Fit the control to the agent's authority

You’ve seen the number, or one shaped like it. Only about one in five organizations has mature governance for AI agents, while three in four plan to put those agents into real production by 2027. The prescription writes itself. You’re under-governed. Build more governance, and build it before you scale.

Here is what that number is counting, in plain terms. AI agents are software that doesn’t just answer a question but takes an action on its own: files the ticket, moves the money, updates the record, sends the reply. The consultancy Deloitte surveyed 3,235 technology and business leaders across 24 countries this spring and found a 53-point spread between the share that plan to deploy such agents and the share that have grown-up rules for overseeing them. McKinsey’s survey of more than 10,000 executives found a matching shape one step later: 88% have deployed AI somewhere, only 39% can point to real profit from it. Two big samples, one story. Deployment is racing; readiness isn’t keeping up.

The instinct that follows is to treat governance as a dial and turn it up. Get from 21% mature to 60% mature and you’ve closed most of the gap. That instinct is where the whole thing goes wrong.

The gap everyone’s rushing to close measures how much governance you’ve built. What decides whether it works is the match between the control and how much authority you actually handed the agent. That score can climb while the match gets worse.

The distinction comes from John Cutler, a widely-read product-management writer, in a July 12 essay for his newsletter The Beautiful Mess. He sorts AI agents into four types by the one thing that turns out to matter: how much power they have over a decision. A scribe only produces output and decides nothing, like an agent that drafts a summary a human then uses. A counselor gives advice that steers a human’s choice. A data-stitcher wires systems together, so its mistakes flow downstream into other tools. A thought-partner reasons alongside you on open problems.

Cutler’s claim is that governance should key to that authority, not to how clever the agent is. And the intuition most of us carry is backwards. You’d assume a more capable agent needs more oversight. But a brilliant scribe that can’t act on anything is safer than a mediocre counselor whispering plausible-but-wrong guidance that a busy human acts on without checking. The scribe mostly needs a review step. The counselor and the thought-partner need tighter watch, because their failure is confident bad advice. The data-stitcher needs validation before it ships, because its errors don’t stay put.

Now run the maturity playbook over those four. Apply one heavy, uniform governance program to all of them and you get two failures at once. You over-constrain the scribe, piling review cycles on an agent that can’t hurt anyone, which is pure friction. And you under-constrain the counselor, because a generic control was never shaped for the way it actually fails. More governance, evenly spread, buys you drag on the safe agents and exposure on the dangerous ones.

Which means the Deloitte gap, real as it is, can’t tell you what you need to know. Some slice of that “mature” 21% is mature-and-mismatched: a thick, uniform program throttling low-authority agents, generating the caution that reads as prudence and quietly stalls the very deployment the survey is trying to explain. And some slice of the deploying-without-maturity 74% may be under-governing exactly the high-authority agents where a mistake is most expensive. A single maturity score can’t separate those two orgs. It counts governance the way a bathroom scale counts fitness: a real number, aimed at the wrong question.

The fair version of the governance-first case still holds a lot of ground, and it deserves saying plainly. Governance really is undersupplied somewhere; the surveys aren’t wrong about that. And the sequence the successful deployers follow is genuine discipline: run low-risk pilots, build oversight from what you learn, then scale on purpose. Deloitte also found that when senior leaders own governance instead of pushing it down to a technical team, business value tends to be higher, though the survey can’t prove the leadership caused the value rather than traveling with it.

But “build governance first” smuggles in an assumption. It treats governance as one capability you build once and carry forward. The archetype lens breaks that. What you build governing a scribe pilot is review cadence. What a counselor deployment needs is oversight of persuasive, wrong reasoning. What a data-stitcher needs is validation against downstream blast radius. Those aren’t three amounts of the same thing. Build the pilot’s control, scale into a different archetype, and you can end up confidently governed behind the wrong instrument.

The strange part is that most teams already believe the fit view somewhere else and don’t notice. Think about how a good engineering org handles AI-written code. Nobody governs it by volume. An unreviewed script you’ll throw out tomorrow gets waved through; the same lack of review on production payment code is a fireable call. The control keys to consequence, not to quantity. Martin Fowler drew that exact line for vibe coding last year, and it’s the same axis Cutler is naming for agents. We govern code by fit and the enterprise by a score, and nobody’s noticed the two rules contradict each other.

So the honest amendment isn’t a footnote about archetypes. The binding constraint on AI transformation was mis-labeled as a quantity when the operative variable is a match. A heavier, more uniform playbook scores as more mature and can be worse matched. The maturity number can rise while fit falls.

That points at a question sharper than “how much governance do we have,” and it’s one you can actually answer. Inside that 21%-mature Deloitte cohort, do the organizations that calibrated control to authority outperform the ones that just went uniformly heavy? If they do, the 53-point gap stops being your signal to build faster. It only says governance is short somewhere, and it stays quiet on whether your own org will transform. The score that would answer that is one nobody publishes yet: how well your controls fit the agents you’re turning loose. Start measuring that now, while the maturity number is still the only one on the dashboard.