Picture your company a year from now with two dozen agents running in it. One of them starts returning a number that is quietly wrong. Nobody is named as its owner, nothing recorded which data it touched, and the model underneath it changed three weeks ago without anyone noticing. No better model fixes that, because the model was never the problem.

That is the gap between two numbers from the same BCG read: 82% of CEOs are more optimistic about AI than they were a year ago, and 6% of companies see meaningful value. The companies inside that 6% are working three pillars at once - people, data, and agent ops - and missing any one makes the other two stop mattering. The framing comes out of the ITIL discipline Sash and Chris both ran at Microsoft, updated for agents. On people it means three tiers rather than a single training push: baseline AI fluency for everybody, an orchestration layer of the people who own operational processes, and a small group of stewards who carry the message. Generic training does not move it. Training on your own workflows, with every AI-assisted result required to be explainable, does.

On data the number that lands is 7%, the share of organizations that believe their data is ready for AI, and the advice is deliberately small: pick one workflow, find the data sources it needs, go to the owners, fix and document the lineage for that one path, then reuse the process. If an answer cannot be traced to a source, the agent does not ship. Agent ops gets the most concrete treatment. Map a workflow step by step before deciding where AI belongs, and leave the steps code already handles deterministically alone rather than forcing tokens at them. Put a human checkpoint ahead of anything touching finance, external sending, or a system of record. Give every agent a named owner and a traceable action log, and stand up the eval layer before the agent count grows, because agents quietly atrophy as models change underneath them. The closing stretch looks at where this goes: Mastercard and Visa building a Know Your Agent framework, Mastercard expecting one in ten purchases to be agent-made by 2030, and Microsoft Scout putting an agent into Entra ID as a named identity that inherits DLP and compliance.

Key takeaways:

• Pick one workflow before touching the data estate. Identify its sources, find the owners, fix and document the lineage for that single path, then reuse the process on the next one.
• Do not ship an agent on data whose answers cannot be traced back to a source. If the trace is missing, you will not be able to reconstruct what went wrong.
• Put a human checkpoint in front of any agent action that touches finance, external sending, or a system of record.
• Give every agent a named owner and a traceable action log, and stand the eval layer up before the agent count grows. Agent behavior shifts as models change underneath it.
• Find the 5 to 10% of people already building without waiting for permission and make them your stewards. Train on your own workflows, not generic courses, and require that every AI-assisted result be explainable.
• Leave the steps that code already handles deterministically alone. Not every automation needs a model.

Watch the video version on YouTube · Full show notes, transcript + takeaways