The agentic enterprise blueprint

What is an AI agent, in an enterprise?

Most of what companies call AI today assists: it drafts, summarises and answers, and a person decides what happens next. An agent acts. Innovation Mode defines it plainly:

Three words in that definition carry the change. Perceiving: the agent reads its environment, the company’s data, documents and systems, rather than waiting for a prompt. Deciding: it chooses among options, against goals someone set. Acting: it takes steps in real systems, which is where both the value and the risk live.

In a company, agents rarely work alone. The book describes a system of specialised agents, each with its own job, coordinated by an orchestrating agent:

The book’s example is an innovation system, but the pattern is the general shape of the agentic enterprise: agents with objectives of their own, working under orchestrating agents, which in turn work under people.

The digitised, AI-driven corporation of the future, as described in Innovation Mode in 2019

The first edition of Innovation Mode, written in 2019, closed by describing where digitisation and AI were taking the corporation:

The closing chapter of the new edition returns to that picture, finds much of it already in place, and looks at the next step:

Read together, the two passages describe the agentic enterprise: a company connected to a digital backbone, sensing and reacting in real time, where routine operations run themselves and people’s attention moves from running the business to pursuing opportunities.

What changes inside the company

Work moves from tasks to goals. Automation followed rules someone wrote. Agents pursue goals someone set, choosing their own steps, which is why they can take over whole workflows rather than single tasks, and why the speed of decisions changes, not just their cost.

The company becomes legible to its own systems. As the book’s preface puts it, a well-integrated AI system knows what is happening inside the organisation, what is happening in the broader market, and how the organisation performs. That knowledge is what agents act on, which makes its quality a leadership concern, not an IT one.

Agents hand work to agents. One agent’s output becomes another’s input, across teams and, increasingly, across companies. A chain of agents can finish in minutes what used to take a week of hand-offs, and it can pass an error along just as fast.

The company opens up to machines. The book’s masterplan ends with an interface layer that lets authorised systems, agentic AI systems among them, query the company’s innovation data. Every function will need the same: deliberate, governed interfaces for agents, inside the company and outside it.

What can go wrong

The same autonomy that makes agents useful makes their failures different from the failures of ordinary software. They fall into three groups.

Agents that do more than they should. An agent with access to strategic plans, product roadmaps or customer data can expose them; an agent that is hacked or misused can act beyond its purpose, and its operations look legitimate because they come from a trusted component. The book is specific about the threat:

Agents that act on bad inputs. An agent fed a superseded policy, a stale price or a feed that quietly stopped does not hesitate; it acts, confidently, and the error is repeated at machine speed and passed from agent to agent. Data Quality in the Era of AI Agents walks through how this happens across structured data, content and tool results.

Agents that misbehave without anyone noticing. Models are probabilistic: the same input can lead to a different action, a test that passes once is evidence rather than proof, and an agent can drift as its inputs change. Without records of what each agent read and did, nobody can say which decisions a faulty source touched, or when an agent started going wrong.

What leaders must govern: the control architecture

None of these risks is solved by choosing a better model. They are solved by the architecture around the agents, and by who owns it. Figure 1 shows the parts and how they connect.

