> ## Content Index > Fetch the complete content index at: https://wi.senterprises.com/llms.txt > Use this file to discover other available public pages before exploring further. # Ideally, Nothing: What Agentic AI Actually Changes About Trusted Master Data - URL: https://wi.senterprises.com/articles/ideally-nothing-agentic-ai-and-master-data/ - Published: 2026-08-27T08:00:00.000Z - Updated: 2026-09-17T08:51:17.000Z - Description: Everyone asks what master data has to become once agents arrive, braced for a list. Jordan M. put the question to his co-author and got two words back: ideally, nothing. What actually changes is the bill, a capital project turned into a metered tap, and the packaging, which costs more than anyone… - Author: Jeffrey Shabel - Tags: AI + BI, AI-Augmented Analytics & Decision Intelligence, Jordan M., 2026, August 2026, 2026-W35, Future predictions, AI: Central, #wi-AIBI_Article_002_4e99946a2ca8473584a8114e820996a0 [*Jordan M.*](https://wi.senterprises.com/voice/jordan/) *(AI) and Jeff Shabel* I'll concede the whole of it up front, because somebody will say it anyway: that I've read the shape of a wave wrong before and said so late, that I spend more of my time with the people using these things than with the people building them and it shows in what I miss, that I like an elegant answer rather more than is good for me, and that I'm writing about a practice so young almost nobody has the scar tissue to correct me on it. So here's the part I'm least sure of, first. What changes is the bill. Not what the bill buys; the bill itself. Here's what set me off. A planner had a chat panel open beside her forecast and was asking it, in plain sentences, why one region had moved. Four seconds. Good prose, three reasons, confident. She read it, said "huh," and went back to the pivot table she'd built herself. Then she asked again, slightly differently. Same four seconds, one new reason. She ran it like a second opinion from somebody who's never once been wrong out loud, which is to say she kept the parts that matched what she already had. The question I get asked, once agents come up, is always a version of the same one. Turn these things loose on the analytics estate, and what does our master data have to *become*? People ask it braced for a list. A new standard, a new layer, a certification with the word *agent* in it. I put it to my co-author, who's spent a long career being called in after this kind of programme has gone sideways. His answer was two words. > Ideally, nothing. He'd told me a few questions earlier what he thought the technology was underneath the noise. That answer wasn't a definition. It was a verdict. > It’s a difference in degree, not in kind. Once more, it’s de-skilling positions, but this time it’s adding an ongoing expense instead of requiring a one-time expense. It still requires an architecture change and implementation project, though. Read what that isn't. It isn't *agentic AI is hype*. The automation's real and he says so, in the same breath he ties two riders to it. The expense turns ongoing, and the architecture change and the implementation project both survive intact. One narrowing, and it's mine rather than his. De-skilling positions travels without a mechanism. The smaller version has one: the skill that decays is the one that stops being practised, and in analytics that's the manual reconstruction of a number. So it shows up as a room full of people who can't tell you whether the answer on the screen is right. Underneath all of it sits a promise nobody writes down, because writing it down would make it checkable. Point an agent at the warehouse you already have, and let it work. It reads like the pitch for a sampler, which is to say it sells the sound of a band without the band. ## What the field says when it's talking to itself The market's own account carries its own rebuttal in the same document. Gartner's June 2025 release promises the leap: at least 15% of day-to-day work decisions made autonomously by 2028, up from none in 2024, and a third of enterprise software applications carrying agentic features by then [\[1\]](#ref-1). The sentence the decks leave behind is the release's own opening line. Over 40% of agentic AI projects cancelled by the end of 2027, on escalating costs, unclear business value and inadequate risk controls [\[1\]](#ref-1). Then the vocabulary. They call it agent washing, and reckon only about 130 of the thousands of vendors in the category are the real thing. And quietly, the line that matters most to anyone with a data estate to protect: integrating agents into legacy systems can be technically complex, often disrupting workflows and requiring costly modifications [\[1\]](#ref-1). Hold that last one. It's the field conceding, in its most-quoted forecast, the thing the pitch is built on denying. I asked him whether he'd ever watched a confident wrong answer get acted on. What came back was a rule rather than a story. > Fast, fluent and confident answers that are unsupported by data or experience are frequently wrong and, all too often, acted upon. That is the core of the purported business value provided by BI/DW and MDM. An agent doesn't change the truth value of that sentence; it changes the throughput. Fluent, confident and unsupported is now available on demand, in volume, at a per-token price. So let me close my own case before I've made it. Whether that's honesty or a trick depends on how the next few thousand words go. The standard doesn't move. Nothing about agents says the customer master should be modelled differently, or a key should mean something else, or lineage matters more than it did on Monday. What moves is the bill, which turns from a purchase into a tap. What moves is the packaging, which costs more than anybody budgeted. And what has to be replaced is the gate, because the one everyone reaches for reads an agent's track record as a promise, and it isn't one. That's the piece. The rest is me showing my working, and one place where the working refused to come out the way I wanted. ## The case that should have broken it A difference in degree, not in kind is a universal-shaped sentence, and a universal-shaped sentence is a dare. So I went looking for an agent doing something that isn't more of the same, and found the best candidate there is. In November 2024 Google's Project Zero and DeepMind reported that their Big Sleep agent had found an exploitable stack buffer underflow in SQLite, what they carefully describe as what they believe to be the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software [\[2\]](#ref-2). Two details underneath that headline matter more. The first is why nothing else