through detailed analysis of an initial 150 traces with expert annotators, and validated it with high inter-annotator agreement. The result was fourteen distinct failure modes in three categories: system design and specification issues, inter-agent misalignment, and task verification failures. Reported distributions place roughly two fifths of failures in the design category, around a third in misalignment and about a fifth in verification, with exact proportions varying by the trace set analysed.

The individual modes read as an audit of bad management practice. Disobeying the task specification. Acting outside the assigned role. Repeating steps already completed. Losing track of earlier conversation. Failing to recognise that the task is finished. Within misalignment: context collapse as messages accumulate, format mismatches where one agent emits YAML and the next expects JSON, conflicting objectives where two agents believe they own the same resource, and ambiguity inherent to communicating through unstructured text.

The authors’ own conclusion is the important one for anyone deciding where to invest. Many of these failures stem from organisational design rather than from model limitations, and improving system design, coordination and verification raises reliability independently of advances in the underlying models. A stronger model does not fix an unstated termination condition. It executes the ambiguity faster.

One insight from the work resists the obvious fix. Solutions focused on context sharing or communication protocols are often not sufficient for misalignment failures, which appear to require deeper social reasoning: the ability to notice that a peer’s assumption conflicts with your own and to raise it. Human teams do this constantly and cheaply. Isolated worker agents cannot do it at all, and agents that can talk to each other tend to compound confusion rather than resolve it, which is why constrained topologies remain the enterprise default.

Later research has added a category that operations teams find more alarming than task failure. Work on silent failures in production agent runtimes examines incidents that did not visibly fail any task, kept every detector green, and were discovered hours or months later. The taxonomy’s authors distinguish their unit of analysis from MAST’s explicitly: MAST describes why agent collectives fail at tasks, while their work describes why an agent system in operation fails its operator without anyone noticing. An orchestrator that quietly stopped escalating a class of case is not a failed system by any dashboard measure. It is a system that has narrowed what humans can see.

Failure attribution has become its own research problem, which is itself a finding about complexity. Benchmarks now exist specifically for identifying the first unrecoverable failure in an agent trajectory, drawing on tool-calling traces, incident-management multi-agent systems and generalist web and file agents. If locating the point of failure in a completed run requires a dedicated model and a purpose-built benchmark, then diagnosing it during an incident, under time pressure, with a customer waiting, is not something a support engineer will accomplish by reading logs.

The practical guidance that falls out of this literature is consistent and cheap relative to its value. Set up structured tracing before deployment rather than after the first incident. Assign correlation identifiers to every message and tool call so an execution path can be reconstructed. Define termination conditions explicitly. Specify output formats at every boundary. Give each agent a bounded role and check that it stays inside it. None of this is machine learning work. It is process design, and it is the part organisations skip because it does not feel like building.

Verification cost is the hidden tax on agent management

The economics of agent coordination depend on an assumption that is rarely tested: that checking the output costs less than producing it. Where that assumption holds, the arithmetic works. Where it fails, the organisation has moved cost rather than removed it.

The most quoted evidence comes from research by BetterUp Labs and Stanford’s Social Media Lab, published in Harvard Business Review in September 2025, which named the phenomenon workslop: AI-generated content that presents as competent work while lacking the substance to advance the task. Of 1,150 full-time United States employees surveyed, 40% reported receiving such output in the previous month, and those who had encountered it estimated that around 15.4% of the content reaching them qualified. Respondents reported spending an average of one hour and fifty-six minutes dealing with each instance. Based on self-reported salaries the researchers calculated an invisible tax of roughly $186 per month per affected employee, which they extrapolated to more than $9 million a year for an organisation of 10,000 people.

The distributional detail matters more than the totals. Workslop shifts the burden downstream: it transfers effort from creator to receiver, which means the productivity gain and the productivity cost land on different people and appear in different budgets. Roughly 40% of incidents occurred between peers and 18% flowed from direct reports up to managers. The relational damage was measurable too: around half of respondents viewed colleagues who sent such output as less capable and less reliable than before, 42% as less trustworthy and 37% as less intelligent.

Commentary from the HKU Centre for AI, Management and Organisation framed the underlying shift as an evaluation tax and identified the mechanism precisely. Before generative tools, appearance and substance were loosely coupled. Length, polish and coherence were imperfect but informative signals of effort, which meant weak work was usually cheap to spot. That coupling has broken. Producing a fluent, correctly formatted memo, deck, analysis or block of code is now nearly free, so the signals reviewers relied on to triage what deserved scrutiny no longer carry information. Everything has to be checked, or nothing does.

Applied to agent coordination the implication is direct. If an orchestrator produces a plan that reads as coherent, a human reviewer cannot tell from its surface whether the decomposition is sound. If a status summary is well structured, the structure says nothing about whether the underlying assessment is right. The reviewer either verifies against sources, which costs close to what producing the summary would have cost, or approves on presentation, which is not review.

The response reported in Harvard Business Review is honest about the irony. Fixing the problem requires investment in verification processes, quality standards and human oversight, which consumes exactly the employee time the adoption was meant to release. Companies that froze hiring on the basis of projected AI productivity gains may find those gains illusory if work quality degrades faster than headcount shrinks.

Two things follow for anyone running an agent coordination layer, and both are actionable this quarter.

Verification cost has to be a line item in the business case. A deployment that saves twenty hours of coordination and adds twelve hours of review has saved eight hours, not twenty. Most business cases as written capture the first number and not the second, because the review time lands in a different team’s timesheet. The organisations getting reliable value are the ones that measured both before scaling.

Verification cost falls fastest when the output is structured to be checkable. A summary with citations to source records can be spot-checked in minutes. A plan with explicit assumptions can be reviewed by testing the assumptions rather than the whole plan. Output that carries a confidence signal, tied to independent scoring rather than to the producing model’s self-assessment, lets reviewers allocate attention where it pays. This is design work on the output format, and it changes the verification economics far more than any adjustment to the model.

The strategic risk is subtler than any single cost line. Standard adoption dashboards measure logins, prompts, active users and estimated time saved, all of which capture whether people are using the tooling and none of which capture whether the work is accurate or useful. A wide gap between executive enthusiasm and employee frustration is the reliable early symptom: leadership sees adoption and faster output while staff see the cleanup, and only one of those experiences is being measured. An organisation tuning a metric that excludes its largest cost will scale the cost with confidence.

Automation complacency and the rubber-stamp problem

Oversight that exists on paper and not in practice is the most common failure in agent governance, and it is not caused by lazy reviewers. It is caused by putting competent people in a position where genuine scrutiny is impossible and then recording their clicks as approval.