1. Sandboxes: contain what agents can reach. Working agents run in isolated environments with controlled data and content feeds, strict access control and monitoring, reaching only the systems and data their task needs, through well-defined interfaces such as MCP servers. New agents start in a pilot sandbox, with narrower permissions, and are promoted when their results hold up.
2. Gatekeeper agents: check what goes in and out. Independent of the agents that do the work, gatekeepers check inputs against the company’s quality rules before they are used, and hold any output or action that breaks a rule before it reaches a customer, a system or another agent. The standard they apply to inputs is context quality: the measured, evidence-backed quality of everything that enters an agent’s context window, judged on freshness, provenance, permission, verification and feedback. Gartner calls agents that review, monitor and protect other agents guardian agents; gatekeepers are the guardians placed where many failures begin, before an input reaches any agent.
3. Gateway agents: one way in, one way out. Other companies’ agents never talk to the agents that run the business. An inbound gateway receives them, whether they arrive over an agent-to-agent protocol such as A2A or an ordinary interface: it verifies who they are and whom they act for, exposes only what the company chooses to share, screens their requests for manipulation, and routes them to the right place. An outbound gateway carries the company’s own agents outwards, when they buy, negotiate or call outside tools: it enforces their mandate, what they may commit and up to how much, checks the counterparty, and keeps sensitive data from leaving. Google and IBM call this layer an agent gateway, typically one layer for both directions. Here the two are separate by design: the agent that lets outsiders in should never hold the authority to commit the company.
4. Exception handling: stop, say why, escalate. An agent that meets an input it cannot trust does not produce something plausible; it stops the task, says why, and reports the source to its owner. Stopped tasks and held items go to an exception queue, and from there to a person whose decision sends the work back, fixed, or ends it.
5. People in the loop: goals, approvals and judgement. People set the goals, approve the critical decisions and resolve the exceptions. The book’s agent systems run on the human-in-the-loop principle, with ongoing monitoring and a statistical comparison of agent decisions against human ones, so that autonomy grows only where the evidence supports it.
6. Monitoring and control: see everything, stop anything. One central function, which the data quality article calls agent assurance, watches every agent. It starts from an agent registry: every agent listed with its owner, purpose, permissions and sandbox, and no agent runs unless it is listed. Microsoft now builds such a registry into Agent 365; whichever tool holds it, the registry belongs to the company and covers every agent, bought or built. On top of the registry it keeps four records (what each agent read, what it produced, the links between the two across the chain of agents, and what it should have used but missed), a reputation ledger for every input, and an agent health score predicted from the quality of what each agent reads. It alerts owners, pauses agents whose inputs fail, and holds the kill switch.

The book sets out the monitoring this requires:

And it puts the whole architecture in one line: “Securing AI agents is not just about technology; it is about responsible risk management.” Responsibility, in turn, stays with people. Agents carry none; every agent needs an owner as clear as the owner of a team, accountable for its purpose, its permissions and its results. The closing chapter puts the line where it belongs:

From one sandbox to the whole company

Figure 1 shows the controls around one group of agents. A company runs many such groups, one or more in every business function, and they have to work together. Figure 2 shows the enterprise view, with the digital backbone at its centre. It draws the most typical functions; every company has more.

Everything flows through the digital backbone. The 2019 description had the distinct parts of the organisation connecting to a digital backbone in real time. In the agentic enterprise everything flows to and from it: the executive team, monitoring and control, enterprise intelligence, every function’s sandbox, the gateways, and the company’s memory and systems. That makes the backbone the control surface too: every agent is in the registry with an identity and an owner, every message passes through it with its permissions checked, and every exchange is recorded, which is what lets the monitoring function trace a decision back across functions. The gateways are agents in a sandbox of their own, at the company’s edge, joined to the backbone like any function. McKinsey calls its version of this layer the agentic AI mesh.

Every function is a sandbox, led by people. Each business function runs its specialist agents in its own sandbox, behind its own gatekeepers, under its own human lead. A local orchestrator agent coordinates the function’s agents and, together with the function’s lead, is the function’s link to the rest of the company. A function’s agents reach its own systems and data and nothing else, so a pricing error in sales cannot become an action in finance. The function is the usual boundary, not the only one. Much of the value of agents sits in end-to-end processes, such as order to cash, customer onboarding or claims, that cross several functions; such a process can have a sandbox of its own, or the generalist orchestrators carry its work across the functions it touches. Either way, the agents follow the work, not the organisation chart.

Generalist orchestrators live in the backbone. Between the functions, in the backbone itself, sit generalist orchestrators: agents that belong to no single function and work across all of them. They take a goal that spans functions, ask each function’s lead and local orchestrator for what it can contribute, bring results and resources from one function’s specialist agents to another’s, and, where a task needs it, deal with other companies’ agents through the gateways. One rule keeps this safe: orchestrators coordinate, functions act. An orchestrator asks; the function’s own agents do the work, behind the function’s gatekeepers. Generalist orchestrators hold no permissions inside any function and never reach a function’s systems directly; everything passes through the function’s orchestrator, its gatekeepers and the backbone’s records. They have the widest view of any agent in the company, so they must have the least power to act: a hijacked orchestrator that can only ask does far less harm than one that can act everywhere.