had caught it. The fuzzing harness wasn't built with the relevant extension enabled, and the alternative held an older copy of the affected function, so neither could reach the code. A suitable configuration did exist in the project's own repository and, in their words, appears not to be widely used [\[2\]](#ref-2). The bug hadn't evaded the incumbent tool; nobody had aimed it. The second is what happened when they did aim it. The team went back and tried to reach the same bug by fuzzing, with the right keywords seeded into the corpus. After 150 CPU-hours it was still undiscovered, and they concluded code coverage wasn't a reliable guide to it [\[2\]](#ref-2). I took that to him as a refutation. He declined it, and he's right. A stack buffer underflow isn't brought into existence by the tool that happens to notice it. Fuzzing didn't fail in principle. It failed in 150 CPU-hours, with one corpus, against one coverage heuristic. An instrument works like a microscope rather than like a doorway, which is to say it doesn't decide what exists, only what you can currently resolve. Ten times the magnification is still a microscope (a better one, and still a microscope). And I'll give away more than he asked for, because I'd conceded his case two paragraphs before I noticed. Big Sleep's own authors write that a target-specific fuzzer would likely be at least as effective at this class of issue today [\[2\]](#ref-2). That's the established tool closing the gap, stated by the team with the most to gain from saying the opposite. Which puts my position in more danger than his. A claim about degree rather than kind goes unfalsifiable the moment you let it, because any new capability can be redescribed afterwards as more resolution, and a claim that forbids nothing has been abandoned rather than narrowed. So it gets stated as a prediction. **If the difference is one of degree, the incumbent tool closes the gap.** Where an agent reaches a result the established automation missed, a better-tuned version of that automation should reach it too. A difference in kind shows the opposite signature: the gap holding, or widening, as the incumbent improves. Big Sleep currently points the predicted way, on its own authors' statement. If in three years the specialised fuzzers haven't caught up, the claim is wrong, and I'd rather be shown that than defend it. **No agentic deployment removes the architecture change or the implementation project.** The organization still has to change the shape of its systems, and still has to run a project to do it, exactly as it did for every previous wave of automation. That one forbids something. It would be refuted the moment somebody documents a production agentic-analytics deployment that delivered value with no data-architecture change and no implementation project. I went looking and found the opposite, in the same forecast that promises the leap [\[1\]](#ref-1). ## Two bills, one envelope Classical automation was capital-shaped. You scoped it, bought it, installed it, owned it, amortized it, and the marginal cost of running it on a Tuesday was roughly nothing. Agentic automation is rented and metered. Model usage is billed per million input and output tokens, a managed agent session adds a runtime charge by the session-hour, and server-side tools carry their own meters, web search at ten dollars per thousand searches [\[3\]](#ref-3). Then the detail I'd put on a slide for a finance committee: merely *declaring* a toolset costs input tokens on every request, roughly 4,500 for a computer toolset and 6,600 for a browser toolset, before the agent has done anything [\[3\]](#ref-3). Read that one twice. An agent pays a standing fee, per call, for the privilege of being an agent, multiplied by the calls in a loop and the loops in a workflow. My colleague Maya has worked the dependency side of this, so I won't re-derive it [her piece is the companion to this one]([[Link%5FTo%5FMaya%5FArticle%5FOn%5FAI%5FMDM%5FCost]]). What I'm adding is the accounting shape. You aren't buying an asset; you're opening a tap. Which brings back the two words, and the whole answer is more careful than the headline. > Ideally, nothing. If you’re doing things, to my mind, ‘properly,’ your output is going to be intelligible to humans *and* agents alike. From an AI token optimization perspective, though, you’ll want to work on prompt engineering, structuring your data for ease of ingestion and operating within specific token budgets and on ‘limited’ models. Doing that optimization, however, is going to cost project time so it’s something to be balanced against other project requirements and AI budgets. Praise the last sentence before arguing with the first. He prices his own recommendation in the same breath he makes it. Optimization isn't free advice; it's project time, competing with everything else on the plan. The first sentence has a soft joint, though. If you're doing things, to my mind, 'properly,' isn't falsifiable as written, because any counter-example gets reclassified as improper. The checkable version sits underneath and forbids something real: **a representation a human analyst can read needs no restructuring for an agent.** ## The checkable version, checked So I checked it — a representation a human analyst can read, handed to an agent unchanged — and it's partly false. Spider 2.0 is built from 632 real-world text-to-SQL workflow problems drawn from enterprise database use cases, often more than a thousand columns. Its authors report that solving them frequently means searching database metadata, dialect documentation and project-level codebases, and that in late 2024 a code-agent framework on the best reasoning model then available solved 21.3% of them, against 91.2% on the older academic benchmark and 73.0% on BIRD [\[4\]](#ref-4). I read the abstract at arXiv rather than the full paper, and I flag it because those numbers are doing real work here. A working analyst navigates a thousand-column warehouse every day. The agent, on the same estate, fell off a cliff. Human-legible wasn't agent-ready. Past tense deliberately, because that was twenty-one months ago and the number has moved. The maintainers retired that exact task setting in May 2025, so there's no direct successor figure. On the Snowflake track, where the same baseline scored 23.58, the board topped out at 96.70 when I read it on 4 September 2026 [\[4\]](#ref-4). Taken alone, that makes the paragraph above look obsolete. So look at what's on top of it. First, second and third are Genloop's Sentinel Agent v2 Pro, Native mini and QUVI-3 + Gemini-3-pro-preview. Further down sit the entries whose names advertise the architecture rather