The mechanism is well established across decades of human-factors research in aviation, medicine, process control and rail. When an automated system is right the overwhelming majority of the time, human monitors stop monitoring. Vigilance degrades with reliability, not against it. The better the system performs, the less attention it receives, and the less capable the monitor becomes of catching the case where it is wrong. A system that is right 99% of the time creates a reviewer who has been trained by experience to approve.

Regulators have absorbed this. The EU AI Act’s oversight requirements explicitly reference the tendency to over-rely on automated output, and commentary on Article 14 has noted that human oversight is the requirement most often reduced to a ticked box: organisations advertise a theoretical human in the loop while in practice the operator approves whatever the machine proposes, with no real capacity to understand, contradict or stop the system.

Practitioners working on agentic identity have made the sharpest version of the argument: presence is not practice. Most organisations put someone in the loop without training them on what to approve, when to escalate or how to recognise their own complacency. The comparison drawn is with aviation, where crew resource management and simulator-based training converted pilot oversight from a formality into an operational discipline. Simulators do not only teach people to fly the aircraft. They teach judgement under pressure: when to escalate, when to hand off, when to abort.

There is a structural condition that makes complacency worse in agent deployments than in the settings where this research was developed. In aviation, the monitor and the automation are working on the same task in real time, and the human retains the skill through periodic manual operation. In an agent deployment, the reviewer sees only flagged exceptions, has no ongoing practice on routine cases, and receives the case at the end of a process they did not observe. They are being asked for judgement about a trajectory they cannot see.

Four design responses have evidence behind them, and none is expensive.

Give the reviewer time proportional to the decision. An approval interface with a four-second window produces approvals, not review. Time-boxed decision windows should be set by decision consequence rather than by throughput targets.

Show the reasoning, not just the recommendation. A reviewer presented with a conclusion can only agree or disagree. A reviewer presented with the steps, the sources and the specific reason for escalation can find the error.

Track override rates as a health metric. An oversight function with a near-zero override rate is either supervising a perfect system or not supervising at all, and the second is far more likely. Sampling a proportion of approved cases for independent review is the only way to tell which.

Maintain calibration through deliberate practice. Reviewers need regular exposure to cases where the agent was wrong, including constructed ones. Organisations that run periodic exercises using known-bad agent output find that reviewer accuracy holds. Organisations that do not find that it decays quietly, and they find out during an incident.

The uncomfortable summary is that real oversight of an agent population costs money in trained people, protected time and deliberate slack, and the business case for the agent deployment was usually built on removing exactly those costs. Oversight that is cheap enough not to affect the return on investment is usually oversight that does not work.

Invisible orchestration and the loss of protective behaviour

A preprint published in 2026 examined a risk specific to the orchestrator-worker arrangement, and its finding deserves attention from anyone building coordination layers because it concerns a safety property that disappears without any component malfunctioning.

The setup is the one now standard in enterprise deployment: a coordinating agent manages specialised worker agents, decomposing user requests into subtasks and delegating them. The researchers note that this has become the dominant architecture for enterprise AI, citing the sharp rise in analyst inquiries about multi-agent systems and projections that a large share of enterprise applications will incorporate agents. Prominent examples span coding assistants and multi-model orchestration platforms across healthcare, legal document processing, financial analysis and software engineering.

The problem they identify is that worker agents cannot see the human. A worker receives a task description from the orchestrator and has no visibility into who the ultimate requester is, what their situation is, or what the request looked like before decomposition. Protective behaviours that models exhibit when they can see a person at risk do not trigger, because from the worker’s perspective there is no person, only a task. The paper describes this as suppression of protective behaviour, coupled with a dissociation of power-holders: the entity with the authority to act is separated from the context that would inform whether acting is appropriate.

Consider the shape of it in a plausible enterprise setting. A user makes a request that, read whole, carries a signal that something is wrong: distress, urgency, an unusual pattern, a mistake with serious consequences. The orchestrator decomposes it into technically neutral subtasks. Each worker executes its subtask correctly. No component fails. The signal that a human would have caught in the original phrasing was destroyed by decomposition, because decomposition retains what is needed for execution and discards what is needed for judgement.

The organisational analogy is exact and familiar to anyone who has worked in a large company. A request passes through three layers of management, each summarising for the next, and by the time it reaches the person who will act on it, the context that made it urgent has been abstracted away. Everybody did their job. The outcome was wrong. What is different is speed and the absence of the informal channel: a human three layers down can pick up a phone and ask what this is really about. A worker agent cannot form the question.

This is a design problem rather than a model problem, which means it has design solutions. Preserving the original request verbatim alongside the decomposed task lets a worker see what was actually asked. Passing context flags for sensitivity, urgency or unusual characteristics gives workers something to act on. Routing categories of request to human review before decomposition prevents the loss entirely for the cases where loss matters most. Each of these costs tokens, latency and design effort, and each is easy to omit because the system works without it right up until the case where it does not.

The broader lesson generalises past the safety framing. Decomposition is lossy, and what it loses is exactly the material that judgement requires. An orchestrator tuned for clean task boundaries strips out ambiguity, and ambiguity is often where the important information was. Human middle managers do this too, which is why every large organisation has a story about a decision that was correct at every step and wrong in aggregate. The agent version runs faster, at higher volume, with no corridor conversation available to catch it, and with logs that will show every step as compliant.

Banking and insurance move first for structural reasons

Adoption of coordinated agent systems is not evenly distributed, and the pattern is not random. Compiled 2026 industry data indicates banking and insurance running roughly 47% of enterprises with at least one agent in production, against a cross-industry rate near 31% and figures nearer 18% in healthcare and 14% in government. Those specific numbers come from aggregated analyst sources rather than a single audited survey and should be read as indicative, but the ordering is consistent across the available data and the reasons are structural.

Financial services had the prerequisites already. Decades of regulatory pressure produced documented processes, defined approval hierarchies, mandatory audit trails, established four-eyes controls and formal risk classification of decisions. These are exactly the artefacts an agent deployment needs and exactly what most organisations lack. A bank that already knows which decisions require dual approval, which are delegated to a specified authority level, and which must be logged in a particular format can specify an agent’s boundaries in an afternoon. A marketing department whose approval process is a manager’s judgement about when something feels ready cannot.

The work profile fits too. Financial services generate high volumes of similar cases with clear correctness criteria and existing exception paths. Loan pre-qualification, claims triage, transaction monitoring, know-your-customer document review and reconciliation are all coordination-heavy processes with defined escalation routes. An agent that routes and pre-processes while a human decides the marginal cases maps onto the existing operating model with no organisational redesign required.

