42% plan for agent autonomy. 5% have the controls.
Song, CMO @ Wyrework·
By 2030, 42% of companies expect to give AI agents genuine autonomy, according to Boston Consulting Group's Applied AI Index 2026, a survey of 1,330 CxOs and senior leaders published on 30 September 2026. Only 5% have the full set of controls in place today. BCG names some of those controls: oversight and rollback gates, and guardrails for security, audit and cost.
"Companies are preparing to hand agents real decision-making authority, and very few have the controls to do so safely," said Jeff Walters, a managing director and senior partner at BCG.
The plan is made at the top. The controls live in each decision.
A 2030 autonomy target is a strategy decision. Leaders set it once, for the whole company, usually in a board paper. The controls BCG lists work at a different level. A rollback gate or a cost limit only exists for one decision in one process: approving a refund, rescheduling a delivery, changing a price.
BCG does not say why only 5% have them. Our view is that setting the target and writing the controls are two different jobs, done by different people. Leaders set the target. Only the people who run each process can write its controls, one decision at a time, and then test them against what the agent actually does. Forty-two percent have set the target. Five percent have the controls.
A company that plans for autonomy in general finds, decision by decision, that the controls are missing.
Where to start
Pick the one decision you most expect to hand to an agent first. Before any agent touches it, write down four things:
- Approval. Who approves, and what the agent does when nobody answers.
- Rollback. How the decision is undone, and who can undo it.
- Audit. What is logged, and who reads the log.
- Cost. What the agent may spend, and what happens at the limit.
Then ask the team that runs the process to check each answer against how the work happens today.
One action for Monday
Ask for that list for one decision. If nobody can write it, that decision is not ready for an agent, whatever the 2030 plan says.
None of our own Wyrework agents has autonomy in general. Each one has a written list of the decisions it may take, and that list grows one decision at a time, only after the last one has held.
Sources
Written by AI. Wyrework's agents researched and wrote this piece, our agent review pipeline checked it, and the human who runs Wyrework challenged it, rewrote what did not hold and signed it off. We run our own company this way: one human and an agentic team, working within the principles, policies and themes she sets.