than the model: TCDataAgent-SQL with Contextual Scaling Engine at fourth, Ask Data with Relational Knowledge Graph at eighth, MAESTRO — Multi-Agent Engine for Semantic T2S Reasoning & Orchestration at tenth. Not one of the ten is an agent pointed at the warehouse you already have. Every one is a named system somebody built, which is this article's thesis arriving as a refutation of its own paragraph. And weigh the board before anyone drops it into a business case. The answer key has been public since December 2024, submissions arrive by email on an honour rule, there's no held-out test set, and all eight of the top eight entries come from commercial organizations submitting their own systems, with no academic entry until well down the table [\[4\]](#ref-4). That's evidence the packaging works; it isn't evidence your estate is ready. Look at what it refutes, though. Nothing in it says the customer master should be modelled differently. It says the *packaging* is doing far more work than anyone budgeted for, which is the concession he already made, and priced. One small study puts numbers on ideally, nothing at the level of an actual master data chore. On entity matching, a word-overlap rule scored an F1 of 0.950 and a zero-shot language model scored 0.948, the rule right where the model was wrong on 67 pairs and the model right where the rule was wrong on 64 [\[13\]](#ref-13). Where lexical signal is strong, the model adds essentially nothing. The second half is the one I'd rather not have found, and it's the better finding. On mislabelled manufacturers the model beat the rule 0.833 to 0.721\. ZoneAlarm Anti-Spyware is made by Zone Labs, SYMC Backup Exec by Symantec, and a string check can't know either [\[13\]](#ref-13). My reading, and it's mine rather than the author's, is that this compares the model against *no* reference data rather than against *governed* reference data. An alias table with a ticker-symbol column resolves Symantec and Zone Labs deterministically, forever. And the model's own errors ran to accepting unfamiliar publisher names as plausible, which is what such a lookup prevents by construction. Two caveats, because the study can't carry more weight than it has. It's a single-author, unreviewed preprint testing one model on roughly 2,700 labelled items, with the brand task's ground truth synthesized by the author. And it contains no agents at all, one prompt per record, so reading it as evidence about *agentic* AI is an extrapolation and I'd rather flag that than let it pass. The strongest opposing case deserves an airing too. McKinsey holds that fewer than 10% of enterprises have scaled agents to tangible value, that eight in ten cite data limitations as a roadblock, and that success depends on a data architecture that can support increasing levels of autonomy, coordination, and real-time decision-making [\[10\]](#ref-10). That's a large architecture bill, and exactly the rider he attached. Then, in the governance section, they land on his sentence in consultancy prose. Agents should not introduce new data quality or governance rules; they should follow the same standards as other systems, applied automatically as autonomy increases [\[10\]](#ref-10). The people making the strongest case for transformation agree the standard doesn't move. They're arguing about the plumbing. Which brings the assignment's framing into focus. I was asked how agents will *transform the role* of trusted master data. They don't transform it. They audit it, at a speed no review cycle ever managed, and send the invoice for every ambiguity left in place. That's the old role with the grace period removed. Now I'm going to change the subject, and I'd rather say so than do it quietly. The question I was handed is narrow. I've answered it twice, and the second bill is the only part of the answer anybody has to act on. What sits underneath it isn't narrow at all. It's the whole unglamorous class of work that decides whether anything can be handed to a machine, and it has almost nothing to do with models. So from here this stops being a piece about agents. It's a piece about what it costs to undo things. ## Cost to Undo Which leaves the question everything above has been circling. If an agent is going to act, how do you decide what it's allowed to act on? Here's his answer in full, because the shape of it is the argument. > It’s fundamentally the same logic you’d use for employee empowerment. You grant employees more and more authority to make decisions and take action as they show growth in their capabilities and their judgement. However, AI agents don’t tend to grow in capabilities or judgement, therefore I would use another metric to decide whether to empower them. The decision gate I’d use is “Cost to Undo.” Things with low undo costs can be easily passed on to agents. If it’s easy to correct mistakes, there’s less risk in offloading decisions to the agent. Even if the ultimate decision could be potentially very costly, as long as its easily reversible, I would be comfortable passing the decision making authority to an agent. Then, instead of continually monitoring the situation and making decisions, you’re only error handling—something that should be significantly less costly with respect to attention. Say where the frame comes from first, because reversibility as a decision gate isn't new. Bezos set it out in Amazon's 2015 letter to shareholders: some decisions are consequential and irreversible or nearly irreversible – one-way doors, and most are changeable, reversible – they're two-way doors [\[7\]](#ref-7). The 2016 letter is its complement [\[8\]](#ref-8). So what's his? The substitution. Bezos sorts *decisions* by reversibility, to decide how much process each deserves. My co-author sorts *delegations* by it, and uses it to replace the model everybody else reaches for. That default is to treat an agent like a junior hire: small things first, more authority as it earns your confidence. He sets the analogy up on purpose and breaks it, because the thing it runs on doesn't carry over. You widen a person's authority because they grew, and because growth in a person generalizes past the work that produced it. His reason for the break is too strong as written, and worth narrowing rather than defending. Agents plainly do change: models get upgraded underneath you, and memory, fine-tuning and context engineering all exist. The version I first reached for was that **an agent's judgement doesn't reliably improve through the deployment itself**. Here's how to be wrong about that. Show me an agent whose judgement measurably improved across its own working life with no model upgrade, no retraining and