Payback data reflects this. Compiled figures put median time-to-value on agent deployments at around five months across functions, with sales development agents paying back fastest at roughly three and a half months and finance and operations agents slower at nearly nine. The slower finance figure is not a failure signal, it is a governance signal: those deployments carry more review, more controls and more compliance work before they go live.

The counterexamples are equally instructive. Healthcare’s slower adoption is not a technology gap. It reflects consequence asymmetry: a wrong clinical decision cannot be reversed by a corrected iteration, patient data carries the heaviest handling obligations, and clinical judgement resists specification. Government’s slower rate reflects procurement cycles, accountability requirements to elected bodies, and the absence of a competitive forcing function.

For sectors between the poles, the practical question is not whether their industry is ready but whether their processes are documented well enough to specify. The organisations that deployed agents fastest were not the most technically sophisticated. They were the ones whose processes were already written down, usually because a regulator made them write them down.

There is a strategic reading for the middle of the market that cuts against the usual advice. The first-mover advantage in agent coordination is smaller than vendors suggest, because the tooling improves quickly and integration work depreciates. The durable advantage is process clarity, which does not depreciate and which is required regardless of which platform eventually wins. A company that spends two quarters documenting its actual workflows, defining decision authority levels and writing down escalation criteria has built an asset that pays off with any tooling, including tooling that does not exist yet. A company that buys an orchestration platform to avoid that work has bought an expensive way to discover that its processes were never specified.

Software engineering shows the pattern in its purest form

Software teams adopted agent coordination earlier and further than anyone else, which makes them the closest thing to a natural experiment in what happens when a digital middle manager is installed in a working team.

The pattern is now unremarkable in practice. A developer states an objective in a coding tool. A primary agent decomposes it, dispatches specialist subagents defined by role, and each subagent works in an isolated context with a scoped tool set. Published configurations use roles copied directly from team structures: a backend architect for API and schema design, a frontend specialist, a devops engineer, a code reviewer. Each is defined by a short description of its remit, a tool allowlist and a role instruction. Development teams are, quite literally, writing job descriptions for software.

The isolation is deliberate and documented. A subagent invoked for a task receives only what is relevant to its task plus persistent project context, and does not see the whole dialogue history or unrelated work. The stated purpose is preventing cross-contamination between phases and keeping each agent focused. Anyone who has managed engineers will recognise the trade-off: focus improves output quality and destroys the peripheral awareness that lets a developer notice that the ticket contradicts something decided last week.

The organisational effects inside engineering teams have been consistent enough to generalise. Senior engineers spend more time on specification and review and less on implementation, which is a shift from doing to directing. The role of the technical lead has become closer to a reviewing architect than to a working peer. Code review load has risen sharply, because generated volume rose faster than review capacity, and review has become the binding constraint on throughput in a growing number of teams.

The entry-level effect is where the evidence is most concrete and least comfortable. Stanford’s payroll-based research found employment declines concentrated among 22 to 25 year olds in AI-exposed occupations, with software development among the clearest cases. The traditional junior developer path started with small, well-defined, low-risk tasks: bug fixes, test coverage, documentation, small features. That is precisely the category current agents handle most reliably. The rung has been removed from the ladder, and the ladder’s upper rungs still require the skills the lower rung taught.

Some teams have found responses that work. Juniors are assigned review responsibility earlier than would previously have been sensible, which develops evaluative judgement even before implementation fluency is established. Others deliberately reserve categories of implementation work for human juniors on the explicit grounds that skill development is a capital investment rather than a cost. The teams doing neither are running a strategy that depends on hiring mid-level engineers who were trained somewhere else, at a moment when everywhere else is doing the same thing.

The security dimension deserves a mention because it is measurable rather than speculative. GitGuardian’s analysis found that commits co-authored by coding agents leaked secrets at roughly twice the baseline rate. That is not a claim about model carelessness so much as a claim about volume and review: more code, generated faster, reviewed less carefully per line, produces more of every category of defect including credential exposure. The failure is in the supervision layer, which is the human one.

There is a finding from this sector that transfers to every other. Teams that got the most from agent coordination were the teams with the strongest existing engineering discipline: good tests, clear interfaces, documented conventions, small changes, fast feedback. Those practices make agent output cheap to verify, and cheap verification is what makes coordination profitable. Agents did not compensate for weak process. They raised the return on strong process and raised the cost of weak process, which widened the gap between teams rather than closing it.

Customer operations and the economics of escalation

Customer service was the first function where agent coordination reached scale, and it now provides the clearest picture of what the intermediate arrangement does to a workforce.

The operating pattern is settled. Agents handle common, well-scoped queries, maintain the conversation state, summarise context and propose next actions. When confidence drops below a threshold, or when the case touches a regulated or high-consequence area, the interaction escalates to a human with the history preserved. The business case is simple and largely holds: routine resolution is faster and cheaper through an agent than through a queue of people.

The consequences for the human side of the operation are where the arithmetic gets misread. Three effects show up consistently and none of them appear in the initial business case.

Case mix hardens. The contacts reaching humans are the ones an agent could not resolve, which means they are more complex, more likely to involve an angry customer who has already failed to get help, and more likely to require coordination with engineering, billing or legal. Average handling time rises, and it rises more than volume falls in a material proportion of deployments.

Emotional load concentrates. Routine interactions include pleasant ones. Removing them removes the recovery that made the difficult ones bearable. Attrition in post-deployment support teams has repeatedly come in above forecast, and the forecasts were built on volume assumptions rather than on case-mix assumptions.

Judgement requirements rise while the training path closes. The remaining role needs deep product knowledge and confident authority to make exceptions. Both were previously acquired by handling hundreds of ordinary cases first. Companies are now recruiting for a senior-judgement role with no internal pipeline to fill it.

Escalation quality is the single largest determinant of whether the model works, and it is under-engineered almost everywhere. A human receiving a case with the full interaction history, the actions already taken, the policy consulted and the specific trigger for escalation can resolve it quickly and confidently. A human receiving a flagged ticket with a one-line summary starts from nothing and behaves defensively. The difference in resolution time and outcome quality between those two designs is larger than the difference between model generations.

Policy adherence is the risk that regulated operations underweight, and the τ-bench benchmark exists because of it. An agent that satisfies a customer by granting something the policy forbids has created a liability while producing a positive satisfaction score. Standard customer service metrics do not detect this. Satisfaction scores measure whether the customer was pleased, and a policy violation frequently pleases the customer. Operations running agents at volume need a separate compliance sampling process, and the teams that skipped it have generally discovered the exposure through an audit rather than through a dashboard.

