The enterprises most likely to pull their AI agents back next year are not the ones that governed too little. They are the ones that governed every agent the same way.
The number that should worry the board
On May 26, Gartner predicted that by 2027, forty percent of enterprises will demote or decommission their autonomous AI agents. The cause it named is not weak technology or thin budgets. It is governance gaps that surface only after a production incident, once the agent is already live and already trusted. Two days later, Fortune reported that board-level AI governance committees have begun pressing management for answers on this exact exposure.
So the board is now asking the question. And the most common answer in the market, govern every agent to the same standard, is the one Gartner says produces the failures it is predicting. The number reads like a warning about doing too little. It is really a warning about doing one thing, uniformly, to a set of systems that are not uniform.
It is worth separating this from the prediction that traveled last year, that more than forty percent of agentic AI projects would be canceled by 2027 on cost and unclear value. That was a warning about hype outrunning substance. This one is narrower and more pointed. It says that even the projects worth keeping will be pulled back, and that the reason will be how they were governed.
The binary trap
Most enterprises run agent governance as a switch with two positions. An agent is either locked down, wrapped in so many approvals and restrictions that it can barely act, or it is trusted, turned loose because it performed well in a controlled demo. Leaders reach for one position or the other because a single setting is simple to explain and simple to audit.
Both positions fail, in opposite directions. Lock down a simple, low-stakes agent and you slow delivery to the point that the team routes around you, standing up shadow agents the governance function never sees. Trust an autonomous, high-reach agent because it looked safe in a sandbox and you let operational, security, and compliance risk accumulate quietly until an incident makes it visible. The first failure frustrates the business. The second ends up in front of the board. Treating governance as binary does not avoid these outcomes. It guarantees you will produce one of them, and usually both at once across different agents.
Autonomy is not access
Uniform governance misfires because it collapses two properties that move independently. The first is autonomy: how much the agent decides on its own, from drafting a recommendation a human approves, to acting with no human in the loop. The second is access: what the agent can actually reach, from a single read-only document to write permissions across production systems and customer records.
These two axes do not track together, and that is the whole point. A highly autonomous agent that can only read a public knowledge base is a low concern. A barely autonomous agent that drafts one email but holds write access to a payments system is a high one. Govern by autonomy alone and you miss the reach. Govern by access alone and you miss the judgment the agent is exercising. Apply one blended tier to everything and you misjudge nearly all of it.
This is also what makes the board-level test simple. For any agent in production, leadership should be able to answer two questions without calling the build team: what can this agent decide on its own, and what can it reach. An organization that cannot answer both for a given agent does not have a governance gap in the abstract. It has an incident waiting for a date.
Proportional governance, defined
The correction Gartner points to is one that regulated institutions already apply to nearly everything else: proportional control, calibrated to stakes rather than spread evenly. No bank routes a stationery order and a wire transfer through the same approval chain. The control scales to what is at risk. Agent governance is that same discipline pointed at a newer object.
In practice it means classifying agents by the combination of autonomy and access, setting a control floor for each tier, and reserving the heavy oversight for the agents that actually warrant it. A low-autonomy, low-access agent gets a light touch and ships fast. A high-autonomy, high-access agent gets human-in-the-loop review, full logging, scoped permissions, and a named owner before it goes anywhere near production. The aim is not more governance, and it is not less. It is governance matched to consequence, so the simple agents move and the dangerous ones are caught before they reach the board.
This is the spine of how EMG's Risk Engine classifies AI use cases: a tiered model that sets a treatment floor by stakes instead of holding every use case to a single standard. The method is not exotic. It is the proportionality a mature risk function already applies to credit, to vendors, and to capital, turned toward a new class of system.
The objection that arrives next is that this sounds like an enormous amount of work: classify every agent on autonomy and access, set a control floor for each tier, and repeat it for every new use case that comes through the door. And it is, if your intake is a form and a workflow. A GRC tool can automate the routing, the approvals, and the record-keeping, but a person still makes every proportionality call inside it. That is why uniform governance stays tempting: one blanket rule is simpler to run than a calibrated system whose every judgment is still manual.
What changes the equation is intelligence at intake, not just automation. In an AI-native approach, as a use case enters the Risk Engine, the system evaluates that use case's autonomy and access and proposes a tier and a control floor in the same step. And because the evaluation is intelligent rather than a checklist, it does not stop at those two axes: the Risk Engine scores each use case across a richer, multidimensional read of suitability, from reversibility to action stakes, the kind of evaluation no team could apply consistently by hand. Classifying a use case is itself a high-stakes act, so that output is a proposal for human review, not a decision the system makes on its own. Proportionality becomes the default starting point rather than a standing project bolted on beside it, and the discipline that looks like more work turns out to be less, because the intelligence does the first pass and a person approves it.
The bet that compounds
When Gartner puts a date on forty percent of agents being pulled back, the reflex is to add control everywhere. That reflex is the failure. Uniform control is precisely what over-restricts the safe agents and still misses the dangerous ones. The enterprises that come out of the next two years ahead will not be the ones that governed the most. They will be the ones that governed in proportion, so they could move quickly where the stakes were low and deliberately where the stakes were high.
Right-sized governance is not a brake. It is the operating system that lets an enterprise run more agents, not fewer, because it knows which ones can be trusted to move and which ones cannot. The institutions that build that discipline now will spend 2027 scaling the agents that work. The ones that governed everything the same way will spend the year explaining the agents they had to pull back.
Proportional governance is the principle. The work is turning it into lived practice, so that every use case is scored, tiered, given its control floor, and assigned a named owner the moment it enters the system. That is the part EMG brings alive, and it is better shown than argued in the abstract.