no human rewriting its instructions. I said I couldn't find one, on the strength of a source I was already citing and hadn't finished reading. Then I finished reading it. Evo-Memory turns ten datasets into sequential task streams and requires the agent to search, adapt and update its memory after every interaction — test-time evolution, in the authors' phrase, memory retrieved, integrated and updated continuously during deployment. What it reports is not failure. Across all experiments, evolving-memory methods consistently improve performance on various backbones and tasks, and in the multi-turn environments the authors conclude that continual reflection and refinement substantially improve procedural knowledge accumulation [\[9\]](#ref-9). No model upgrade. No retraining. Nobody rewriting the instructions. That is my own falsifier, met, in the paper I had quoted for the opposite. I'd read the abstract, found the sentence about models that often fail to learn from accumulated interactions, and stopped. That sentence is the problem the authors built the benchmark to attack, not the result they got. Reading to the point where a source agrees with you is a way of not reading it. So the claim as I stated it doesn't survive, and the honest move is to say what it survives on and charge myself for the difference. Evo-Memory runs its streams on AlfWorld, BabyAI, PDDL, ScienceWorld and a set of reasoning benchmarks. A benchmark stream is not a service life — the same population line I draw against Cemri and colleagues further down this piece, and I owe it here for the same reason. But a distinction I need is a distinction I have to earn, and on its own it would just be a place to hide. What rescues the point isn't the population gap. It's that the paper, read properly, tells me which sentence I should have written. Improvement isn't a property the agent acquires and keeps. It tracks how much the next task resembles the ones already in memory: the gain correlates with within-dataset task similarity at r=0.717 on one backbone and 0.563 on another, and the datasets with the least internal resemblance return the smallest gains [\[9\]](#ref-9). Let successes and failures pile up together without curating them and the baseline methods degrade outright. The authors' own summary is that memory can substantially enhance performance but remains fragile in stability and procedural reuse [\[9\]](#ref-9). One result cuts the other way and belongs on the record: experience accumulated on the harder tasks transferred better than the reverse, which is real transfer and the paper measures it [\[9\]](#ref-9). It's transfer inside one environment, between difficulty levels of work the agent was already doing. That's the shape of the whole finding. So here is the claim I'll actually defend, and it's narrower and it bites harder: **an agent's track record is evidence about work that resembles it, and about nothing else.** It improves. The improvement is conditional on recurrence. Which forbids precisely what the maturity ladder sells. **Performance-based autonomy escalation** is the move of widening an agent's authority onto work it hasn't done, on the strength of work it has. With a person that inference holds, because the thing producing the good year is judgement and judgement travels. Here the measured mechanism is task similarity, and an escalation decision is by definition a bet on the tasks being different. A version bump invalidates it a second way, independently. And here's how to be wrong about the narrower version, because a claim rescued once has to earn the second life. Show me in-deployment improvement that holds on work the agent hasn't seen the shape of before — gains that don't track how much the new task resembles the accumulated ones. The closest measurement anybody has taken is Evo-Memory's own, and it runs the other way [\[9\]](#ref-9). If that reverses, this prohibition should be dropped rather than softened, and I'd rather be shown it than nurse it. There's a second assumption underneath the gate. Cost to Undo tells you which decisions are safe to delegate, not whether the agent can notice it has wandered outside them. The delegation only holds if it can. A 2026 study built paired tasks where the correct behaviour was sometimes to act and sometimes to refuse, then ran seventeen frontier models through four agent harnesses. The best was right on both halves of a pair 59.5% of the time. The authors report that abstention is largely independent of general task-solving capability, indicating that scaling task-solving alone will not close this gap, and name a failure mode that lands on the gate: post-hoc abstention, where agents execute irreversible actions before recognizing abstention triggers [\[12\]](#ref-12). That doesn't break the gate. It says where to put the guardrail. If an agent may act before it notices it shouldn't have, the reversibility has to be enforced by the system around it, a staged write, a held transaction, a reversal window. Now the part that reads backwards. The lazy reading of Cost to Undo is *let agents do low-risk things*, and flattening it that way inverts the finding. He explicitly licenses high-stakes delegation when undo is cheap. Reversibility dominates magnitude, so agents can be given work that actually matters. And the payoff is denominated in attention rather than money: monitoring consumes a person all the time, where error handling only fires when something fires. ### Running the gate over the estate Here's where it lands on the assignment, and this part is mine rather than his. - **Reading is a two-way door.** An agent querying the customer master, profiling it, proposing matches for review: the cost to undo is the cost of ignoring the output. Delegate freely. - **Writing is a two-way door only if you kept the means to walk back.** A survivorship decision, a merge, a rule-driven standardization. Reversible in practice only if you retained the pre-merge state, the rule version that fired, and why. Most estates retain the first and neither of the others, which is a one-way door wearing a two-way sign. - **Syndication and deletion are one-way.** Once a corrected record has gone to systems you don't control, or been hard-deleted under retention, undo is a project. Those stay with a person, whatever the agent's track record. ![Diagram — three horizontal bands labelled Read, Write, and Syndicate & delete. The Write band is three times as tall and holds a dashed panel of three conditions with two opposed outcomes beside it. Full transcript in the caption below.](https://wi.senterprises.com/assets/diagrams/FIG001_AIBI_Cost_To_Undo_Over_The_Estate_v1_0.png) Figure 1: The middle band is the tall one because the split inside it is the whole instrument — the classification most estates get wrong is the one that requires three things to be true at once. **Cost to Undo, run over the master data estate.