The vendor-reported outcomes should be read with the caveat attached earlier. Salesforce’s internal analysis of its Reddit deployment has been cited as showing an 84% reduction in case resolution time and over $100 million in annual savings. Those figures are not independently audited and the metric definitions are not always clear. They are credible as evidence of scale and unreliable as a planning basis, and any organisation modelling its own case on them should assume its results will differ substantially.

Marketing, SEO and content teams under agent coordination

Marketing organisations adopted agent coordination fast, for a reason that has little to do with strategy: their output is text and images, their volume expectations are elastic, and nobody dies when a blog post is wrong. The result has been an unusually clear demonstration of what happens when a coordination layer is installed without a verification layer.

The typical arrangement looks like a small agency compressed into software. A coordinating agent takes a brief, produces a content plan, dispatches research, drafting, on-page refinement and formatting to specialist agents or tools, assembles the output, and routes anything sensitive to a human. Search and content teams have layered further specialisation on top: entity coverage checks, internal linking, schema generation, competitive gap analysis and performance monitoring, each handled by a scoped process that a coordinator triggers on a schedule.

The productivity numbers on production are genuine and large. The distribution problem is that the constraint in content operations moved from production to selection and verification, and most teams scaled production. A team that can produce forty articles a month instead of eight is not worth five times as much if its distinguishing asset was editorial judgement about which eight were worth writing.

Search itself has made this more consequential rather than less. Answer engines, AI Overviews and assistant-mediated search reward content that is specific, verifiable and genuinely informative, and they are increasingly indifferent to volume. A coordination layer that produces competent, unremarkable coverage of topics everyone else has covered is producing exactly the category of content that generative retrieval collapses into a single summarised answer with no click. The advantage sits with content carrying original data, first-hand experience, specific claims traceable to sources, and positions a model cannot synthesise from consensus. None of those are things an orchestration layer supplies.

The verification economics in marketing are worse than in most functions, and this is under-appreciated. In engineering, tests catch a large class of errors automatically. In finance, reconciliation does. In content, the failure mode is a plausible sentence that is subtly wrong: a misattributed statistic, a date shifted by a year, a study characterised in a way its authors would reject, a regulatory requirement stated as of last year. These errors are invisible to every automated check and expensive for a human to catch, because catching them requires going back to the source. A team publishing at agent-enabled volume without proportionate fact-checking capacity is accumulating a liability that surfaces as a correction, a lost client or a quiet decline in domain trust.

The organisational shift inside marketing teams follows the general pattern. The junior content role has thinned, because first-draft production was the junior job. Senior roles have moved towards briefing, source verification, positioning and editorial judgement. The middle of the department, where a content manager coordinated freelancers, tracked a calendar and reviewed drafts against a brief, is the part most directly substituted by the coordination layer, and it is also where editorial standards were historically enforced.

For agencies specifically, the commercial consequence deserves stating plainly. If the deliverable is volume of competent content, the price of that deliverable is falling towards the cost of the tokens plus a margin, and clients will work that out. The defensible offer is the part agents cannot supply: original research, primary sources, subject-matter authority, distribution relationships, strategic judgement about what to say and what not to say, and accountability for the result. The agencies that will struggle are the ones whose actual product was coordination, because coordination is the thing that just became cheap.

The internal governance point mirrors every other function. A content coordination agent with publishing access is a system that can put statements into the world under the company’s name. It needs a named owner, a defined approval boundary for anything factual or regulated, and an audit trail. Most content stacks were assembled without any of those, on the reasonable-seeming grounds that a blog is low risk, and the reasonable-seeming grounds stop applying the first time a wrong claim about a product, a price or a legal requirement is published at scale.

Professional services and the billable-hour problem

Professional services firms face the sharpest version of the coordination question, because their revenue model is built on the thing that agents took.

The structure of a consulting, legal or accounting engagement has been stable for decades. A partner sells and owns the relationship. A manager or senior associate structures the work, allocates it, reviews it and assembles the deliverable. Junior staff do research, analysis, document review and drafting. The economics depend on staffing ratios: many billable juniors under each partner, with the coordination layer making those ratios workable.

Agents attack both ends. The junior work is substantially automatable: document review, precedent search, first-draft analysis, data extraction, comparative research. The coordination layer is exactly what orchestration tooling does. What remains is the partner’s judgement, the relationship, and the accountability for the advice, which cannot be delegated to software for the same reasons a company cannot delegate liability for its chatbot.

The pricing problem is immediate and unsolved. If the work took forty hours and now takes eight, a firm billing by time has reduced its own revenue by 80% on that engagement while its cost base has fallen much less, because the remaining eight hours are senior hours. Firms are attempting value-based pricing, outcome pricing and subscription models, with mixed results, and the transition is genuinely difficult because clients have decades of experience anchoring on rates.

The quality problem is more serious than the pricing problem and gets less attention. Professional advice carries liability, and liability requires that a qualified person actually verified the output. A partner signing off on a memo largely produced by an agent, reviewed under time pressure by a senior associate who did not build the analysis, is exposed in a way that is difficult to price and difficult to insure. The verification burden has risen at exactly the level of the firm that has the least available time, and the traditional mechanism for managing it, delegating review to a manager, is the layer being thinned.

There is also a structural threat to the firm’s core asset. A professional services firm’s durable value is the accumulated judgement of its senior people, which was built by doing the junior work, then supervising it, then owning it. Automating the first stage and thinning the second breaks the production process for the third. A firm that stops producing partners in ten years has a business model problem that no productivity gain compensates for.

Some responses look sound. Restructuring junior roles around supervision and verification of agent output develops evaluative judgement earlier, even if it develops it in a different order. Charging explicitly for verification as a distinct service acknowledges what clients are actually buying: not the document, but the accountable assurance that the document is right. Investing in proprietary knowledge assets, methodologies and data that agents cannot reproduce from public sources shifts the defensible ground away from labour.

The firms in the most difficulty are the ones whose product was, in substance, the coordination of commodity work at scale. That describes a large share of mid-market consulting and a sizeable share of legal process work. When the coordination is free and the underlying work is automatable, the business is left selling accountability, which is a real product with a much smaller revenue line.

Career pipelines break where the middle used to be

The most durable consequence of automating coordination may have nothing to do with the current generation of workers. It concerns the people who will not become senior leaders because the roles that produced them no longer exist.

The mechanism is simple and has been noted by analysts watching the flattening data. Organisations eliminating middle managers in 2026 are dismantling the apparatus that would have produced senior leaders in 2028 and beyond. The bench thins from two directions at once: the people who would have grown into the role are gone, and some of those who remain have concluded the role is not worth wanting. The Bureau of Labor Statistics still projects growth in management occupations this decade, which means demand for these people is not disappearing. Supply is being interrupted.

