On September 16, John Kell wrote in Fortune that AI agents are going rogue and CIOs are racing to put guardrails around them. The photo lineup is the tell: Zscaler’s CISO, Workday’s CTO, Cisco’s operations lead. This is not a startup demo. It is the people who already own production.
The same day, Maria Korolov at CIO ran Deloitte’s larger comfort blanket. More than 3,200 executives. Seventy-five percent of organizations already use at least some agentic AI. Ninety-five percent expect to within two years. Those two stories are the same week because vendors are shipping stacks while the review queue is still a human.
We already argued that the CIO job is where agents are allowed to act. This week is the next tense. Allowed was a policy. Rogue is a ticket.
What Fortune actually measured
Kell’s useful numbers are not the headline. Over half of the decision-makers in the survey he cites spend “significant” staffing hours manually reviewing and correcting autonomous agent outputs before those outputs go live. At organizations with $100 million or more in revenue, 64 percent report that review habit. Ninety-six percent of that large-org group say AI project failure is tied to poor data foundations.
Felix Van de Maele, Collibra’s CEO, told Fortune the quiet part: the models do not have the right context, so the outputs are wrong, so people babysit. That is not a guardrail. That is unpaid QA with a new job title.
Sam Curry, Zscaler’s CISO, gave the sentence everyone will paste into a slide: “AI is non-deterministic, it can take initiative, and it is effectively a new form of insider.” Security teams spent careers worrying about humans. They have had a few years to think about this. Curry also points at the Open Secure AI Alliance, an Nvidia-led group that includes Cisco and Workday, as a place where the vendors are trying to share safeguards. A coalition is not a control. It is an admission that nobody has a standard yet.
If your transformation program still lists “deploy agents” as a milestone and “governance” as a Q4 workshop, Fortune is describing your present. The agents are already in the workflow. The workshop is late.
Deloitte’s 75 percent is coverage, not competence
Korolov’s Deloitte cut is worth keeping in two columns.
Column one, now: 20 percent say they use agentic AI moderately, 2 percent extensively, 1 percent as a fully integrated key component. Column two, two years out: 46 percent moderate, 23 percent extensive, 5 percent as a key component. The jump is a forecast. Forecasts are where transformation decks go to look brave.
Two other Deloitte figures sit next to that. Thirty percent of enterprises are already redesigning key processes around AI. Thirty-four percent say they are starting to use it to deeply transform the business. Twenty percent report increased revenue. AT&T’s chief data and AI officer, Andy Markus, is the named success: “Last year we had five-X cash ROI on our AI investment.” He says they built their own platform, it is model-agnostic, they control the knowledge, they grade accuracy, they monitor for governance.
Copy the last clause, not the 5X. You do not have AT&T’s platform. You have a Salesforce agent and a shared drive. Markus’s point is the boring one we keep repeating: the model is not the asset. The knowledge control is.
We already have a separate piece on why a different 40 percent of agent projects may be cancelled. Do not glue Deloitte’s 75 percent to that 40 percent. One is usage. One is survival. You can use a bad agent in a lot of meetings.
The stack vendors shipped anyway
September 15 at Dreamforce, Salesforce and Google Cloud announced the version of this story that sales likes. Hyperforce on Google Cloud, North America generally available in November 2026, more regions in 2027 including Germany. A Salesforce Federated Connector for Gemini in private preview, GA planned for late October. Agentforce Sales Agent for Gemini Enterprise in beta on Google Cloud Marketplace. Agentforce Reasoning Engine with Gemini, GA now. Zero-copy Data 360 expansion, GA fall 2026.
Meir Amiel, Salesforce’s chief trust and infrastructure officer, said the change is the infrastructure underneath customers, not the trust bar. That sentence is doing a lot of work. The product is: agents on either side can reason over the same data without a custom integration. The risk is: agents on either side can act on the same data without a custom integration.
If you already let Agentforce draft a customer email, November’s GA is not a philosophy seminar. It is a question about which identity the agent uses, which system of record it can write, and who gets paged when it writes the wrong thing at 2 a.m. Curry’s “new form of insider” is the write path.
Accenture parking 1,000 engineers in the office was last month’s staffing version. This is the infrastructure version. Same plot. Someone else will run the agent unless you write the allow-list first.
