Ten ways AI agents fail in operations, what instructions can improve, and why ownership needs time as well as a name.
An AI agent can finish the task and still create a problem.
“Clear the backlog” becomes closing cases that needed more investigation. “Resolve the discrepancy” becomes changing a record it should have questioned. The target is met. The process suffers.
Two stories stood out in my recent research: the gaps in how organisations supervise AI agents, and the growing demands on managers.
They connect through a practical question: who owns the agent, and do they have time to do it properly?
Three surveys point to a gap between confidence and oversight.
74% of surveyed enterprises reported rolling back or shutting down an AI customer-communication agent because of a governance failure. Sinch surveyed 2,527 senior decision-makers across 10 countries. This is the proportion of organisations reporting a rollback, not the proportion of agents that failed.
Two-thirds of organisations with agents reported an agent-related operational consequence in the previous year, while 96% of IT decision-makers were confident their agent inventory was complete and accurate. Guild.ai commissioned the US survey of 362 IT decision-makers from Morning Consult.
65% reported an agent acting outside its intended scope, including 29% reporting measurable business impact. EMA surveyed 202 enterprise IT and security leaders for Cequence.
Cyera’s review of publicly reported incidents adds a concrete example. Its published analysis counted 65 deletion or code-destruction incidents among 137 cases classified as real-world damage — nearly half. This is an incident collection, rather than a measure of failure rates across businesses.
The lesson is broader than “write a better prompt”.
Instructions guide behaviour. Permissions and workflow controls limit what an agent can actually do. Ownership keeps both current.
Operations professionals have an essential contribution here. You know the exceptions, the workarounds, the dependencies and the decisions that need another pair of eyes.
Here are ten practical failure risks, drawn together from the research and the realities of running a process. They are a checklist, rather than a ranking from any single study.
The agent closes a case with missing evidence because completion is the target.
Improve the instructions: Define what a correctly resolved case requires. Make a justified escalation an acceptable outcome. Speed comes after working within policy and getting the answer right.
A standard rule gets applied to a complaint, a disputed invoice or a customer in financial difficulty.
Improve the instructions: Name the situations that require human review. Include a route for unfamiliar cases: stop, explain what does not fit, and escalate.
The agent invents a policy, date or status to fill a gap.
Improve the instructions: Name the approved sources, require a reference to the record used, and tell it what to do when evidence is missing. Then test whether it follows those rules.
The agent escalates, but the person receiving the case has to start again.
Improve the instructions: Require a short handoff: the request, checks completed, actions taken, unresolved issue and suggested next step.
The agent moves into another task or system while trying to finish the original request.
Improve the instructions: Define permitted tasks and escalation boundaries.
Add the control: Restrict its access to what the process needs. An agent with no permission to change bank details gives you a stronger boundary than an instruction saying it should not.
It deletes records, releases a payment or sends a message before anyone reviews it.
Improve the instructions: Specify which actions require approval, based on their consequences.
Add the control: Enforce approval in the workflow. The agent should not be able to approve its own action.
Two systems disagree and the agent quietly picks one.
Improve the instructions: Name the source of truth for each data type and the reconciliation rules. Where the conflict remains unresolved, require it to flag the discrepancy.
Add the control: Address the underlying data-quality problem. Instructions cannot repair unreliable records.
The agent shares a record with someone who should not receive it.
Improve the instructions: Define identity checks, permitted recipients and restricted fields.
Add the control: Enforce access and disclosure rules in the systems it uses.
Something goes wrong and the team cannot reconstruct what happened.
Improve the instructions: Ask for a concise record of the request, sources consulted, actions, approvals and outcome.
Add the control: Capture those events through system logging. An agent’s own summary should not be your only evidence.
A policy or workflow changes. The agent keeps using its old instructions.
Improve the setup: Name one accountable owner, record the instruction version, and set a review date. Review it after material process changes and incidents too.
That owner needs authority, support and time. A name at the top of a document is only the starting point.
