Agents with autonomy. Decisions with an owner.
How we govern a factory of agents: what they do on their own, what a person decides, and how we prove it with our own log.
Many say “agents”. Few can show how they govern them.
of agentic AI projects will be canceled by the end of 2027 due to costs, unclear value or weak risk controls, according to Gartner.
of the thousands of vendors calling themselves “agentic” are real, Gartner estimates. It calls the rest agent washing: chatbots and RPA renamed.
We don't ask you to take our word for it. We publish the cycle, the gates and our own factory's numbers, failure rate included.
Source: Gartner, 25 jun 2025
Agents research, rank and cost. A person decides what to build.
It's our product cycle with agents: every step has an agent with a clear role, and every decision has a person accountable for it.
-
Step 01 · Agents, 24/7
Listen
Market agent · pricing and competitorsVoice-of-the-customer agentPortfolio agent · betsEngineering agent · tech debtAnalytics agent · usage and drop-offsMetrics · what the last release did -
Step 02 · Agents turn signals into one list
Prioritize
Strategic betCustomer requestTech debtData finding -
Step 03 · Cost · weeks · expected impact
Price the options
Option A · MXN · wk · ΔOption B · MXN · wk · ΔOption C · MXN · wk · Δ -
Step 04 · Investment decision · Man in the loop
Investment decision
Man in the loopOne-page spec approved (G0)
Specify
Epic · stories · acceptance criteria as tests
Build through 5 reviews
Tests first (G1) and automated review (G2) · guardian agent · your approval on high risk (G4) Man in the loop
Prove the outcome
Usage · retention · margin → Outcome review Man in the loop
The outcome review checks whether the release moved the outcome, and that feeds step 1. Without an outcome review, a factory measures how it builds, not what it achieves.
Priority = (V × F × C) ÷ (K × (1 + T/4))
V expected value (1–5) · F feasibility (1–5) · C confidence in the data (0–1) · K cost to build and run (1–5) · T weeks until users see it. Every month of waiting counts.
5 reviews before production
Nothing reaches production without passing these five reviews. A person makes two of the calls.
- 1 Idea approved (G0) A person approves the one-page spec: what gets built and how it is measured. Man in the loop
- 2 Tests first (G1) Tests are written before the code, from the acceptance criteria. Reviewed by agents
- 3 Automated quality, security and privacy review (G2) Quality, architecture, UX, accessibility, privacy and security. Reviewed by agents
- 4 Final review by the guardian agent A guardian agent (Gartner’s term) reviews independently. If it says STOP, nothing ships. Reviewed by agents
- 5 Your approval (G4) A person approves the move to production, with a rollback plan. Man in the loop
Every pillar has an owner and a status. No makeup.
Gartner doesn’t leave governance to one person: it spreads it across named roles. In a small company one person covers several; in your diagnostic we assign them to people on your team.
| Pillar | How we cover it | Who owns it (Gartner role) | Status |
|---|---|---|---|
| 01 · Agent identity | Every agent has least privilege; one writer of main; only the data agent writes migrations. Evidence: platform registry with each product’s owner, in the command center. | Security leader, with protector agents that act if an agent steps outside its permissions. | Partial |
| 02 · Runtime guardrails | Security, privacy and isolation are never feature flags. Per-agent circuit breaker. Evidence: security and privacy rules live in code, not behind a switch. The per-agent breaker is still missing. | Protector agents that step in at runtime; the security leader sets the limits. | In progress |
| 03 · Observability and audit | A log of every deploy, small traceable commits, independent external audit. Evidence: 576 commits and 101 deploys in the log (below). | Monitor agents that watch and alert; the CIO or CAIO (chief AI officer) is the evidence custodian. | Running |
| 04 · Agentic FinOps | Which model for which task; cost per delivered unit measured per agent. Evidence: we don’t measure cost per delivery yet; we won’t publish figures until we do. | Technology executive and business leader, together: what each agent costs and what value it delivers. | In progress |
| 05 · Autonomy levels | 10 decisions reserved for a person: production, money, legal, data, brand, deletion, secrets. Man in the loop Evidence: 6 reserved decisions made by a person in 6 days. | A cross-functional team from technology, business and legal that classifies what each agent may decide. | Running |
| 06 · Gates and containment | 5 reviews before production (G0–G4): if the guardian agent says STOP, nothing ships. A rollback plan with every release. Evidence: 1 guardian-agent STOP respected; change failure at 25% with a ≤ 20% goal. | Reviewer agents that check every delivery; the business leader approves the move to production. | Running |
| 07 · Data perimeters | One database per client. In SERENA, only averages of 5 or more people. Evidence: in SERENA, the company dashboard only shows averages of 5 or more people. | Risk and compliance leaders, with legal: what data goes in, where it lives and who sees it. | Running |
How to read the status: Operating = works and is measured · Partial = works in part · In progress = designed, not operating yet. We’d rather show an explained «partial» than seven «OK».
Underneath it all: entity governance. A person signs architecture decisions (ADRs) and contracts; agents propose. Gartner expects the CIO or CAIO to be the custodian of AI evidence.
Roles per Gartner: reviewer, monitor and protector guardian agents (Jun 2025); governance shared across technology, business and legal (May 2026); CIO or CAIO as evidence custodian, with security, risk and compliance (Sep 2026).
Our log is the evidence.
commits in 6 days
logged deployments
to production, each with rollback
Guardian agent STOP honored
reserved human decisions
written lessons