Connect
AI agents are cruising fast inside your systems. That is exciting.
What should give you pause is how quickly organizations are stepping back from the controls.
Six months ago, 40% of organizations required a human to review high-risk AI actions before they happened. Today, that number has dropped to 25%, according to our IT Trends Report. In the same window, full agent autonomy, which means letting systems take high-risk actions with no human-in-the-loop, more than doubled from 11% to 26%.
Read that again. We are handing more power to autonomous systems while pulling back the very checkpoints that keep them in line. The full IT Trends Report Q3 2026 breaks down exactly how this is playing out and what leading teams are doing about it.
Keep reading for a quick, practical look at the danger and how to close the gap.
When No One Reviews High-Risk Actions
High-risk actions are the moves that run directly inside your critical databases, your production environments, and your communication platforms. When an agent takes one of these actions without review, there is no human standing between a mistake and your core systems.
For example, a major airline deployed an autonomous customer service agent to help resolve passenger disputes. The agent drifted from its intended job and started offering free, legally binding airline tickets to customers on its own. That single unsupervised system created costly operational damage and a public reputation hit. No one told it to do that. It simply acted beyond its boundaries, and no checkpoint caught it in time.
Audit Gaps Let Problems Go Undetected
Removing human review does not just raise the odds of a bad action. It also erases your ability to see what happened afterward. NHIMG points to a 48% complete audit and compliance blind spot, and notes that only 52% of organizations track or audit the data their agents access.
Think about what that means during an incident. If an agent touches sensitive records or makes a costly decision, half of organizations cannot trace the path it took. When agents pass credentials down a chain to other agents, the audit trail fractures completely. Your security team is left guessing.
How Automation Complacency Sneaks In
You might wonder how careful teams end up here. The answer is a pattern well documented in aviation safety called automation complacency. When systems work smoothly for a while, human operators start to over-trust them. They stop verifying alerts closely and begin treating important approvals as routine paperwork.
After-the-fact automated review is now the most common oversight model, used by 44% of organizations. That approach can work for low-stakes tasks. The problem starts when it becomes the default for actions that deserve a real human decision. Add machine-speed transactions to the mix, and manual approvals start to feel like a bottleneck rather than a safeguard. So teams quietly remove them, and the checkpoints disappear.
Machine Identities Are Multiplying Fast
Every AI agent needs credentials to operate, and those credentials are piling up fast. Non-human identities(NHIs) now outnumber human users in 83% of organizations, and one-third report a ratio of six or more machine credentials for every person. Yet only 21% of organizations have governance controls in place for these non-human identities.
That is a lot of powerful accounts running with little oversight. It gets harder because organizations use an average of 6.9 separate tools to manage core IT functions. With that much fragmentation, your security analysts have no single pane of glass to watch agent activity or coordinate an emergency shutdown. Shadow AI makes it worse, as departments spin up their own agents outside central IT and grant them broad, lasting permissions. If one agent’s reasoning gets hijacked, it can chain together everyday tools to read confidential directories or delete database tables.
How to Bring Oversight Back Under Control
You do not have to choose between speed and control. You can have both with the right structure.
Start with proportional governance. Not every agent needs the same leash.
- Sort agents into clear tiers, from simple observers up to fully autonomous systems, so your oversight matches the actual risk of each action.
- Pair that with intent-based authorization, which uses short-lived just-in-time credentials instead of standing access that lingers forever.
- Then add a deterministic kill switch so you can stop an agent instantly across identity, gateway, and host layers when something goes wrong.
Our Trends Report ties all of this together with a clear four-step framework:
- Discover every agent and identity in your environment.
- Register each one with a defined purpose and a human owner.
- Manage access with least privilege and shutdown rules.
- Govern continuously with logs, audits, and post-action reviews.
Four steps that turn invisible autonomy into managed autonomy.
Take Back Control Before You Scale Further
Human review is down sharply. Agent autonomy has doubled. And the tools to catch problems are spread too thin to give anyone a clear view.
The airline story shows what a single unsupervised agent can cost in real dollars and real reputation. The audit blind spots show how hard recovery gets when there is no trail to follow.
It is an oversight problem with a clear fix. Teams that are acting now, putting tiers in place, assigning human owners, and building kill switches into their deployments, are the ones that will scale AI without the cleanup bill.
The next step is not slowing down your AI ambitions. It is building the structure that makes those ambitions safe to act on.
Our IT Trends Report Q3 2026 gives you the step-by-step framework top teams are using to keep humans meaningfully in the loop. Download it to see how you can move fast and stay in control at the same time.
