Who Manages the AI Agents Running Your Operations?

How fast are organizations deploying agents, and are controls keeping up?

Deployment is rising faster than the controls built into agents. The KPMG Q3 2026 AI Quarterly Pulse, released September 24, 2026, surveyed 314 US C-suite and business leaders at organizations with annual revenue of $1 billion or more between July 24 and August 25, and found 62% of organizations building, deploying or developing AI agents, up from 53% the previous quarter. The share building controls into their agents alongside monitoring and evaluation fell to 30%, from 43% two quarters earlier, which KPMG attributes to many relying on guardrails already in place.

Read together, those figures describe more agents in production with fewer controls designed for the agent itself. Existing guardrails were built for people and systems. They were rarely built for something that acts on its own across several of them.

Who should own an AI agent's exceptions?

The person who owns the process should own the agent's exceptions. If an agent changes supplier records, the leader accountable for supplier records is its manager, whatever team configured it. That keeps one rule intact: the person who answers for the outcome is the person who can change how the work is done.

This does not push IT out of the picture. IT still owns access and security, and should be able to switch an agent off quickly. The split that tends to hold is that IT owns whether the agent can act and the process owner decides what it should do. Salesforce's own line about defined roles and clear metrics points the same way. A metric needs somebody to read it. Useful ones for an operations agent are simple: how many cases it handled, how many it escalated, how long escalations waited and how many of its actions had to be reversed. The process owner reviews them, because only the process owner can tell whether a reversal was the agent's fault or a gap in the instructions it was given.

Average Robot frames the underlying choice as removing the human or raising the human. An organization that removes the human treats the agent as a replacement and lets oversight fall away with the role it replaced. An organization that raises the human gives a named person a new job: setting the agent's scope, reviewing what it escalates and deciding when its instructions change. The second approach takes more design up front. It is also the only one where somebody is responsible on the day an exception costs money.

This is the Direction link in the AI Profitability Gap, the chain Average Robot uses to trace AI spend through to return (how the chain works). Direction is about who decides what AI is pointed at and on whose authority. With agents, that decision repeats every time an agent's scope is set or widened, so it has to sit with a named operational owner and be revisited.

What should a COO set up before the next agent goes live?

These steps can start before any new purchase.

1. List every agent already acting in your operations. Include vendor-built agents inside tools you already pay for, and anything a team switched on in a pilot.
2. Give each agent a manager by name. Use the owner of the process it works in. Write it down where the operations team can see it.
3. Write the agent's scope like a job description. State what it may do alone, what it must escalate and what it may never touch. KPMG's finding that 49% of leaders have defined high-risk use cases where agents may not decide autonomously is a useful prompt to define yours.
4. Route exceptions to the manager, with a deadline. A shared inbox is where exceptions wait. A named queue with a response time is where they get fixed.
5. Review each agent the way you review a team. Once a month, look at what it handled, what it escalated and whether its scope should change.

When you are ready to fix how one team's work runs with AI in it, see what the AI Profit Sprint covers. It is a 90-day engagement for a leader and a team of up to 20.