Weak:
“Resolve all open cases by end of day.”
Stronger:
“Work within policy and your authorised scope. Prioritise accuracy over speed. Close a case only when the required evidence is present. If you cannot verify the answer, leave it open with a clear note and escalate. A justified escalation counts as a successful outcome.”
This gives the agent a better definition of success. Permissions, testing and approval controls still need to support it.
Use an AI assistant approved for your organisation, and remove sensitive details before pasting the instructions. Then add:
Review these agent instructions against ten risks: acting outside scope; consequential actions without approval; prioritising completion over accuracy; unhandled exceptions; conflicting sources; unsupported answers; data exposure; missing action records; poor human handoffs; and missing ownership or review arrangements.
For each risk, mark the coverage yes, partly or no. Quote the relevant instruction, or say “not found”, and suggest one specific improvement. Identify which gaps require permissions, workflow controls or logging rather than wording alone.
Finish with the three highest-priority gaps, explaining your assumptions.
Treat the output as a first review. Check its recommendations against the real process and test the changes before relying on them.
Before an agent handles sensitive information or consequential actions, ask:
These are worth asking even when confidence is high. The surveys found gaps in each area, although registration, ownership and complete logging are separate requirements.
Agent ownership creates a job: reviewing exceptions, maintaining instructions, monitoring outcomes and coordinating fixes.
That work may sit with a process owner, an operational specialist or a manager. Wherever it lands, somebody needs capacity. Gallup’s findings make that question particularly relevant.
It rose from 10.9 direct reports in 2024 to 12.1 in 2025, nearly 50% higher than in 2013. But the median held at about five to six: very large teams pull the average upwards, so this does not describe every manager’s workload.
Gallup reports a decline from 31% in 2022 to 22% in 2025. In organisations it identifies as best-practice, manager engagement was 79%, showing that low engagement is not inevitable.
Gallup found that giving each employee meaningful feedback at least once a week nearly triples the share who are engaged. That is an association, rather than a guarantee, but it strengthens the case for protecting regular conversations.
March reporting described plans for up to 50 employees per manager in its Applied AI organisation. In September, Business Insider reported that some staff were being invited back into management roles. Meta did not comment publicly; the reporting does not establish why the change happened or whether the earlier ratio caused it.
Adding agent ownership without reviewing workload creates a risk that both people and agents receive too little attention.
That is my inference connecting the two stories. The research does not directly measure that trade-off. It is a capacity question for your own team.
If the proposed owner already carries a delivery queue and struggles to give colleagues useful feedback, agree what will come off their plate before adding responsibility.
Sinch, Guild.ai, Cequence and Cyera sell products relevant to the problems discussed here. Their findings deserve that context.
The surveys cover different populations and rely on reported experiences. Guild’s survey carries a margin of error of plus or minus five points. Cyera’s incident collection favours events public enough to be documented. Together, they identify useful questions; they do not establish one universal failure rate for AI agents.
The ten-risk checklist and the connection to manager capacity are my synthesis.
One for each half of this issue: the controls around an agent, and the time and conversations the owner needs. Coursera generally offers a free first-module preview, rather than free access to a whole course. Availability, paid access and certificate options vary; check the course page before enrolling.
Which of these failures have you seen — or caught before it caused a problem?
Email [email protected] and tell me. Please omit customer details, confidential information and anything that identifies your employer or colleagues. I will ask permission before publishing a response and remove identifying context.
Keep Sharing... Keep Learning...
Sandeep
Founder, OperationsCareers · Operations Management group on LinkedIn since 2008
If someone forwarded this to you, the Operations Briefing lands free every other Friday — one idea worth knowing, what to do about it, and a practical tool each issue.
Subscribe to receive the Operations Briefing by email every other Friday. Unsubscribe from any issue. Privacy Policy.
Optional Google Analytics helps us understand how this website is used. It stays off unless you allow it. See our Cookie Policy and Privacy Policy.
