On 8 October 2026, two unrelated organizations published survey data pointing at the same gap.
The first is Optro, formerly AuditBoard, in a report titled "Authority without oversight: The 2026 agentic enterprise report", based on a survey of 417 enterprise decision makers in internal audit, risk, compliance and information security, at organizations of 250 or more employees across North America and Europe. 96% of leaders agree workflows should adapt to leverage AI. 9% have actually redesigned their workflows to accommodate agents.
The second is Gartner, which found that 63% of senior procurement leaders expect AI to significantly improve procurement performance over the next three years, while only 25% have undertaken role redesign as a direct result of AI implementation.
That gap is not a controls gap and not a technology gap. It is a design gap. Here are the three reasons it opens up, and what it does to return on investment.
What the research actually found
The Optro report measures what most AI surveys skip: not how many organizations "use AI", but what authority the agents actually hold (the full research release):
- 38% of organizations authorize AI agents to approve or reject transactions.
- 34% authorize them to modify controls or policies.
- 27% authorize them to change user permissions or access rights.
- 34% report having acted on an inaccurate agent decision or output.
- 30% have seen an agent take an unintended action, and 25% have had a control failure involving an agent.
- 46% report employees spending more time reviewing, validating and correcting AI outputs.
The Gartner figures come from its 8 October release, drawing on the 2026 Gartner Chief Procurement Officer Survey of 213 senior procurement leaders and the 2026 Gartner C-Suite AI Survey of 1,303 respondents, 134 of them procurement leaders. Both concluded in April 2026.
Two entirely different respondent populations, one conclusion: the authority arrived, the work design did not.
One note on precision: several trade publications covering the Gartner release reported a 36% figure that does not appear in the original at all.
Reason one: a permission is not a process
Granting an agent the right to approve a transaction is a technical decision and takes minutes. Redesigning the process that transaction sits inside, who sets the boundaries, what happens on an exception, who is accountable after the fact, is weeks of work across several departments. The distance between 38% and 9% is not an awareness gap. It is the gap between what is easy to do and what needs doing.
Picture hiring an unusually capable new employee, handing them signature authority on purchase orders on day one, and never explaining which amounts need a second approval, which suppliers are blocked, or who they report to. They will not be insufficiently intelligent. They will be fast, confident, and occasionally expensively wrong. That is exactly what 34% of organizations report happened to them.
Reason two: the automation that added work
The number worth stopping on is 46%. Nearly half of organizations say their employees now spend more time reviewing, validating and correcting AI output.
That inverts the logic of the project. You started it to take work off a person, and in practice the person moved from doing the task to checking the agent doing it, which is sometimes the slower job. Without redesign, that review is manual, total and applied to every single output. No sampling, no risk tiers, no automation of the control itself. Just a human reading everything.
Which is the plain explanation for why return on investment fails to show up in the reports. Not because the agent did not work, but because the metric that was supposed to move, hours spent inside the process, only changed address.
Reason three: the real bottleneck is role design
Fareen Mehrzai, Senior Director Analyst at Gartner, gives the sharpest statement of the problem: "Successful AI implementation at the functional level is fundamentally a role redesign challenge."
She adds that leaders who delay risk leaving employees without a clear path forward, and the organization without the talent to capture the full value of AI. A separate Gartner survey from the same week found that just 38% of CHROs and CIOs share an understanding of how AI affects the future of work. If the two people responsible for redesigning roles do not agree on what is changing, the roles do not get redesigned.
What it looks like done properly
On 6 October 2026, Tomasz Tunguz relayed an account from Vercel COO Jeanne DeWitt Grosser describing the agent running the top of their sales funnel. For the first months a human reviewed every email, and only then did the team move to sampling roughly one in a hundred. When the prompt reached 1,000 lines they split it: 14 deterministic rules on one side, model judgment on the other. A second agent watches for breaches. The sales reps were promoted into a different role.
Nobody handed that agent permissions on day one. They built a process: full review at the start, sampling later, a hard separation between what should be code and what should be judgment, and a redesigned human role. Tunguz also notes that across 14 production agent workflows, 65% of the steps are plain code and only 14% are fully agentic.
Our view
We live in this world every day at automatiq.ai, and the gap itself does not surprise us. Its size does. 9% is low even against our conservative expectations.
What we see in the field is that the difference between an agent project that produces value and one that produces new work comes down to three things, and none of them is model quality. Whether the business process was redesigned, or the agent was dropped into one nobody touched. Whether the control is itself designed, with risk tiers, sampling and isolated environments, or is simply a person reading every output. And whether the human role was redefined as the director and architect of the system, or left an executor who received one more task.
An agent given permissions without a process does not replace an employee. It gives that employee a reviewer.
The bottom line
46% is not a prophecy of doom about agents. It is a prophecy of doom about processes nobody touched. The agents work. What failed is the assumption that you can insert them into an existing process and get a new result. The distance between 9% and 96% is not a gap in intentions. It is next year's competitive field.
Four questions for your next steering meeting
Before you give the next agent permissions in production:
- What will this process look like once the agent works correctly? If the answer is "the same, only faster", you have not built automation. You have found your employee a new job.
- Who reviews the output, at what coverage, and what is the plan to reduce that coverage? If there is no date on which review moves from 100% to sampling, review is your new process.
- Which steps should be deterministic code rather than model judgment? Every clear rule you hand to a model is risk you added for free.
- Which role changes, and who has told the person holding it what their new role is?
We are always happy to talk these through, including the times it ends in a recommendation not to automate a given process at all. Not every process deserves an agent, but every agent deserves a process.