The Autonomy Line

Before you board, about 6 minutes

Start here: how to read the map

Most enterprises bought AI coding tools first, and are now being asked about agents. These are not two projects. They are one line, and your organisation is already on it.

The idea in one minute

A coding assistant that suggests the next line and a business agent that processes a case are built from the same five parts. What changes along the line is autonomy, how much the AI does before a person looks, and reach, how much of the business it touches.

You earn each station. Autonomy is granted in proportion to the controls and the evidence you have, never in proportion to the excitement. That is the whole discipline of enterprise AI adoption, and the rest of this guide is detail.

Four tracks run under the entire line: Platform, Guardrails, People and Value. The train can only go as far as the shortest track. Most stalled programmes have a train at Station 3 and a track that ends at Station 1.

How to use this guide

• Nine stops, about 111 minutes. Every station has the same layout so you can skim: what it is, what it looks like in practice, what to build on each track, the gaps to mind, and how you know you can move on.
• One company runs through every example. Alderline Health is a fictional composite: 14,000 people, 1,600 engineers, and a prior authorization platform at the centre of its operations. Its numbers illustrate the pattern. They are not benchmarks.
• Each stop ends with one checkpoint question. Answer it and the stop is marked on your line.
• Presenting it? The left and right arrow keys move between stops, and the night map is easier on a projector in a dark room.
• Short of time? Go straight to the one-page route card, or find your station with the six-question assessment.

Board the train

The approach, about 10 minutes

Why the line starts with code

Software engineering is where an enterprise learns to work with AI, because it is the one place where the work checks itself.

Four reasons to begin in engineering

• The work can be verified. Code compiles or it does not. Tests pass or fail. No other kind of knowledge work gives AI such fast, objective feedback, which is why AI improved here first.
• The people are ready. Engineers adopt tools quickly and tell you bluntly what works.
• Mistakes are contained. Version control, code review and rollback already exist. A bad suggestion is caught before it ships.
• The lessons transfer. Everything your engineers learn about briefing, checking and limiting a coding agent is what the rest of the business will need for its agents two stations later.

Every agent has the same five parts

Strip away the product names and an agent is five things. Leaders who can name them can ask good questions of any vendor or team.

A chatbot has the first two parts. A coding assistant adds a few tools. An agent has all five, and the loop is what makes it an agent: it acts, looks at the result, and tries again without being asked.

Everyone can rent the same model. Your advantage is your context, your tools and your guardrails, and those are built station by station.

The autonomy dial

The five stations are five settings of one dial. Turn it and watch what the AI does, what people do, and which control has to exist before you are allowed to turn it further.

What the evidence says

Five findings every leadership team should hold in mind at once.

Read together: adoption is nearly universal and value is not. The difference is never the tool. It is the system around the tool, and that system is what the five stations build.

One caution about the first number in any survey you read, including these. Figures near 90% come from asking executives, and executives are answering about ambition as much as practice. When the US Census Bureau asks businesses directly, in a survey built as a random sample rather than a panel, about one firm in five reports using AI at all. Both numbers are honest and they are measuring different things. If your board is anxious that everyone else is further ahead, that gap is the reason, and the 7% above is the part that matters.

What engineering teaches the rest of the business

This is the reason to take the first two stations seriously even if your real interest is agents in operations. Each habit your engineers form has a direct twin in a business agent.

Station 1 of 5, about 9 minutes

Assist

AI suggests. People do the work and own every line of it.

What it looks like

An assistant inside the code editor and a chat window beside it. GitHub Copilot, Claude Code, Cursor, Codex and their peers all start here. The assistant completes the line being typed, explains unfamiliar code, drafts a test, writes a SQL query, summarises a log file. The engineer reads every suggestion and decides what to keep.

It is the lowest-risk station on the line, and the one where the habits for the other four are formed.

