Enterprise AI's Real Risk in 2026: The Complexity Between Agents, Not the Agents

Agent complexity is the insidious shadow lurking inside enterprises right now. Because enterprises don't deploy a single agent and watch it run — they deploy fleets, each one calling APIs, calling other agents, reaching into applications that were never built with a machine decision-maker in mind. That's the failure mode that should keep you up at night: a windy, complicated system nobody can see clearly enough to govern. But why do things get so opaque so quickly? Add a second agent to a system, and you've added one connection. Add a tenth, and you haven't added ten connections — you've potentially added dozens, because now any agent might call any other, and each of those calls can trigger a call somewhere else. Complexity doesn't creep up with agent headcount. It compounds with the number of paths between agents, and nobody's job is to draw that graph.

1. Complexity Compounds Along Paths

A support ticket that used to touch one system might now pass through four agents before a human ever lays eyes on it, and every one of those handoffs is a decision point nobody approved. Most enterprise AI programs stall when the humans responsible for their agents lose the thread. Ask a security team a simple question — which agents can reach which systems — and watch the silence. Ask which agent triggered which downstream action three hops ago. More silence. The instinct is to treat this like a checklist: approve the agent, log the agent, move on. I'd argue this is the wrong instinct. A checklist checks a single point in time. Complexity runs across a chain, and you can't govern a chain with a stack of one-time approvals any more than you can call a diet successful because you had a vegetable once.

// Why complexity compounds: add a second agent and you
// have one connection. Add a tenth and you have dozens,
// because any agent might call any other, and each call can
// trigger a call somewhere else.
function maxPairs(n: number): number {
  return (n * (n - 1)) / 2;
}
maxPairs(2);  // 1
maxPairs(10); // 45 — and that is only pairwise paths
// Nobody's job is to draw that graph. That is the risk.

2. Where It Breaks Down First: Permissions Creep

Permissions creep comes first. Somebody builds an agent to summarize support tickets, grants it broad API access because scoping it properly would have taken another sprint, and forgets about it. Six months later, that same agent has a path into the payments system. Nobody remembers signing off on that. Nobody did. This is the classic shape of "nobody remembers approving it": the broad grant was a shortcut, and the agent never shrinks its own permissions. Every wide grant is a dormant path waiting for some downstream system to come within reach. The fix is not a permissions audit once a quarter; it is scoped authority at creation time and revocation that actually fires.

// Agent identity: every agent exists as its own entity, not
// a shadow permission borrowed from whoever deployed it.
type Agent = {
  id: string;            // its own name in the register
  sponsor: string;       // a named human who answers for it
  scopes: string[];      // scoped authority, granted not inherited
  register: "active" | "revoked";
};
const ticketSummarizer: Agent = {
  id: "agent:support-ticket-summarizer",
  sponsor: "alice@corp",
  scopes: ["tickets:read", "triage:write"],
  register: "active",
};
// Six months later it must NOT have a path to payments.

3. Ownership Thins Out Along the Chain

And ownership thins out the further the chain runs. Five agents touch one workflow, something breaks at step four, and now you're asking who is responsible for a link nobody was ever assigned to own, because the org chart stopped at "deploy the agent" and never got to "name the human who answers for it." When every link has a named owner, failures have an owner too; today, the longer the chain, the fuzzier the accountability. This is a story about governance infrastructure that hasn't caught up with how agents actually behave: interconnected, cascading, multiplying faster than the processes built to track them.

// Enforcement before execution: a system that STOPS an
// out-of-policy call before it executes is governance. A
// dashboard that shows you a breach five minutes after it
// happened is only monitoring.
async function guardedCall<T>(agent: Agent, call: Call): Promise<T> {
  const decision = await policyEngine.evaluate({
    agent: agent.id,
    action: call.action,
    target: call.target,
    chain: trace.getAncestors(call), // 3 hops back
  });
  if (decision !== "allow") {
    audit.log({ agent: agent.id, call, decision, at: Date.now() });
    throw new PolicyBlocked(decision);
  }
  return execute(call);
}
// Monitoring tells you what happened. Enforcement is the
// piece most programs skip.

4. Fixing the Cluster Starts with Identity — But Identity Is Not Enough

Fixing the cluster starts with identity. Every agent needs to exist as its own entity, not a shadow permission borrowed from whoever deployed it. Its own name in the register. Its own scoped authority. A named human sponsor who answers for what it does. That part is necessary. But it is nowhere near sufficient. The harder piece is the oversight that holds across the entire chain, not just at each individual link: you need to see what an agent did, what it set off downstream, and where that trail ends — in real time, not in a report someone pulls together once a quarter. Get agent-level identity right and stop there, and you end up with a filing cabinet full of perfectly documented agents operating inside a system nobody can actually explain.

5. Oversight Only Tells You What Already Happened

Oversight by itself only tells you what already happened. Watching a chain isn't the same as controlling it. Enforcement is the piece most programs skip: the ability to stop an out-of-policy call before it executes, not just log it for someone to find in a review three weeks later. A dashboard that shows you an agent breached its scope five minutes ago is a monitoring tool. A system that stops the breach from happening in the first place is governance. Enterprises serious about agent accountability need both, and most have only built the first. The moment a security team cannot answer "which agents can reach which systems," you are already behind.

// Ownership that doesn't thin out: name the human who
// answers for every LINK, not just every agent. The org
// chart stops at "deploy the agent" — push it further.
type Link = {
  from: AgentId;
  to: AgentId;
  owner: HumanId;      // answers when step four breaks
  approvedBy: HumanId; // and who signed off
  approvedAt: string;
};
const links: Link[] = registry.getAllLinks();
// Ask "which agent triggered which downstream action three
// hops ago" and the silence comes from missing Link rows.

6. The Goal: Human-Agent Harmony

Complexity is not a reason to pump the brakes. The enterprises getting this right aren't slowing down — they're building toward Human-Agent Harmony, where scale and accountability grow together instead of trading off against each other. The real risk was never a single agent doing exactly what it was built to do. It's a hundred of them doing exactly that, all at once, interacting in combinations nobody designed for. That kind of multiplication is what keeps enterprise AI stuck running pilots forever instead of running production. Solve for complexity — identity, chain-level oversight, enforcement before execution — and autonomy stops being the villain. It starts being the whole point. Answer the one question: what is this system doing right now, and who is responsible for it?

// Chain-level oversight: you need to see what an agent did,
// what it set off downstream, and where the trail ends — in
// real time, not in a quarterly report.
async function traceChain(start: AgentId, depth = 3) {
  const trail = [];
  let current = start;
  for (let i = 0; i < depth; i++) {
    const step = await telemetry.getStep(current);
    trail.push({ agent: step.agent, action: step.action,
                 target: step.target, at: step.at });
    current = step.next ?? break;
  }
  return trail;
}
// A filing cabinet of perfectly documented agents operating
// inside a system nobody can explain is not governance.