The budget is already over
Futurum’s Mitch Ashley put a different number on September 14: 46.9 percent of enterprises are running over budget on AI, with FY2027 as the reckoning. The same week, Conduent named Narayanan Sundaresan chief information and technology officer, effective September 14, with 28-plus years of enterprise AI and transformation work. A CITO hire is not a rebuttal to overruns. It is often how overruns get a single owner.
Transformation programs fail in a boring way. The vendor invoice is real. The ROI slide is a hope. Deloitte’s 20 percent who saw revenue should make you ask which 80 percent did not. Fortune’s 96 percent blaming data foundations should make you ask whether your “agent rollout” is actually a catalog project.
None of this is a stock pick. Conduent, Salesforce, Google, Nvidia, Cisco, Workday: I do not care which ticker you watch. I care whether your agent can refund a customer, change a payroll code, or email a regulated client without a person in the loop.
A guardrail is a write policy
If you need a meeting agenda that is not a vibe, use this.
First, list the systems the agent may read. Shared drives do not count as a list. Named collections count.
Second, list the systems it may write. Most companies skip this and then act shocked when the agent updates a record. Write is the insider.
Third, name the human who reviews a sample of outputs every day, not “the team.” Fortune’s 64 percent at large orgs are already doing this as overtime. Put it on a roster.
Fourth, pick one metric that is not token volume. Markus grades accuracy. Van de Maele wants context. Curry wants to know what kind of risk this insider presents. Token volume is how you lose the FY2027 argument Ashley is describing.
Fifth, do not wait for the Open Secure AI Alliance to publish a PDF. If Hyperforce on Google Cloud is coming in November, the allow-list is an October job.
What “rogue” looks like on a Tuesday
Fortune’s headline is doing work the body does not fully cash. Curry is not describing a cartoon agent emptying a bank account. He is describing non-deterministic software that takes a next step. On a Tuesday that looks like: a sales agent sending a discount the price list does not allow, a support agent closing a ticket with a policy that is two years old, a ops agent restarting a job that was paused because a human knew the downstream file was late.
Those are insider moves. They are also ordinary. The 64 percent of large orgs reviewing outputs by hand are paying for the fact that the step happened before the policy did.
Salesforce’s availability table is the calendar for that Tuesday. Reasoning Engine with Gemini is GA now. Sales Agent for Gemini Enterprise is beta on the Marketplace. Federated Connector is a private preview with GA aimed at late October. Hyperforce on Google Cloud is November in North America. If you turn all of that on because Dreamforce made it look like one stack, you have four different maturity levels in one diagram. Beta write paths do not belong on the same allow-list as GA read paths.
Amiel’s trust sentence is a vendor’s job. Your job is to name the identity. Does the agent run as a service account that can see every Data 360 object? Does it run as the salesperson? Can it create a case, or only draft? Write those answers in the ticket before November, not in the incident after.
Deloitte’s 1 percent who say agentic AI is fully integrated as a key component of operations are the only people who should be talking about “the transition” as if it were done. Everyone else is in the 20 percent moderate bucket, or below it. Moderate means a few workflows and a lot of screenshots in Slack. Do not staff a transformation office as if you were the 1 percent.
If you need a second number for the board, use Ashley’s 46.9 percent over budget. Pair it with Fortune’s 96 percent blaming data. The overrun is often a catalog problem wearing an agent hat. Markus built a platform that grades accuracy. That is data work. The CITO hire at Conduent may help them. It will not grade your accuracy for you.
Korolov also notes 30 percent of enterprises redesigning key processes and 34 percent claiming a deeper rewrite of the business. Those are survey labels. In a shop that still reviews 64 percent of agent output by hand, “redesign” often means a flowchart with a robot icon. Ask to see the write policy. If there is no write policy, the process was not redesigned. A human was added at the end. Write policies are boring on purpose. Boring is the point. If the policy cannot be read in two minutes, it will not be used at 2 a.m. Either.
The transition Korolov describes is underway in the same sense that a merger is underway after the press release. Some companies will get Markus’s flywheel. Most will get a reviewed queue and a budget overrun. The guardrail meeting is late because the agent did not wait for the invite.