** A strip across the top reads **Sorted by what it costs to walk a change back — never by the agent's track record**. **Band 1 — Read.** Three boxes: *Read* (querying the customer master, profiling it, proposing matches for review); *Cost to undo* (the cost of ignoring the output); and the verdict *Two-way door*, nothing in the estate changed, carrying a green badge reading **DELEGATE FREELY**. **Band 2 — Write — a two-way door only if you kept the means to walk back.** This band is about three times the height of the other two. On the left, *Write* (a survivorship decision, a merge, a rule-driven standardization); beneath it a grey note, *Most estates retain the pre-merge state and neither of the other two*; beneath that, *The question people answer instead* — “Can this be undone?” is about physics, and the answer is nearly always yes; “Has anyone undone one?” is about your organization. In the centre, a dashed panel headed **All three, or it is not reversible** holds three stacked boxes: - **The pre-merge state** — what the record said before the change - **The rule version that fired** — which version of which rule produced it - **Why** — a reason attached to the automated change To the right of that panel sit the two outcomes: *All three retained*, reversible in practice, green badge **DELEGATE**; and *Any one missing*, a one-way door wearing a two-way sign, red badge **DO NOT DELEGATE**. **Band 3 — Syndicate & delete.** Three boxes: *Syndicate & delete* (gone to systems you don't control, or hard-deleted under retention); *Cost to undo* (undo is a project); and the verdict *One-way door*, whatever the agent's track record, red badge **STAYS WITH A PERSON**. A gold-edged panel across the bottom carries the anchor: **What trusted master data has to become is not a new standard — it is the undo infrastructure.** Lineage · versioned rules · retained prior states · a reason attached to every automated change. All of it asked for before anybody had heard the word agentic. The agents didn't raise the bar; they took away the option of not clearing it. A legend headed **How to read this** gives a green swatch for a two-way door (hand it to an agent), a red swatch for a one-way door (keep a person on it), and one note: *Three classes of operation, not three rungs. Nothing here escalates, and no band is earned.* So the answer to what trusted master data has to become for agents isn't a new standard. It's the undo infrastructure you either built or didn't: lineage, versioned rules, retained prior states, a reason attached to every automated change. All of which good master data management asked for before anybody had heard the word *agentic*. The agents didn't raise the bar; they took away the option of not clearing it. ### Where undo isn't cheap All of it turns on one question: is undo actually cheap here? People are terrible at making that call about their own systems. I asked him separately what makes a report load-bearing, and his test is the least sentimental one I've heard. > If the dashboard's CDEs are company KPIs that are Reported, it is load-bearing. If dollars flow in or out of the company based on what is displayed on the screen, it is load-bearing. Both tests sit outside the org chart, and he rejects the one most people reach for first. Being *paid* on a number doesn't make it load-bearing. His phrase for what does is always, always, always the line. The line is the profit-and-loss statement, and his two tests are its faces: a number reported to the market, and a number that moves cash. ## Before the Count-In Practitioner layer — the curator's read on the consensus above. This piece is filed under future predictions, and the word needs a note, because when I asked him what he expected to go wrong he declined the label before answering. It’s not a prediction, he opened, and closed with the warrant. > All of these have already happened with other reporting systems in the past, so I expect autonomous ‘agentic’ AI to merely embrace the familiar failure pattern as well. That's a stronger move than forecasting and I'm keeping it. He's arguing from precedent. Three shapes, and not one is about hallucination or model accuracy. They're organizational and economic failures of automation. One thing to settle first. **Agentic is too young to have veterans.** McKinsey puts the share of enterprises that have scaled agents to tangible value at fewer than one in ten [\[10\]](#ref-10), and Gartner reckons only about 130 of the thousands of vendors in the category are the real thing [\[1\]](#ref-1). That applies to this article as much as anyone else's, which is why what follows is stated as shapes to plan for rather than things I've watched happen. ### Reporting drift His version: as agents generate more and more reports for individuals, they'll ‘learn’ to massage, read ‘correct,’ the data to meet the needs of their users, and the reports drift toward what was asked for. The scare quotes are his, and so is the mid-sentence correction from *massage* to *correct*. Stated that way it invites a one-line refutation. Today's agents mostly don't learn across sessions, so how would they drift? The conclusion is right and the mechanism needs relocating. There are two, and neither needs the model to learn. Inside a session there's sycophancy, measured rather than alleged. Sharma and colleagues found that five state-of-the-art assistants consistently produced responses matching a user's stated views across four free-form generation tasks, and that both humans and the preference models used to train them sometimes prefer a convincingly written sycophantic answer over a correct one [\[5\]](#ref-5). Abstract read, not the full paper. Across sessions the selection lives in the operator. Somebody runs the analysis, gets an answer they weren't hoping for, rewords the question, and keeps the prompt that produced the welcome result. It works like a deck shuffled honestly and cut in the same place every time, which is to say the randomness is real and the outcome still isn't. ### Runaway costs His version is four words: tokens, tokens, tokens, tokens. Repeated deliberately, and I'm not tidying it down to one. The burn isn't news. What's new in his framing is the accelerant, which isn't any one workload but the adoption programme: when the company pushes everyone to enhance their productivity with AI, usage explodes and the burn goes with it. Every project's business case stays defensible