The Governance Costs Missing From Enterprise Agentic AI ROI Models

Signup Write New Story The Governance Costs Missing From Enterprise Agentic AI ROI Models by Sebastian Martinez Torregrosa by Sebastian Martinez Torregrosa | @ sebastianmartinez Principal PMM for SUSE Linux at SUSE PMM (ex-Engineer, Sales & SAP veteran) with 25+ yrs bridging tech and enterprise. Writing on AI, Zero Trust & Linux. Personal articles.

PMM (ex-Engineer, Sales & SAP veteran) with 25+ yrs bridging tech and enterprise. Writing on AI, Zero Trust & Linux. Personal articles.

One of the most interesting uses of agentic AI is going beyond a predefined path: filling gaps in the specification, finding a way, and acting on it. On paper, the return is obvious. Work that needed a human to find the way can be attempted at machine speed.

The business case for an agent that can find its own way is usually written before the control system is. Capability goes in the numerator. Governance, identity, purpose limits, approvals, evaluation, and the work of writing down what the human already knew go in a footnote called “phase two.”

That is not an accounting error at the margin. It is a comparison between two different products.

Bounded agents on a path you already drew—filters, extraction, a choice among predefined consequential outputs—do not create this path-finding problem. Replacing the human professional can still drop tacit boundaries, but that is a different problem. This is the case for a path-finder allowed to discover how to reach the goal and act on what it finds. The tension begins when finding the path is part of what you are buying.

The human process was expensive because it bundled execution with vetoes. Let the agent find the way and some of that path no longer runs through the human who carried them. Call it replacement, assistance, or delegation; the missing control still has to go somewhere.

The agent process in the slide deck is cheap because it unbundled them and kept only the first.

Humans are not perfect controls. They make mistakes, violate mandates, and take shortcuts. That does not make the controls they carried imaginary.

Many AI ROI models compare a complete human process with an incomplete AI process.

Everyone wants to pay for the new bathroom. Nobody wants to open the walls.

The tiles are visible: faster answers, fewer people, a demo that finds a path nobody flowcharted, an executive who can say the team is “on AI.” The pipes are not: identity, permissions, purpose binding, destination control, composition policy, audit, escalation, the list of paths that were never plans.

The bathroom works because the pipes do. The agent looks cheap because the quote stopped at the tiles.

That does not mean the company had no identity system or no sandbox. The quote did not forget the pipes. It assumed the existing pipes could take the new bathroom—new flow, new pressure, new joins—without pricing the chance they cannot.

You have automated work for decades. Classical automation paid the specification cost up front. You mapped the workflow, named the exceptions, encoded the permitted transitions. For those workflows, agentic AI is attractive because it skips that bill by finding the way instead. You give it a goal, tools, and a short brief. It tries to fill in the gaps at runtime.

Then you try to run it on something that matters.

Least privilege, purpose limitation, and accountable execution force the missing questions into view: which systems, which identities, which verbs, which purposes, which data, which destinations, which composed effects. The specification work the business case eliminated did not disappear for free. It was transformed into risk.

The point is whether the business can afford the risk it is not billing.

You really did avoid specifying the complete workflow. You did not have to pay that specification bill. That does not make the residual risk worth zero.

But knowing there will be some leakage is not the same as knowing what you are accepting. You are not pricing one leak. You are pricing a walk whose next edges may only become visible after the first step. To evaluate how far the exposure can reach, you have to map the paths, joins, destinations, and consequences you paid the agent to discover for itself. Evaluation buys information about the residual risk, not necessarily a complete inventory of it. And that evaluation starts to consume the same specification savings that created the risk.

Reducing that residual risk pushes specification back onto the table: enough of the acceptable space has to be defined to distinguish legitimate discovery from off-mandate action.

The more completely you specify that space, the more of the agentic premium you trade for bounded automation. The less completely you specify it, the more residual risk you keep.