The knowledge graph is the organisation’s memory. Between the backbone and the company’s systems sits its evolving memory: a knowledge graph in which data, insights, documents, plans and decisions, drawn from the systems of record below it, live as connected entities, so that every agent and every person works from the same, current picture, and what one function learns is available to the others. The book’s Innovation Graph is its specialised part for innovation, “an evolving network of problems, ideas, insights, and resources from various systems within the organization”, which keeps the innovation function’s knowledge connected and feeds its AI. Whatever lives in the graph is what agents read, so its quality is the context quality of every agent in the company. That is why the graph has a gatekeeper of its own: every write is checked before it is stored and carries its source and its reputation, because a wrong fact written once is read by every agent afterwards, until someone finds it.

Monitoring, control and enterprise intelligence, for all of it. Functions own their agents, but no function can see the failures of another. Agent assurance has to be central: one view of every agent’s inputs, outputs, health and exceptions, and one place that can pause or stop an agent anywhere in the company. The same records serve the executive team. What every agent read, decided and produced, across every function, is also the most current picture of how the company runs: where it performs, where it is at risk and where the opportunities are. That is why monitoring and control sits directly under leadership, beside what Figure 2 calls enterprise intelligence: the same records that let the company stop any agent give its leaders their live view of the company.

Beyond the company: other people’s agents

The agentic enterprise does not only deploy agents; it is met by them. Customers’ agents compare offers and buy, suppliers’ agents negotiate, and assistants answer questions about your company from whatever they can read. Agents acting on behalf of buyers and sellers were filed as a patent in 2016, years before the term agentic AI was in use (see research and patents); AI Agents That Shop (and Sell) For You explains how agentic commerce works today.

Two consequences follow. Your products, prices and terms need to be readable by machines, through the gateways and governed interfaces above, because an agent that cannot read your offer will recommend someone else’s. And what outside agents say about you depends on what they can find and trust: the data quality article calls this your company in other agents’ context, and it is now part of your reputation.

People in the agentic enterprise

The closing chapter is candid that the transition will not be smooth. When agents take over tasks that defined professional roles, people’s work moves up: from producing to directing, from ideas to judgement. The role of the people who innovate becomes, in the book’s words, “more about bringing judgment and wisdom in making bold innovation investments”, allocating resources to the right opportunities and building ecosystems, in partnership with agents.

That shift needs design, not hope: new roles and career paths that value critical thinking, judgement and the ability to execute; recognition and rewards that follow those behaviours; and ongoing upskilling. The book expects the intrapreneur profile, ambitious, autonomous and entrepreneurial, with strong product and business sense, to thrive. It also warns of the cost to culture and self-esteem when agents take over creative work; the innovation culture guide covers that risk, and The Role of the Product Manager in the Era of AI traces the same shift in one profession.

When agents run innovation itself

One application deserves its own name. Agentic innovation is innovation powered by agents: an always-on system in which agents sense the market, frame and assess opportunities, and bring the best of them to the people who decide. It is a discipline with its own architecture, described in Chapter 6 of the book; this blueprint is about the wider enterprise those agents work in.

Where to start

Begin where agents already act. Most companies run more of them than they know: inside vendor products, automations and assistants with access to tools. Map them, with their inputs, their permissions and their owners.

Build the monitoring before the fleet. The four records and the reputation ledger are cheapest to start when there are few agents, and they are what lets you trust the next ones. Context quality is the most neglected control; an agent fed stale or unverified context acts on it with full confidence.

Contain, then extend. Start agents in a pilot sandbox with narrow permissions, gatekeepers on their inputs and outputs, and a kill switch, and widen their reach as evidence accumulates, comparing their decisions with people’s.

Decide the human role explicitly: which decisions keep a sign-off, who resolves exceptions, which roles change, and how the people whose work changes are supported. For a board-ready plan, AI Strategy Advisory works through the use cases, the governance and the roadmap with the leaders who own the mandate, and Chief AI Officer vs Chief Innovation Officer covers who should lead it.