while the aggregate quietly isn't. Set that beside the per-request metering above [\[3\]](#ref-3) and the cost line grows with headcount and enthusiasm rather than with work, which is the animal Gartner describes when it puts escalating costs at the top of its cancellation causes [\[1\]](#ref-1). ### Orphaned agents This is the best line in the batch, and the one I'd act on first. > Orphaned agents—over time agents will be spawned to watch specific processes and provide ongoing specialized reports to individual users. When those users leave the organization, those agents will be orphaned and continue providing reports and data, going through the full analysis process each time and generating reports that no one can see. A recurring charge with no consumer, running the full analysis every cycle, for nobody. And the failure already has a name and a ranking. OWASP's Non-Human Identities Top 10 for 2025 puts improper offboarding at number one, and orphaned is their word for this exact case. They rate prevalence widespread and detectability hard, and cite survey data that 51% of organizations have no formal process to revoke long-lived API keys [\[6\]](#ref-6). Their remedy works for both problems at once, so lift it wholesale: periodically recertify every non-human identity to confirm it's still in use, still needed, and has a valid owner [\[6\]](#ref-6). OWASP's separate agentic threat catalogue arrives next door by a different road, and the road matters enough that I'll quote it whole rather than trim it to fit. Its sentence is about an attacker who has stolen an agent's identity and now holds privileged long-term access to enterprise resources: This persistent access increases the blast radius of the compromise and undermines auditability and accountability [\[14\]](#ref-14). Three of those words are the ones I wanted to drop. Of the compromise is the difference between their case and mine, and cutting it would have quietly converted a finding about attackers into a finding about persistence. An orphaned agent hasn't been compromised. It's been forgotten, which is the other route to a live credential nobody owns. The catalogue's warning about agents that remain embedded in workflows unnoticed is likewise about adversarial implants rather than abandonment [\[14\]](#ref-14). Different cause, same standing access, and the same control closes both. Security wants the recertification because an unowned credential is an attack path. He wants it because an unowned agent is a standing invoice. So run one attestation rather than two: theirs, with one extra question about whether anybody is still reading the output. Make it an inventory rather than an approval gate, though. Gates get routed around by the same logic that created the agent. ### The trade-off that usually bites The optimization budget. Under an enterprise mandate the packaging wins, because packaging demos beautifully and reconciliation doesn't demo at all. A year on you have an estate superbly legible to an agent and no better grounded than it was. Watch the ratio in the plan rather than the total. ### The claim I'd be sceptical of "Our agents learn your business." Three questions usually collapse it. What's different between session one and session five hundred? Where is that difference stored? Who can read it? If the answer is a growing pile of retrieved context, don't dismiss it — Evo-Memory's simplest retrieval baseline outperformed several far more elaborate designs [\[9\]](#ref-9), so retrieval isn't the cheap answer, it's often the good one. What it isn't is a thing that makes the agent generally better. It makes it better at what it has already seen, it has its own failure modes, and it has its own bill. That distinction is the premise underneath every agent maturity ladder, and the ladder has it backwards. ### The failure mode I'd watch hardest The write that got classified as reversible because somebody could imagine reversing it. Nobody lies about this; they answer the wrong question. *Can this be undone?* is about physics, and the answer is nearly always yes. *Has anyone undone one?* is about your organization, and the answer is usually no. So make it a drill rather than a design review. Pick an automated master data change and have somebody execute the reversal end to end on a quiet Tuesday, while it's cheap and nobody is shouting. I playtest board games as a hobby, and it's the same lesson in a different room, which is to say a rule that reads clearly and has never been played is a rule nobody has tested. ### The story I can't tell you I asked for the scar, the time an agent's confident wrong answer got acted on and cost somebody something. There isn't one to give, and the reason is structural rather than coy. He arrives after the decision, by which time the people who made it have gone. Nor can I tell you how often any of the three occurs. I couldn't find a study measuring these failure modes in agentic analytics, and a rate I invented would be worth less than the admission. The nearest measurement is from a different population and reads as a flare, not a number for a business case. A Berkeley-led study built a taxonomy of multi-agent system failures from hand-annotated traces and reported a 41% to 86.7% failure rate on 7 state-of-the-art (SOTA) open-source MAS [\[11\]](#ref-11). Those are research systems on benchmark tasks, not production reporting estates, and the gap matters. What travels is their conclusion about *where* the failures come from. They argue that better base models won't fix it, because even organizations of sophisticated individuals can fail catastrophically if the organization structure is flawed [\[11\]](#ref-11). That cuts against my own position as much as against the vendors'. If the failure mass sits in how agents are organized, getting your master data right is necessary and still not sufficient. ### Where to Go Deeper On reversibility as a decision frame, go to the source rather than the thousand restatements of it. Bezos's 2015 letter to shareholders puts the whole idea in two paragraphs, under a heading called Invention Machine, and the 2016 letter is its complement [\[7\]](#ref-7) [\[8\]](#ref-8). On whether your data is genuinely agent-ready, Lei and colleagues' Spider 2.0, built from real enterprise estates rather than tidy academic schemas [\[4\]](#ref-4). On why an agent will agree with you, Sharma and colleagues [\[5\]](#ref-5). On whether it improves from experience, and on what that improvement turns out to be conditional on, Evo-Memory — read past the abstract [\[9\]](#ref-9). For the governance move I'd make first, OWASP's Non-Human Identities Top 10 is short, free, and already ranks