Push evaluation all the way to completeness and the distinction collapses: to know every consequential path and the steps within it well enough to evaluate them all, you have to bound the space the agent can traverse. You are no longer just measuring the open walk. You are turning it into a bounded one. That creates an uncomfortable incentive: the work that would make the remainder fully knowable also attacks the return used to approve the searcher. There is an economic reason not to look all the way.

That does not make AI equivalent to traditional automation. AI can still be enormously useful inside a bounded process: messy inputs, variation, unstructured information. The tension is narrower. It appears where the value proposition depends on discovering consequential paths you did not define in advance.

The broad agentic promise is strongest where comprehensive predefined control is weakest. Making the control complete changes the product.

Path-finding means searching, at runtime, for possible ways of reaching the goal that were not predefined—and acting on them. Comprehensive predefined control means the space in which those consequential steps can occur was bounded before runtime. You cannot require a way to be discovered by taking it and also fully specified in advance.

For path discovery, there are only three scenarios:

There is no fourth scenario: the agent cannot freely discover a path and have a grant already waiting for every step it will take.

Human-in-the-loop is how the second scenario is usually staffed. It is not a miracle. Someone still has to know this is the moment to ask. Escalate every new step the agent discovers as a possible continuation and it cannot proceed unattended. Escalate only the steps your rule recognizes as needing a grant, and the rest stay open. Adding human-in-the-loop can make the operating model infeasible. Even when it does not, it cuts into the ROI.

Human-in-the-loop also has to preserve enough human judgment to mean something. Put the reviewer at call-center volume to preserve the ROI, show them only the proposed step instead of the path that led to it, and approval can become throughput rather than control. That becomes especially dangerous when the appearance of human supervision is what justified leaving more of the search space open.

“Find a way, but only along paths we fully specified” is not an agentic requirement. It is a contradiction.\That is why the first scenario—the safer SKU—is often a different SKU. Narrow agents on a listed graph can print money, just as bounded automation has for decades. They are not the unattended path-finder the business case priced. The fragile object is the agent allowed to find its own way through a consequential space—an autonomous agent sold as a high-value worker precisely because it can discover its own paths: broad mandate, sensitive data, open tools, unattended search, and paths nobody specified in advance.

Even in the third scenario, the controls that make the agent delegable cut into the ROI. Tighten those controls by shrinking the space it can explore, and you also shrink part of what made the broad agent valuable.

But the third scenario has a harder prerequisite: the business must be able to authorize an undetermined remainder. If it cannot accept consequential risk that remains undefined, the third scenario is not a worse investment. It is not a feasible option for that work.

The second scenario avoids accepting every new consequential step in advance, but it pays at runtime instead. At scale, meaningful supervision becomes increasingly impractical unless more of the consequential space is bounded before the agent reaches the gate. The second scenario does not become the first, but making it scalable pushes it toward the first.

Any dollar spent on control is booked as drag. Any dollar spent on the model is booked as future margin.

That incentive is ordinary. It is also why the foundation is late. Identity, policy, evaluation, and explicit constraints do not photograph well. They slow the workflow the slide promised to accelerate. They look unnecessary while the logs stay clean.

Clean logs are not a validation of the architecture. They are the absence, so far, of a path that made the missing graph visible. Past success tells you the system operated under the conditions it encountered. It does not prove the architecture contains the conditions it has not encountered yet.

The same allergy that treats hesitation as a stopper treats pipes as overhead. Sometimes the missing constraint was not forgotten. It was classified as friction. Then the organization discovers that the delay was the control.

Nobody will say they cannot afford the controls. They will say they cannot afford the slowdown. That booking decision is how the foundation stays late. The slowdown is visible now. The failure is probabilistic, later, and may land on somebody else’s ledger.

But somebody else’s ledger is not yours to discount. A recent Australian healthcare incident showed the pattern: a benign brief, a searcher that hit a wall and tried another way, and effects on infrastructure the operator did not own.

Human-in-the-loop feels like a product failure even when it is the right control. Unattended discovery was the product. Approval voids the brochure. People are not only angry that approval is slow. They are angry that approval shows the thing they bought cannot exist as sold.

