How do coupled enterprise risks manifest differently in agentic Artificial…

Research Question

How do the coupled enterprise risks, capability debt, incentive-driven shadow Artificial Intelligence (AI) adoption, skill decay, and oversight failure, manifest differently in agentic AI, meaning autonomous multi-step systems, versus generative AI deployments? What integrated risk frameworks best predict and prevent cascading failures? What are the long-term organisational impacts of prioritising measurable speed over unmeasured quality in AI tool adoption, and how can enterprises empirically test "AI for risk reduction first" strategies that address debt and incentives before scaling autonomous agents?

Findings

Executive Summary

Agentic deployments fail differently from generative deployments because they convert the same upstream weaknesses, capability debt, shadow use, skill decay, and weak oversight, into delegated action risk rather than mostly content and information-quality risk.

The strongest predictive model is not a single checklist but a layered combination of Systems-Theoretic Accident Model and Processes (STAMP) control analysis, systems-feedback reasoning, National Institute of Standards and Technology (NIST) lifecycle governance, and enterprise operating signals from DevOps Research and Assessment (DORA) and Cybersecurity and Infrastructure Security Agency (CISA) guidance.

Enterprises that optimise for visible speed before platform quality, policy clarity, and skill retention create reinforcing loops that increase shadow AI, weaken review, and raise the chance that small local shortcuts become enterprise-wide incidents.

A cautious sequencing rule supported by this evidence base is "AI for risk reduction first": use AI to strengthen inventory, monitoring, security, platform context, and low-risk workflows before granting broad autonomy or sensitive access.

Key Findings

1. Once planning, tool use, memory, and delegated action are added, the upstream weaknesses already familiar from generative deployments become execution and permissions failures with a materially wider blast radius.
2. In practice, capability debt worsens shadow AI under agentic deployment because weak sanctioned rails push workers toward unmanaged tools just as those unmanaged tools gain access, state, and action authority.
3. Human skill decay and weak oversight move from quality concerns to containment concerns in agentic settings, since the people asked to challenge plans and stop unsafe actions are the same people whose judgment erodes under repeated over-delegation.
4. A layered STAMP-plus-systems-thinking-plus-NIST-plus-DORA-CISA stack is the most predictive option because it joins causal structure, feedback dynamics, lifecycle governance, and operational sequencing in one frame.
5. Evidence from DORA, IBM, and Cyberhaven points to a reinforcing loop in which local speed gains raise shadow demand and change volume faster than platforms, policies, and review systems can absorb them.
6. Measurable support for "AI for risk reduction first" is strongest where AI is used to improve security, monitoring, and platform context before broad autonomy, since those investments are the ones most consistently associated with lower incident cost and more stable delivery.
7. A credible enterprise experiment should compare rollout sequence, not only tool choice, by tracking shadow use, privileged-action volume, stability, incident rate, override behavior, queue depth, and skill-maintenance measures across autonomy-first and risk-reduction-first cohorts.
8. For scaled agentic deployment, the best-supported control pattern is bounded autonomy with least privilege, explicit action schemas, deterministic human review for irreversible actions, and strong logging or observability instead of universal per-step approval.

Assumptions

• The management and security guidance drawn from critical infrastructure, software, and major-platform environments generalises to broader enterprise deployments because the relevant control surfaces, permissions, logging, review rights, and intervention paths, are shared.
• The skill-decay evidence, which includes medicine and more general information-systems work, is directionally applicable to enterprise AI operations because the shared mechanism is reduced human practice in judgment, verification, and recovery tasks.

Analysis

STAMP and systems thinking carry most of the causal weight here, since the four target risks reinforce one another over time and would be flattened by a single-cause framework.

By contrast, NIST matters because it turns a cascade story into an intervention map through inventory, role clarity, monitoring, risk tolerance, and decommissioning guidance.

DORA, IBM, and Cyberhaven were weighted for operational signal because they quantify what happens when user demand outruns sanctioned platforms, even though some of that evidence is vendor-produced rather than fully independent.

CISA, Microsoft, and Anthropic are the strongest differentiators between agentic and generative deployment because they describe the action layer, not only the harm categories.

The remaining uncertainty sits around the sequencing claim itself: current evidence strongly favors safety nets, internal platforms, and AI-enabled security, but it still falls short of a standardised longitudinal benchmark for rollout order.

Risks, Gaps, and Uncertainties

• Public evidence on agentic AI is still weighted toward official guidance and provider experiments, so long-horizon enterprise incident datasets remain thin.
• Shadow AI prevalence evidence is directionally consistent across sources, but precise magnitudes should be treated cautiously because two of the strongest public sources are vendor-affiliated.
• Skill outcomes remain design-contingent, so enterprises should avoid treating deskilling as inevitable and instead measure whether work design is producing upskilling or deskilling.
• Return-on-investment evidence for risk-reduction-first sequencing is strongest in adjacent signals, security savings and delivery stability, not yet in direct head-to-head rollout trials.

Open Questions

• Which enterprise sectors will publish the first credible longitudinal comparisons of autonomy-first and risk-reduction-first deployment sequences?
• Which skill-maintenance measures are the best leading indicators that human exception-handling capability is degrading before incidents reveal it?
• What is the minimum viable observability package for agentic systems that preserves auditability without recreating the same review bottlenecks it is meant to reduce?

sources

• Leveson (2011) Engineering a Safer World: Systems Thinking Applied to Safety
• Meadows (2008) Thinking in Systems: A Primer
• National Institute of Standards and Technology (NIST) AI Risk Management Framework
• National Institute of Standards and Technology (NIST) AI Risk Management Framework Playbook
• National Institute of Standards and Technology (NIST) AI Risk Management Framework Core
• National Institute of Standards and Technology (NIST) (2024) Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
• National Cyber Security Centre United Kingdom (2023) Guidelines for secure AI system development
• Cybersecurity and Infrastructure Security Agency (CISA) (2026) CISA, United States and international partners release guide to secure adoption of agentic AI
• Cybersecurity and Infrastructure Security Agency (CISA) (2026) Careful Adoption of Agentic AI Services
• Microsoft (2026) Secure autonomous agentic AI systems
• Anthropic (2026) Trustworthy agents
• Anthropic (2026) Teaching Claude why
• Google Cloud DevOps Research and Assessment (DORA) (2025) Announcing the 2025 DORA report
• Massachusetts Institute of Technology (MIT) Sloan Management Review and Boston Consulting Group (BCG) (2025) Agentic AI at Scale: Redefining Management for a Superhuman Workforce
• International Business Machines (IBM) (2025) Is rising AI adoption creating shadow AI risks?
• International Business Machines (IBM) and Ponemon Institute (2025) Cost of a Data Breach Report, The AI oversight gap
• Cyberhaven (2024) Shadow AI: How employees are leading the charge in AI adoption and putting company data at risk
• Open Worldwide Application Security Project (OWASP) (2025) Large Language Model (LLM) Top 10, LLM01 Prompt Injection
• Macnamara et al. (2024) Does using artificial intelligence assistance accelerate skill decay and hinder skill development without performers' awareness?
• Crowston and Bolici (2025) Deskilling and upskilling with AI systems
• Unit 42 (2026) Indirect prompt injection poisons AI long-term memory