The traditional path was cumulative and slow for good reasons. An individual contributor became a team lead with three or four reports, learned to delegate on low-stakes work, made ordinary mistakes at survivable scale, then took a larger team, then a function. Each step added judgement about people, priorities and politics that could not be acquired by reading about it. Flattening removes the intermediate steps and replaces them with fewer, larger, more demanding jumps, which raises both the failure rate of the people who take them and the reluctance of the people considering them.

Compounding this, the entry-level squeeze documented in the Stanford payroll research operates at the other end of the same pipeline. Employment declines concentrated among 22 to 25 year olds in AI-exposed occupations, with adjustment coming through hiring rather than pay, and concentrated in occupations where AI automates rather than augments. A company that hires fewer juniors and eliminates the team-lead layer has removed both the intake and the first promotion. The pipeline is not narrowed at one point, it is cut in two places.

The response most organisations have adopted is to buy senior talent externally, and the collective version of that strategy does not work. Every firm applying it competes for the same shrinking pool at rising prices, and the pool does not replenish, because the firms supplying it stopped training people for the same reasons. Korn Ferry analysts observing rapid flattening have noted the immediate symptoms — employee confusion and dissatisfaction feeding into productivity — but the leadership-supply problem surfaces on a multi-year delay and will be attributed to a labour market rather than to a decision.

There is a subtler loss that resists workforce planning entirely. Middle managers carried the organisation’s practical knowledge: why a process has an odd step, which customer relationships are fragile, which internal commitments are real and which are theatre, what was tried in 2019 and why it failed. This knowledge was never written down because it was never separable from the person. Agents cannot inherit it, because it does not exist in the systems they read. Flattening a management layer discards an undocumented knowledge base and replaces it with tooling that only knows what was recorded.

Realistic responses exist and they cost money on a timeline longer than a planning cycle, which is why they are rare. Deliberate rotation programmes give high-potential staff exposure to supervision, budget ownership and cross-functional negotiation without a permanent management title. Explicit apprenticeship, where a senior leader carries a designated successor through real decisions rather than through a curriculum, reproduces what the eliminated layer produced incidentally. Protected junior roles, justified as capability investment rather than as production capacity, keep the intake open.

Each of these is an argument for holding costs that a spreadsheet says are removable. Organisations that make that argument successfully will be the ones with leaders in five years, and they will not be able to prove the return until the counterfactual has already happened to their competitors.

Practical shifts for managers working above agent layers

For an individual whose job now involves supervising a mixed population of people and agents, the useful question is what to actually do differently. Several shifts have enough evidence behind them to be worth acting on, and none require organisational permission.

Treat specification as your primary output. The MAST findings put the largest share of coordinated-agent failures in specification and design. If you brief agents, the quality of your task definitions is now a first-order determinant of your team’s output. That means writing objectives, boundaries, output formats and completion conditions explicitly, versioning them, and reviewing them when they fail. Vague instruction produces duplicated and misdirected work at machine speed, and it produces it confidently.

Own your escalation thresholds explicitly. Find out where they are set, who set them, and when they were last reviewed. Watch two numbers: the share of cases escalated, and the share of escalated cases where a human changed the outcome. A low escalation rate with a high override rate means problems are getting through. A high escalation rate with a low override rate means humans are being consumed as decoration.

Budget verification as work. Any commitment based on agent-assisted throughput needs the review time included. Deployments that look profitable on production time and unprofitable on total time are common, and the difference usually sits in someone else’s timesheet.

Protect the calibration of your reviewers. Route a share of routine cases to humans deliberately. Run periodic exercises using known-bad agent output. Give reviewers time proportional to the consequence of the decision rather than to throughput targets. Reviewer accuracy decays silently under high automation reliability, and the decay is only discovered during an incident unless you test for it.

Rebuild the informal channel by hand. With a span of twenty rather than eight and status reports generated automatically, you have lost the ambient signal that told you a person was struggling. Nothing replaces it except deliberate, scheduled, individual contact whose purpose is not project status. If your calendar does not contain it, you do not have it.

Keep a name on every judgement. Require that generated reports carry a short human section: what the data does not show, what concerns the owner, what they would change. This preserves the accountability that made human reporting trustworthy, and it costs ten minutes.

Know what your agents can reach. Ask what systems each agent your team relies on can access, what it can write to, and who granted that scope. Access is authority. You are responsible for a set of permissions you probably did not approve and may not have seen.

Invest in the skills that are not being substituted. The residual value of the role sits in coaching, evaluative judgement, negotiation across boundaries, and the willingness to absorb pressure on behalf of a team. These are also the hardest to demonstrate in a performance review, which is a real problem and not a reason to deprioritise them.

Do not accept a span increase without a corresponding scope reduction. Coordination load falling does not mean relational load falling. If the number of people you are responsible for doubles, something else has to come off the list, and the thing to protect is individual attention rather than reporting cadence.

The stance that seems to work is neither resistance nor enthusiasm. Agents have made a specific part of the job cheap and left the expensive part concentrated in fewer hands, and the managers doing well are the ones who identified which part they were being paid for and moved deliberately towards it.

Designing an agent org chart that survives an audit

Organisations that reach production with coordinated agents have converged on a set of design decisions, largely by discovering the same failures. The following is a synthesis of what governance frameworks, security guidance and the more candid practitioner accounts agree on.

Start with a register rather than a pilot. Every agent needs an entry recording its purpose, its named business owner, its risk classification, its authority scope, the data and tools it may reach, who assigned that scope, its oversight assignment and its escalation protocol. Control planes now supply the mechanism, but the artefact matters more than the tooling. An agent whose owner cannot be identified in under a minute is an unmanaged liability regardless of what platform it runs on.

Classify by consequence, not by capability. The relevant question is not how autonomous the agent is but what happens if it is wrong. Reversible, low-value, internally visible actions belong in one tier. Irreversible, customer-facing, regulated or financially material actions belong in another, with oversight requirements attached to the tier rather than to the technology. Governance guidance across vendors and academic sources converges on this: define when approval is required and when monitoring is sufficient, and write the boundary down before deployment.

Design for safe failure, not only for success. Research on enterprise agent evaluation has argued that agents must be assessed on how they behave when things go wrong, not only on task completion. When authority is missing, sources conflict, policy is unclear, memory is stale, a tool call is unsafe or audit evidence is incomplete, the correct behaviour is to fail closed, escalate, quarantine, narrow the action or mark the output as not authoritative. A system that completes tasks impressively and fails unpredictably is worse than a system that completes fewer tasks and fails the same way every time, because the second can be supervised.