This is not an argument that public model valuations are a bubble. It is an argument that enterprises grow a local one.

A sponsor backs a broad promise. The demo works. Then production asks for purpose limits, egress control, composition rules, and a written graph of refusals. The safe version is narrower, slower, and more expensive than the pitch. Stopping the project means admitting the original product was the wrong product. Continuing lets the gap be renamed innovation, phase two, learning, or temporary governance debt.

They do not need to believe the 10× forever. They only need not to be the person who killed it. The warning was often available. Hearing it would have changed the slide. Not hearing it preserved the business case.

This does not require dishonesty. The decision is asymmetric. A successful competitor is visible. The incident that has not happened is not.

Each additional investment can make cancellation harder while doing nothing to resolve the contradiction that stalled the project.

The tiles go to production. The pipes stay in phase two. The first leaks look small enough to patch one at a time. A campaign that should not have gone out. A customer field in an external query. Two green grants nobody evaluated together. Each event is treated as a local exception. That is the seductive part of small failures: each one can be explained without revisiting the architecture.

Repeated leaks are not proof the house is sound. They are how the missing architecture shows up before the failure looks sudden.

You did not make the new bathroom cheaper. You removed the plumbing from the quote.

If you want a number that survives contact with production, price both sides.

Build cost: making tacit constraints explicit. Identity. Purpose. Destinations. Composition rules. Evaluation. The time to discover that “be ethical” is not a setting.

Run cost: the friction you put back on purpose. Approvals. Denied edges. Segregation of sensitive data from open channels. The paths you refuse to search. The work that will never be as fast as the demo.

Neither cost proves the project is uneconomic. The question is whether the ROI still belongs to the same product after those costs are included.

Then ask a harder question than “what does the agent save.”

Does the promised return exist only while the agent operates in a space too broad to specify in advance? If yes, residual risk is not an implementation defect around the business case. It is inside the business case. The problem was never only that controls are expensive. A path-finder cannot have every consequential path fully specified in advance without giving up the open-ended path-finding that created part of its value.

Narrow the mandate until the consequential space can be bounded in advance and you may still have a good project. You may not have the project that was approved.

There is a point where this stops being a pricing problem. Can the organization authorize the undetermined remainder at all?

If the answer is yes, leaving some paths open may be a legitimate choice. The business keeps more of the exploratory premium and knowingly carries risk it cannot fully determine in advance. That risk is not free. It is part of what bought the return.

If the answer is no, there is no risk-adjusted ROI that rescues the open path-finder for that work. The architecture that produced the return is not feasible for that use. The consequential space has to be bounded or newly discovered steps have to be supervised. Either choice changes the economics and, pushed far enough, changes the product.

And not every consequence necessarily stays inside the organization making that choice. An off-mandate path can reach customers, counterparties, public infrastructure, or somebody else’s systems. The party on the other end did not accept your scenario 3. Some consequential uncertainty may not be yours to accept.

That makes the incentive not to look especially ugly. The work that would make the remainder more knowable can reduce the return used to justify the agent. But choosing not to know does not make the remainder free. If an unevaluated path later harms someone outside the firm, the decision to leave it unevaluated becomes part of the story of how the system was authorized.

The original slide cannot have this both ways. It cannot book the economic value of leaving the path open while treating the undetermined remainder as if it were already controlled.

The hype is not that AI has no value. The hype is pretending that broad autonomous capability and tight enterprise control come without a tradeoff.

There is no magic layer that converts open-ended exploration into closed-ended economics. You can pay to define the path. You can pay to supervise the path. Or you can accept that some paths remain undefined.

You can buy the explorer. You can buy the colleague’s refusals. You cannot book both at the explorer’s price and call the difference productivity.

This article is the economics. Related: AI Isn’t Escaping. We Built an Agent and Expected a Human and Escape Surface: A Missing Security Concept for AI Agents.

AI Isn’t Escaping. We Built an Agent and Expected a Human.