Eighty percent of companies using AI agents say those agents have already done things nobody intended, according to a 2025 SailPoint survey of 353 enterprise IT professionals. The details are specific. In the same survey, 39% reported agents reaching systems they were not authorised to use, 32% saw agents download sensitive content, and 23% said an agent had been tricked into revealing access credentials. A smarter model fixes none of that. What fixes it is the layer a demo never exercises: scoped permissions, an evaluation suite that runs on every change, and a spending ceiling that someone actually watches. Building that layer alongside the agent, rather than after the first incident, is part of why Crunch-IS is a leader in AI agent development services. Each of the three disciplines below fails in its own way, and each needs its own controls.
Permissions: write the job description first
IBM’s 2025 Cost of a Data Breach report, based on 600 breached organisations, found that 13% had suffered breaches involving their own AI models or applications. Of those, 97% lacked proper AI access controls. Sixty-three percent of the organisations studied either had no AI governance policy or were still writing one, and a high level of unsanctioned « shadow » AI added about $670,000 to the average breach cost. Gartner expects that by 2028 a quarter of enterprise breaches will be traced back to AI agent abuse, by outside attackers and malicious insiders alike.
An agent running on a human’s login inherits every mistake that human could make, at machine speed and without the hesitation a person feels before deleting a thousand records. The controls that hold up in production are dull and specific:
- One identity per agent. No shared service accounts and no borrowed employee credentials, so every line in the audit log points to a single owner.
- Read by default, write per tool. An agent that drafts refunds does not need permission to issue them.
- Limits enforced outside the prompt. Refund ceilings, maximum records per run and allowed email domains belong in the API gateway. A rule in the system prompt is a request; a rule at the gateway is a control.
- Human sign-off for anything irreversible. Payments, deletions, external emails, filings.
- Short-lived credentials, rotated automatically and kept out of the context window, where a prompt injection can ask for them.
Evaluation: most teams can see, few can judge
LangChain’s State of Agent Engineering survey of 1,340 practitioners, fielded in late 2025, shows the gap clearly. Observability is close to universal: 89% have some form of it and 62% trace individual steps and tool calls. Evaluation lags well behind. Only 52.4% run offline evaluations against test sets, 37.3% evaluate live traffic, and 29.5% do not evaluate at all. Even among teams with agents already in production, 22.8% run no evaluations.
Tracing tells you what the agent did. It does not tell you whether that was right.
A working evaluation setup starts with a golden set of a few hundred real cases, including the ugly ones: the half-filled form, the customer who writes in two languages, the invoice with a negative line item. It runs on every prompt edit, model upgrade and tool change, because each of those can quietly break behaviour that worked yesterday. LangChain found 53.3% of evaluating teams use an LLM as judge and 59.8% use human review. Both have a place. The model judge gives volume, and the humans keep the judge honest. Finally, a sample of production traffic feeds back into the test set every week, so the suite keeps pace with how people actually use the agent. Teams that skip this step tend to learn about regressions from customers.
Cost: cheaper tokens, bigger bills
Stanford’s 2025 AI Index found that the price of GPT-3.5-level performance fell from $20 to $0.07 per million tokens between November 2022 and October 2024, a drop of more than 280-fold. Agents spend that saving quickly. Anthropic’s engineering team reported that agents typically use about four times the tokens of a chat interaction, and multi-agent systems about 15 times. The same team was blunt that multi-agent designs only make economic sense when the task is valuable enough to pay for the extra tokens. Add a tool that times out and a retry loop with no cap, and a task budgeted at a few cents can run for minutes.
Cost control is an engineering task with four parts:
- A token budget per task with a hard stop, not a monthly alert that fires after the money is gone.
- Model routing, so classification and extraction steps go to small models and only the reasoning step reaches the expensive one.
- A cap on tool-call depth and retries.
- Reporting in cost per completed task. Cost per token says nothing about whether the spend was worth it.
The boring layer is the product
The reasoning is the part of an agent that gets demonstrated. Permissions, tests and budgets decide whether it is still running in a year. Deloitte’s 2026 enterprise survey found only 21% of companies planning agentic AI deployments have a mature model for governing agents, which means most agents going live now will meet their first serious incident before their first audit. Putting the controls in first costs less than explaining afterwards why they were missing.