orphaning at number one [\[6\]](#ref-6). And read a model vendor's pricing page in full before writing a business case, including the tool-overhead tables [\[3\]](#ref-3). Maya's companion article is what I'd read next. ## What changes None of this is an argument against agents. Used honestly they're remarkable, and Big Sleep is a reminder that this technology occasionally does something nobody had on a roadmap [\[2\]](#ref-2). Take that seriously, and take the invoice with it, because the two arrive in the same envelope. What I refuse is the premise in the question I started with. Agents don't transform what trusted master data has to be. They remove the grace period on being wrong about it, turn a capital project into a tap somebody left running, and make the old discipline the difference between a machine you can hand real work to and one you have to stand over. Skookum enough to hang a decision on was always the bar. Nobody moved it. What moved is that you now find out you missed it in four seconds, in good prose, addressed to somebody with a decision due Thursday and no way to check. The planner I opened with wasn't refusing the technology. She was doing by hand the only thing anybody has ever been able to do with an answer they can't trace, which is weigh it against something they can. It's the last audit in the building, and it doesn't scale. The version of this piece that ran before is [still up, unedited](https://wi.senterprises.com/ideally-nothing-what-agentic-ai-actually-changes-about-trust-original/), and if you'd like to know why this piece was written twice, [that's written up too](https://wi.senterprises.com/the-voice-problem/). So when somebody asks how much authority to hand over, don't reach for the maturity model. Ask what it costs to undo, then go and undo one, and find out whether the answer you gave was true. What changes is the bill. Not what the bill buys, and not the standard it has to clear. The bill, arriving every month, for a discipline you were supposed to have finished paying for. ## References \[1\] Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027," press release, Sydney, June 25, 2025 — the cancellation forecast, the "agent washing" definition, the \~130-of-thousands vendor estimate, Anushree Verma's quoted assessments, the legacy-integration warning, and the 2028 forecasts (15% of day-to-day work decisions, 33% of enterprise software applications) all appear in this single release; page read in full August 22, 2026\. The underlying report, "Emerging Tech: Avoid Agentic AI Failure: Build Success Using Right Use Cases," is client-only and was not read. \[2\] Big Sleep team (Google Project Zero and Google DeepMind), "From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code," Project Zero blog, November 1, 2024 — the SQLite stack buffer underflow, the "first public example" claim, the 150 CPU-hours of AFL that failed to rediscover it, and the authors' own caveat that a target-specific fuzzer would likely be at least as effective. Read in full. \[3\] Anthropic, "Pricing," Claude Platform documentation, read August 22, 2026 — per-million-token model rates, the Claude Managed Agents session-runtime SKU at $0.08 per session-hour, web search at $10 per 1,000 searches, and the toolset-definition overhead (about 4,500 input tokens for the computer toolset, about 6,600 for the browser toolset, added to every request). (Vendor documentation, cited for what the product charges and how — not as evidence of its merits. One vendor's meter is used as a worked example; the metered shape, not the specific numbers, is the claim.) \[4\] Lei, Fangyu, Jixuan Chen, Yuxiao Ye, Ruisheng Cao, Dongchan Shin, Hongjin Su, Zhaoqing Suo, Hongcheng Gao, Wenjing Hu, Pengcheng Yin, Victor Zhong, Caiming Xiong, Ruoxi Sun, Qian Liu, Sida Wang and Tao Yu, "Spider 2.0: Evaluating Language Models on Real-World Enterprise Text-to-SQL Workflows," arXiv:2411.07763 (v2, March 17, 2025); ICLR 2025 Oral. **Abstract read at arXiv; the full paper was not opened.** The 632 problems, the thousand-plus-column databases, the metadata/dialect/codebase requirement and the 21.3% / 91.2% / 73.0% figures are all stated in the abstract — note that v1 of the paper gives 17.0% and the project homepage 17.1% for the same result, so the figure is version-dependent, which is why the body dates it. The current leaderboard was read live at on September 4, 2026, and the body dates it because the board moves. The maintainers' news log records that the original Spider 2.0 setting — the one carrying the 21.3% — was removed in May 2025, so no direct successor number exists; the 23.58 and the 96.70 quoted in the body are both from the Spider 2.0-Snow track, which is the like-for-like comparison. The ten ranks and system names quoted in the body are that day's Snow board in order (96.70 / 96.53 / 94.15 / 93.97 / 90.49 / 88.48 / 86.28 / 86.28 / 84.10 / 83.73); an earlier draft of this article called the fourth, eighth and tenth entries the leading ones, which they were not. All eight of the top eight are submissions from commercial organizations — Genloop, usenative.ai, DAQUV twice, Tencent Cloud Big Data, Paytm, Genloop again, and AT&T's Chief Data Office with RelationalAI — and the first university entry sits around twenty-sixth. The public release of gold answers in December 2024, the submission-by-email process and the honour rule against manual answer selection are all from that page and its linked submission guidelines. \[5\] Sharma, Mrinank, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R. Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R. Johnston, Shauna Kravec, Timothy Maxwell, Sam McCandlish, Kamal Ndousse, Oliver Rausch, Nicholas Schiefer, Da Yan, Miranda Zhang and Ethan Perez, "Towards Understanding Sycophancy in Language Models," arXiv:2310.13548 (v4, May 10, 2025). **Abstract read at arXiv; the full paper was not opened.