Prefer graduated containment over termination. Runtime governance research has pointed out that abruptly killing an agent can corrupt state, leave critical tasks half-finished or disable oversight across a coordinated system. Proposed intermediate responses include maintaining operation while increasing monitoring and inserting human checkpoints, allowing current tasks to complete while blocking new planning cycles, revoking specific tool categories while substituting read-only alternatives, and migrating an agent to an isolated environment with simulated tool responses so behaviour can be observed without external effect. That is a graduated disciplinary ladder, which is what organisations use for people, and for the same reason.

Oversight models mapped to decision consequence

Selecting a row is a risk decision rather than a technology decision, and the same agent may sit in different rows for different action types. The pattern worth noting is that each model has a distinct failure signature, which means each requires a different monitoring metric rather than a shared dashboard.

Instrument before you scale. Structured tracing, correlation identifiers on every message and tool call, logs of every action, tool call, data access and execution path, and retained change records are the difference between a diagnosable incident and an unexplainable one. Since dedicated research effort is now going into attributing the first unrecoverable failure in an agent trajectory, assuming a support engineer will find it in raw logs during an outage is not a plan.

Separate the checker from the producer. The evidence that independent trust scoring cuts agent failure rates substantially, and the general principle behind conformance versus substantive review, both point the same way. The agent that did the work should not be the sole judge of whether the work is acceptable, and the human reviewing an escalation should receive the reasoning rather than only the conclusion.

Review the configuration on a schedule. Thresholds, tool scopes, policy references and objectives drift out of alignment with the business within months. Lifecycle rules that expire inactive agents and flag ownerless ones exist because agents accumulate silently, and an agent nobody remembers deploying is holding permissions nobody has reviewed.

Metrics that show whether agent management is working

Most organisations measure the wrong things about their agent deployments, and the measurement error is systematic rather than random: the standard metrics capture the benefits and miss the costs.

Adoption dashboards typically track logins, prompt volume, active users and estimated time saved. Those figures establish that people are using the tooling. They say nothing about whether the work produced was accurate, whether anyone downstream had to redo it, or whether the coordination layer is quietly narrowing what humans see. An organisation reporting strong adoption alongside employee frustration is not looking at contradictory data. It is looking at one half of the picture, and the missing half is where the money went.

Six measures give a more honest read, and all are obtainable without new tooling.

Total task time, not production time. Time from request to accepted output, including every review and correction cycle, measured against the pre-deployment baseline for the same work. This is the only figure that captures whether the verification burden ate the gain. Teams that measure it frequently find the improvement is real and roughly half of what the production metric suggested.

Rework rate. The proportion of agent-produced output that a downstream recipient had to interpret, correct or redo. This is the workslop measurement applied internally, and it can be captured by asking, in a lightweight recurring survey, what share of received work required cleanup. The published research found respondents estimating around 15% of content reaching them qualified, with nearly two hours spent per instance, which gives a reference point for whether your number is unusual.

Escalation rate paired with override rate. Reported together or not at all. The pair diagnoses the threshold in a way neither figure does alone, and a threshold with no owner will drift without either number moving in a way anyone notices.

Policy adherence sampled independently. A separate compliance sample of agent-handled cases, checked against policy rather than against customer satisfaction. Satisfaction scores are actively misleading here, because the most common policy violations make customers happier. τ-bench exists as a benchmark precisely because task completion and policy compliance diverge.

Silent failure discovery latency. How long elapsed between an agent behaving incorrectly and anyone noticing. Research into production agent failures specifically examines incidents that failed no task, kept detectors green and surfaced hours to months later. Any organisation that cannot produce this number for its last three incidents does not know how exposed it is.

Reviewer calibration. Accuracy of human reviewers on constructed cases containing known agent errors, measured periodically. Under high automation reliability, reviewer performance decays silently, and this is the only measurement that catches it before an incident does.

Two organisational metrics belong alongside the operational ones because they capture the effects that arrive late.

Span-adjusted individual contact time. Minutes per month of scheduled individual contact per direct report, tracked as spans widen. Coordination load falling does not offset relational load rising, and this number falls quietly when nobody is watching it.

Internal promotion rate into supervisory roles. The share of supervisory appointments filled internally rather than externally. A falling ratio is the leading indicator of a broken leadership pipeline, and it moves years before the shortage becomes visible in hiring difficulty.

The general principle is that agent deployments should be measured on total system cost and total system reliability, not on the productivity of the automated step. Every serious failure documented in the research literature and the analyst data traces back to an organisation that measured the step and not the system.

The cost structure of running a digital middle manager

The financial case for agent coordination is more fragile than the headline numbers suggest, because the cost sits in several places that are usually accounted for separately.

Token consumption is the first and most visible. The orchestrator-worker pattern that produced a 90.2% improvement on Anthropic’s internal research evaluation consumed roughly fifteen times the tokens of a single-agent exchange. That multiple is a property of the architecture, not of a particular model: parallel workers each carry their own context, the orchestrator reads every return, and synthesis passes over the accumulated material. Compiled industry data indicates the median enterprise monthly language-model bill growing several times over year on year entering 2026, with aggregate enterprise agent spend forecasts from IDC and McKinsey converging near $1.4 trillion by 2027. Whatever the accuracy of the aggregate forecast, the direction of individual bills is not in dispute.

Platform and governance costs come next and are frequently omitted from the original business case. Microsoft Agent 365 lists at $15 per user per month as an add-on. Observability tooling, identity governance for agent populations, secrets management and audit retention each carry their own line. The people who own the register, set the thresholds and run the reviews are headcount. A company that budgeted for agents as a per-seat software subscription has budgeted for perhaps half the cost of running them properly.

Integration is where the estimates go furthest wrong. Gartner’s diagnosis of the projects it expects to be cancelled named escalating costs alongside unclear value and inadequate risk controls, and noted that connecting agents into legacy systems is often technically complex, disrupting workflows and requiring expensive modification. The firm’s suggested alternative — rethinking workflows around agents from the ground up rather than retrofitting — is more likely to succeed and considerably more expensive, which is a trade-off most business cases do not present honestly.

Verification cost is the line nobody puts on the sheet. Applying the published workslop figures as an order of magnitude, an organisation of 10,000 people with 41% prevalence and roughly two hours spent per instance arrives at over $9 million a year of cleanup labour. That estimate covers general AI-assisted output rather than agent coordination specifically, so it should be treated as an illustration of scale rather than a forecast. The structural point stands regardless: the cost falls on the recipient’s timesheet rather than the producer’s, which means it does not appear in the same budget as the saving.

