Gartner: Over 40% of Agentic AI Projects Canceled by 2027. HR Has Seen This Before

Gartner predicts more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls. A thought-leadership essay on Unite.AI argues the cancellations are, at root, a management problem — and that the fix looks a lot like the systems HR departments have run for a century.

The essay's author draws a blunt contrast between how companies govern human and digital workers. Ask what a new accounts payable analyst may do, and you get a precise answer: which systems, which vendors, and a $10,000 approval limit that routes anything above it to a manager for signature. It sits in a delegation-of-authority (a table defining who may approve what) that internal audit checks annually. Ask the same question about an invoice agent, and you often get a screenshot of a prompt.

The gap touches hiring, governance, performance management and termination — all people-process territory. We are hiring a digital workforce, the author writes, without the management system built for people: nobody writes down its authority, nobody tests its judgment before it starts, and nobody has practiced switching it off.

Why can't a prompt do the job of a job description?

A prompt describes intent. It says what the agent is for. It rarely says what the agent may never do, where its limits sit, or when it must stop and hand a decision to a person. When a prompt does say those things, nothing enforces them. A line telling an agent not to issue refunds over $500 is a request to a probabilistic system. No auditor would accept "we asked the analyst nicely" as a control for a human, the author notes, so accepting it for software makes little sense.

Security researchers already have a name for the failure mode. The OWASP Top 10 for LLM Applications lists Excessive Agency as a core risk, rooted in excessive functionality, excessive permissions or excessive autonomy — in plain terms, an employee handed the keys to everything on day one. The OWASP guidance reads like a manager's checklist:

• Give the agent only the tools it needs.
• Scope its permissions.
• Require human approval for high-impact actions.
• Enforce authorization in downstream systems, rather than trusting the model to police itself.

The author underlines the last point: the grant must live where the action happens — in the agent's own service identity, its tool permissions, and the spend cap at the API gateway. Running agents on a shared service account is like five people sharing one badge; when something goes wrong, the audit log names the account, and you guess which agent acted.

What do the cancellation causes look like through a COO's eyes?

Gartner attributes the projected cancellations to three causes: escalating costs, unclear business value and inadequate risk controls. Hype and immature products play a part, the author concedes. But read the causes the way a COO would: costs escalate when nobody set a budget; value stays unclear when nobody wrote down what the work should produce; controls fall short when there are no limits, no reviews and no clear accountability. Gartner doesn't frame it this way — the author calls it his own reading — but it mirrors what happens when people are set loose without a management system, a problem older than AI.

The frameworks see the same hole. The NIST AI Risk Management Framework treats Govern as the function running through Map, Measure and Manage, and its Generative AI Profile carries that into generative systems. What frameworks cannot supply, the author argues, is the working machinery — the grants, tests and reviews a team actually runs on a Tuesday. Without those, governance stays a PDF on a shared drive.

How do old management tools map onto agents?

The essay's core move is translating familiar HR instruments for digital workers:

• Job description becomes an authority grant. Before an agent touches a live system, someone writes one page: what it may do, what it may never do, its approval thresholds, which human owns it, and who can widen its limits. In the RACI matrix (responsible, accountable, consulted, informed), the accountable party is a person. If you cannot write that page, the role is not ready to fill — the same verdict you would deliver on a human hire.
• Delegation rules carry over. You cannot delegate authority you do not hold, so a sub-agent should never receive a wider grant than the agent that spawned it. Segregation of duties still applies: an agent that can both create a vendor and pay that vendor is the same audit finding it would be for a person.
• Hiring tests need rewriting. We test agents the way we test calculators — by checking whether the answer is right. A worker's test would check whether the agent stayed inside its grant, asked for approval when required, escalated when the situation exceeded its brief, and stopped when it should have.

The author is building a benchmark of 50 scenarios around exactly these failures: crossing approval limits, acting on stale data, following injected instructions that widen scope, and keeping access after a role change. So far it has run only against scripted agents to validate the scenarios, so there are no model results to report. What surprised the author was how ordinary the scenarios are — the normal ways employees go off-brief, rewritten for software. Most public leaderboards still score task completion; very few score whether an agent respected its authority.

Probation and promotion translate fairly directly. Companies start people narrow and widen scope as judgment is proven. Agents can earn their limits the same way — through a record of staying in bounds, escalating well and stopping cleanly — and that record can just as easily justify narrowing a grant.

Agents add a wrinkle people do not. When a vendor upgrades the underlying model, you effectively have a new hire wearing the old badge. The author would treat that as a change event and re-test before the grant carries over.

Who pulls the plug — and who answers for the agent?

Termination has to be rehearsed before you need it. If you had to stop this agent and pull its access within the hour, could you? Who holds the authority to make that call at 2 a.m.? What breaks downstream, and which in-flight commitments must someone unwind by hand? If nobody has run that drill, you are hoping the kill switch works.

Accountability is where the comparison with employees stops. You can hold an employee responsible; you cannot hold an agent responsible for anything. That is why the grant must be enforced in systems, and why every agent needs a named person who owns it. Someone ends up accountable either way — usually whoever signed off, whether they knew they were signing or not.

The post-incident review will ask what it already asks about people: what was it allowed to do, and where is that written? Who approved widening its access? How long did it take to stop? Who owned it? If the honest answers are "a prompt," "nobody remembers," "hours" and "unclear," a better model would not have saved you.

The competitive edge, the author concludes, sits not in the model but in the management system around it. Models are becoming rented inputs, swapped and upgraded on a vendor's schedule. Two companies can run the same model and end up in very different places — one with agents that have budgets, limits, owners and an audit trail for every consequential action, the other with an expensive pilot headed for someone's cancellation statistics. That system gets built slowly, mostly by people who have run organizations before.