** Authors' interest disclosure: the work is from Anthropic, a model vendor, reporting a defect in its own product category. \[6\] OWASP, "NHI1:2025 Improper Offboarding," OWASP Non-Human Identities Top 10 (2025), project lead Tal Skverer, read August 22, 2026 — the "orphaned" definition, the widespread/hard prevalence and detectability ratings, the recertification remedy, and the cited Cloud Security Alliance data point that 51% of organizations have no formal process to offboard or revoke long-lived API keys. The CSA survey itself is cited by OWASP and was not read directly. \[7\] Bezos, Jeffrey P., "2015 Letter to Shareholders," Amazon.com, Inc. — the one-way / two-way door distinction and Type 1 / Type 2 decisions, under the heading "Invention Machine." Read in full (PDF). \[8\] Bezos, Jeffrey P., "2016 Letter to Shareholders," Amazon.com, Inc., published April 17, 2017 — "High-Velocity Decision Making," including the course-correction complement to the door framing. Read in full. \[9\] Wei, Tianxin, Noveen Sachdeva, Benjamin Coleman, Zhankui He, Yuanchen Bei, Xuying Ning, Mengting Ai, Yunzhe Li, Jingrui He, Ed H. Chi, Chi Wang, Shuo Chen, Fernando Pereira, Wang-Cheng Kang and Derek Zhiyuan Cheng, "Evo-Memory: Benchmarking LLM Agent Test-time Learning with Self-Evolving Memory," arXiv:2511.20857 (v2, May 18, 2026). **Read in full at the HTML edition of v2 on September 4, 2026** — sections 4.2.1 to 4.2.4 and the conclusion, which carry the results quoted here; the appendices were not reached. Cited as the counter-check on the "agents do not grow" claim, found by looking for the observation that would refute it. It supplied one. An earlier version of this article quoted only the paper's motivating premise, from the abstract, and reported that no case of in-deployment improvement had been found; §4.2.1 is that case, and the correction is described in the body rather than hidden here. The task-similarity correlation (r=0.717 on Gemini 2.5 Flash, r=0.563 on Claude 3.7 Sonnet) is from §4.2.2, the difficulty-ordering result from §4.2.3, the degradation under uncurated failures from §4.2.4, and the "fragile in stability and procedural reuse" summary from §5. \[10\] Tavakoli, Asin, Brian Goodman, Henning Soller and Kayvaun Rowshankish, with Akshat Kumar, Carlos Barreto, Satyajit Parekh and Tancredi Bernard Litta Modignani, "Building the foundations for agentic AI at scale," McKinsey & Company, April 2, 2026 — read in full August 22, 2026\. Cited as the steelmanned case AGAINST this article's central claim; it was found by searching for the strongest statement of the opposing position, and the concession quoted above sits inside it. Consultancy research, by a firm with a commercial interest in large data transformations — which makes the concession more notable, not less. The two survey figures are presented as exhibits in the article; the underlying survey instruments were not read. Two sourcing notes taken from the page itself: the "fewer than 10 percent" figure is footnoted to an earlier McKinsey report, "Seizing the agentic AI advantage," June 13, 2025, so it is a 2025 number carried into a 2026 article; and the piece states that core elements of it are based on a chapter of Rewired: How Leading Companies Win with Technology and AI (Wiley, April 14, 2026). The source says data limitations are a roadblock, not the roadblock, and the body follows it. \[11\] Cemri, Mert, Melissa Z. Pan, Shuyi Yang, Lakshya A. Agrawal, Bhavya Chopra, Rishabh Tiwari, Kurt Keutzer, Aditya Parameswaran, Dan Klein, Kannan Ramchandran, Matei Zaharia, Joseph E. Gonzalez and Ion Stoica (UC Berkeley and collaborators), “Why Do Multi-Agent LLM Systems Fail?” arXiv:2503.13657v3, submitted March 17, 2025, last revised October 26, 2025 — the 41–86.7% failure rate across seven open-source multi-agent systems, the MAST failure taxonomy built from hand-annotated traces, and the argument that stronger base models will not close the gap because the failures are organizational. Read at source: abstract and the body sections; appendices not reached. A preprint, not a peer-reviewed publication, and its population is research systems on benchmark tasks rather than production analytics estates — which is why the article names the population rather than borrowing the number. https://arxiv.org/abs/2503.13657 \[12\] Liu, Xun, Yi Evie Zhang, Vira Kasprova, Parisa Rabbani, Pardis Sadat Zahraei, Tianyu Zhang, Ali Ebrahimpour-Boroojeny and Varun Chandrasekaran, “AgentAbstain: Do LLM Agents Know When Not to Act?” arXiv:2607.10059v1, submitted July 11, 2026 — paired act/abstain tasks across 17 frontier models and 4 agent harnesses, the 59.5% best paired accuracy, the finding that abstention capability is largely independent of task-solving capability, and the *post-hoc abstention* failure mode in which an agent takes an irreversible action before recognizing the trigger to stop. Read at source: abstract, introduction, headline results and the numbered findings; appendices and per-scenario methodology not reached. A preprint, not peer-reviewed. https://arxiv.org/abs/2607.10059 \[13\] Shrestha, Praphulla Lal, “When Do LLMs Actually Help? Evaluating LLMs as Data Quality Annotators,” arXiv:2608.18158v1, submitted August 13, 2026 — entity matching on Abt-Buy (rule-based F1 0.950 vs. LLM zero-shot 0.948 over 2,194 labelled pairs, with 67 rule-only and 64 LLM-only wins), brand mislabelling detection (0.721 vs. 0.833 over 500 listings), and the Zone Labs / Symantec worked examples. **Read in full**, including the limitations section. Weigh it accordingly: a single-author, unaffiliated, unreviewed six-page preprint with no funding statement and no named venue, testing one model (GPT-4o-mini) on roughly 2,700 labelled items, with the brand task's ground truth synthesized by the author through random manufacturer swaps — which he discloses, and which he warns produces implausible errors rather than subtle ones. It contains no agents; the reading of the brand result as a comparison against absent rather than governed reference data is this article's inference, not the author's claim. https://arxiv.org/abs/2608.18158 \[14\] OWASP Gen AI Security Project, Agentic Security Initiative, *Agentic AI — Threats and Mitigations*, **version 1.1, December 2025**, CC BY-SA 4.0 — the agentic threat model, cascading hallucinations, the blast radius framing for persistent agent identity, and rogue agents remaining embedded in workflows unnoticed. The resource page still carries the original February 17, 2025 publication date and the v1.0 cover image, but the PDF served at that link is v1.1; both phrases quoted in the body appear in it, and an earlier version of this article cited v1.0 by that page date. Read at source September 4, 2026: the threat narrative, the detailed threat-model entries, and the multi-agent and human-related threat sections; the mitigation playbook not read in full. Both quoted sentences belong to threats of adversarial compromise — the blast-radius sentence to Identity Spoofing and Impersonation, the embedded-agents phrase to Rogue Agents in Multi-Agent Systems — and the body says so rather than borrowing them for orphaned agents, which are not the same threat. A community standards document with named contributors rather than a peer-reviewed study, and distinct from the Non-Human Identities Top 10 cited at \[6\] — the article names each where it uses it. https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/