Then there are the costs that arrive on a longer delay and never get attributed to the deployment. Turnover in roles that became harder without becoming better paid. External hiring premiums for supervisory positions the organisation no longer produces internally. Incident costs from silent failures found late. Remediation after an audit finds oversight that existed on paper.

Against all of this sits genuine value, and the return figures where deployments are well governed are real. Compiled data puts median time-to-value near five months, with fast-payback categories in sales development around three and a half months and finance and operations closer to nine. Deloitte’s survey of roughly 1,800 executives across Europe and the Middle East found only 6% reporting payback inside a year and most expecting two to four years, which is a more sober distribution and probably closer to typical experience than the vendor case studies.

The pattern in who succeeds is consistent enough to plan against. Value concentrates where the process was already documented, where the output is cheap to verify, where the consequence of error is recoverable, and where somebody owns the agent. It evaporates where an agent was deployed into an undocumented process, where verification requires expert time, where errors are irreversible, or where nobody was made responsible. That is a governance profile rather than a technology profile, and it is why Gartner attributed the expected cancellations to management decisions rather than to model shortcomings.

Three scenarios for the next three years

Forecasting is cheap and usually wrong, so what follows is framed as three trajectories with the conditions that would make each dominant, and the observable signals that would tell you which one you are in.

The coordination layer consolidates. Agents remain in supervisory and routing roles rather than moving into autonomous execution, because the reliability gap between 50% and 80% success on long tasks persists as capability advances. Organisations settle into a stable arrangement: software coordinates, humans handle exceptions and own outcomes, control planes manage agent populations the way HR systems manage employees, and the management layer stabilises at a smaller size doing a more concentrated job. Regulatory frameworks harden around oversight, and demonstrable human control becomes a compliance baseline rather than a differentiator. The signal that this is the path: escalation volumes stabilise, override rates remain non-trivial, and organisations keep adding human roles specifically for verification and agent ownership.

The execution layer opens. Time horizons keep doubling at the faster recent rate, reliability at high success thresholds improves rather than merely shifting outwards, and agents begin taking end-to-end ownership of processes with acceptable error rates. The coordination role becomes a transitional stage rather than an equilibrium, and the question shifts from who supervises the agents to what the remaining humans are for. This trajectory depends on something that has not yet been demonstrated: closing the gap between the 50% and 80% horizons rather than moving both outwards together. The signal to watch is whether high-reliability performance on multi-hour tasks improves faster than headline capability, and whether organisations begin reducing verification staffing rather than adding it.

The correction arrives. The cancellation wave Gartner projects materialises, verification costs prove larger than the coordination savings across a broad set of deployments, one or more high-profile failures produces regulatory response sharper than the current oversight requirements, and the market re-sorts. Agents remain, in narrower roles, with heavier governance and lower expectations. Companies that flattened aggressively rebuild coordination capacity under different titles, as happened after the 1990s delayering wave. The signal: rising incident disclosure, agent deployments being narrowed rather than expanded, and the reappearance of coordination roles with new names.

These are not mutually exclusive across an economy. The most likely outcome is all three simultaneously in different sectors. Financial services, with documented processes and existing control frameworks, are best positioned for consolidation. Software engineering, where verification is partly automated and errors are usually recoverable, is the most plausible site for the execution layer opening first. Functions that adopted fastest with the least governance are the most exposed to correction.

Two things are worth holding regardless of which trajectory dominates. The organisational changes being made now are more durable than the technology driving them. A management layer removed in 2026 is not restored in 2027 if the technology disappoints; it is rebuilt slowly, expensively, with different people. And the leadership pipeline damage compounds on a schedule nobody’s planning cycle covers, which means the cost lands on a management team that did not make the decision.

The forecast that should be resisted hardest is the confident one. Time-horizon researchers have been notably careful about the limits of their own extrapolations, noting that a 50% horizon of X hours does not authorise delegating tasks under X hours, that some work needs success rates above 98% before automation makes sense, and that doubling the horizon does not double automation because failures become more complex and cost more human labour to resolve. The people with the best data on capability growth are the most cautious about what it implies for work. That caution is the appropriate stance for anyone making organisational decisions on the strength of it.

Open questions the current evidence cannot settle

Several questions central to this subject remain genuinely open, and being clear about which ones is more useful than manufacturing confidence.

How much of the management contraction is attributable to agents specifically. Manager headcount fell 6.1% between May 2022 and May 2025, and that window contains a post-pandemic correction, an interest-rate shock and a broad cost-cutting cycle. Companies have incentives to attribute reductions to technology strategy. The Stanford researchers who found the clearest entry-level effects were explicit that with the broadest controls the timing becomes statistically detectable only from 2024, and that earlier declines probably reflect other factors. Nobody has yet isolated the agent-specific contribution to management-layer reduction, and the confounders are large.

Whether wide spans with strong tooling actually work. Spans have risen from roughly eight to twelve on average, with some organisations reaching fourteen and individual managers reportedly carrying ninety. Research predating agents found management quality degrading beyond eight to ten reports. Whether coordination tooling changes that ceiling, or merely hides the degradation for a while, has not been tested over a long enough period to know. The honest answer is that we will find out from the cohort currently running the experiment.

Whether the reliability gap closes or persists. Everything about the coordination equilibrium depends on the four-to-sixfold gap between 50% and 80% success horizons. If that gap narrows, agents move into execution and the arrangement described here is a way station. If it persists as both horizons extend, coordination becomes the stable role. The doubling rates for both thresholds have so far been similar, which favours persistence, but the sample of model generations is small and the trend has already accelerated once.

Whether verification cost falls with better tooling. Independent trust scoring has cut agent failure rates substantially in benchmark conditions, and structured, citation-carrying output is cheaper to check than prose. Whether these techniques reduce verification labour enough to change the economics at enterprise scale, or whether they simply relocate the work, is unresolved. The published cost estimates cover general AI-assisted output rather than governed agent coordination, and no independent study has yet measured the verification burden of a mature agent deployment against a like-for-like baseline.

What adequate oversight consists of in law. The EU AI Act requires that high-risk systems be capable of being overseen and that overseers be able to understand, interpret, override and halt. It does not specify how much time a review requires, what override rate demonstrates real scrutiny, or what training qualifies a person to supervise an agent population. Academic commentary has noted the absence of any clear standard. That standard will emerge through guidance, harmonised standards and enforcement, and organisations building oversight functions now are guessing at a target that has not been set.

How liability distributes in multi-party agent chains. The Air Canada reasoning is clear where one company deploys one system: the deployer answers for the output. It is far less clear where an agent from one vendor calls a tool from another through a protocol server maintained by a third, on infrastructure operated by a fourth, under an objective set by a customer. Existing agency doctrine provides a starting point and has not been tested on that fact pattern.

Whether the leadership pipeline problem is real or a category error. The argument that removing team-lead roles removes the training ground for senior leaders is intuitive and historically supported. The counter-argument is that management skill has always been developed in whatever roles existed, and that supervising agent populations may prove to be adequate or superior preparation for supervising large organisations. There is no evidence either way, because the first cohort trained this way has not yet reached senior positions.

Whether decomposition can be made to preserve judgement-relevant context. The finding that worker agents cannot see the human, and that protective behaviour is suppressed accordingly, describes a property of current architectures rather than a law. Whether passing original requests, sensitivity flags and richer context restores the lost signal without reintroducing the context degradation that isolation was designed to prevent is an active engineering question with no settled answer.

What can be said with reasonable confidence is narrower than the discourse implies. Agents entered organisations through the coordination layer rather than the execution layer. Reliability measurements explain why. The management layer is contracting and spans are widening, from multiple causes. Accountability has not moved and will not. Regulators are targeting oversight rather than autonomy. Verification cost is real, poorly measured and lands on people other than those claiming the saving. The organisations doing well are the ones that treated agent deployment as an operating-model change requiring named owners, documented processes and governed thresholds, rather than as a software purchase. Everything past that is inference, and the people with the best data are the ones hedging hardest.

Questions companies are asking about agent-run coordination

Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency

This article is an original analysis supported by the sources cited below

Measuring AI Ability to Complete Long Software Tasks METR’s research introducing the task-completion time horizon metric, documenting the roughly seven-month doubling of the 50% horizon and the four-to-sixfold shorter 80% horizon.

Clarifying limitations of time horizon METR’s January 2026 note explaining why a 50% time horizon does not authorise delegating tasks of that length, and why doubling the horizon does not double automation.

Measuring AI Ability to Complete Long Tasks (full paper) The underlying paper by Kwa and colleagues with the methodology, the 80% horizon comparison and the qualitative failure analysis.

Why Do Multi-Agent LLM Systems Fail? The Berkeley work introducing the Multi-Agent System Failure Taxonomy from more than 1,600 annotated traces across seven frameworks, identifying fourteen failure modes in three categories.

How we built our multi-agent research system Anthropic’s engineering account of the orchestrator-worker pattern, the 90.2% internal evaluation improvement, the token cost multiple and the delegation problems encountered in production.

Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 Gartner’s forecast on cancellation causes, the agent washing estimate of roughly 130 genuine vendors, and projections for autonomous work decisions by 2028.

Article 14: Human Oversight The operative text of the EU AI Act’s human oversight requirement for high-risk systems, including the capabilities the assigned overseer must have.

Under EU AI Act, high-risk systems require a human touch Analysis from the International Association of Privacy Professionals on what Article 14 demands of providers and deployers and how compliance is likely to be examined.

Governing the Agentic Enterprise California Management Review’s operating-model framework covering human-on-the-loop supervision, safe-action pipelines and per-agent ownership, risk classification and escalation protocols.

Microsoft Agent 365 Microsoft’s product documentation for its agent control plane, covering registry, onboarding, least-privilege scoping, lifecycle rules and audit capabilities.

What’s new in Agent 365, June 2026 Microsoft’s update describing local agent visibility, shadow AI discovery and expanded programmatic governance for agent populations.

Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence Stanford Digital Economy Lab research on entry-level employment declines in AI-exposed occupations using large-scale payroll records.

Canaries, Interest Rates, and Timing The authors’ February 2026 update addressing alternative explanations and revising the timing at which the employment decline becomes statistically detectable.

AI Flattening Organizations Is The Latest Chapter In A Continuing Story Forbes analysis placing the current flattening wave in the context of four decades of delayering, with span-of-control trajectory data.

Management Cuts Today Are Shaping A Leadership Shortage Forbes coverage of manager headcount data, Korn Ferry survey findings and the pipeline consequences of removing supervisory roles.

Moffatt v. Air Canada: A Misrepresentation by an AI Chatbot Legal analysis of the tribunal’s reasoning, including the rejection of the argument that a chatbot is a separate entity responsible for its own actions.

Air Canada chatbot case highlights AI liability risks Commentary on the negligent misrepresentation findings and what the case indicates about how existing doctrine will be applied to generative systems.

BC Tribunal Confirms Companies Remain Liable for Information Provided by AI Chatbot American Bar Association analysis of the decision and its implications for organisations deploying customer-facing automated systems.

Air Canada’s chatbot illustrates persistent agency and responsibility gap problems for AI Peer-reviewed examination of the responsibility gap the case exposes, published in AI & Society.

Tamping Down AI’s Workslop Problem Coverage of the BetterUp Labs and Stanford research quantifying time lost to low-substance AI output and its effect on collaboration and trust.

AI workslop and knowledge decay Reporting on the June 2026 Harvard Business Review work by Holweg and Davenport describing how unverified AI output degrades an organisation’s knowledge base.

The Evaluation Tax Analysis from the HKU Centre for AI, Management and Organisation on why polish no longer signals effort and what that does to review workloads.

Practicing the human in the loop Practitioner argument that oversight requires training, enforcement mechanisms and time-boxed decision windows rather than nominal presence in an approval flow.

A Complete Guide to Agentic AI Governance Security-side governance guidance on liability, documentation of authority scope, escalation thresholds and the distinction between approval and monitoring.

Governing enterprise AI agents A maturity progression from supervised agents to governed and adaptive deployments, with criteria for when human review should be mandatory.

The Non-Human Identity Governance Vacuum Cloud Security Alliance research on non-human identity growth, credential rotation delays and the governance gap created by agent populations.

The Agent Identity Problem Analysis of identity ratios, secrets sprawl data from GitGuardian’s 2026 report and the standards work underway at NIST, CoSAI and OWASP.

Invisible Orchestrators Suppress Protective Behavior in Multi-Agent LLM Systems Preprint examining how decomposition removes worker agents’ visibility of the human requester and what that does to safety-relevant behaviour.

CAGE-1: Control, Assurance, and Governance Evaluation for Enterprise Agentic AI Evaluation framework arguing that enterprise agents must be assessed on safe failure behaviour, oversight placement and operational maturity rather than task completion alone.

MI9: An Integrated Runtime Governance Framework for Agentic AI Research proposing graduated containment responses, from monitoring augmentation through tool restriction to execution isolation, as alternatives to abrupt termination.

A new Moore’s Law for AI agents Accessible treatment of the time-horizon trend, including the correlation between task length and success rate and the recent acceleration in doubling time.