Before anyone boards

Four foundations, none of which takes longer than a month:

• A one-page use policy. What data may go where, which tools are approved, and one sentence everyone remembers: you own what you ship, whoever typed it.
• Enterprise terms. Licences that keep your code out of model training and limit how long it is retained.
• Sign-on and telemetry. Single sign-on, and usage data you can actually see.
• A named owner for adoption, with time to do the job.

Where assistance helps, and where it misleads

Station 2 of 5, about 13 minutes

Delegate

People hand over whole tasks. AI does the work. People direct it, review it and own the result.

The shift

At Station 1 the engineer types faster. At Station 2 the engineer manages work. A coding agent reads the repository, makes a plan, edits many files, runs the tests, fixes what fails and opens a pull request. The engineer's day moves from writing to four other verbs: specify, delegate, verify, review.

1. PersonSpecifyWrite the brief: goal, scope, how to verify, when to stop and ask.
2. AgentPlanReads the code and proposes an approach. The person approves it.
3. AgentBuildEdits files and runs tests in a sandbox until they pass.
4. PipelineVerifyAutomated checks: tests, security scan, style, coverage.
5. PersonReviewReads the change. Accountable for merging it.

A person actsThe agent or the pipeline acts

Two documents worth recognising

You do not need to write these. You do need to know that teams without them are delegating blind.

# AGENTS.md: prior-auth-eligibility service

## What this service does
Decides member eligibility for a prior authorization request.

## How to build and test
./gradlew clean test        # must pass before any commit
./gradlew integrationTest   # needs local Postgres, see docker-compose.yml

## Rules
- Never change files under /rules/clinical without a linked ticket.
- No new dependencies without approval. Ask first.
- Member health data never appears in logs, tests or commit messages.
  Use the fixtures in /testdata.
- Keep pull requests under 400 changed lines.

## Done means
Tests pass, coverage does not drop, CHANGELOG is updated.

Task          Upgrade this service from Java 8 to Java 21.
Follow        docs/migration-playbook.md
In scope      Build files, deprecated APIs, javax to jakarta imports.
Out of scope  Business logic. Database schema.
Verify        All unit and integration tests pass. Service starts locally.
Stop and ask  If any test needs its expected value changed.

The last line of the brief matters most. A test that needs a new expected value means the behaviour of the system changed, and that is a decision for a person.

Five disciplines to make normal

• Context engineering. Write down how your systems work, in files agents read. Knowledge that lives only in people's heads is now a delivery bottleneck.
• Specification first. Goal, scope, verification, stopping rule.
• Tests as the contract. An agent is exactly as safe as your test suite is good. Weak tests plus fast agents means fast damage.
• Small batches. Many small pull requests. Never one 5,000-line drop that nobody can review.
• Permissions as engineering. Sandboxes, short-lived scoped credentials, and approval before any destructive command.

The new bottleneck is review

If agents write code three times faster and people review at the same speed, you have not sped up delivery. You have built a queue. DORA's 2026 work names the cost directly: a verification tax, the extra effort of checking that generated code is correct, secure and fits the architecture.

Pay it on purpose. Strengthen the automated checks. Add an AI first-pass review so people see cleaner changes. Tier human review by risk: deep for payment logic and clinical rules, light for documentation and tests.

Station 3 of 5, about 13 minutes

Integrate

AI stops being a personal tool and becomes part of how the team's system works, on a platform everyone shares.

Why this station exists

Stations 1 and 2 make individuals faster. But delivery is a system: requirements, code, review, test, security, release, operations. Speed up one step and the queue simply moves to the next. At Integrate you do two things. You put AI at every step of the flow, and you build the shared platform that every future agent, in engineering and in the business, will run on.

This is the least glamorous station and the one that decides whether Stations 4 and 5 are possible.

1. PlanTurn a rough request into a testable specification.
2. BuildCoding agents work from tickets, in the background.
3. ReviewAI first pass on every change. People focus on design and risk.
4. TestGenerate missing tests. Maintain test data.
5. SecureTriage scanner findings. Propose the fix.
6. ReleaseWrite release notes. Score change risk.
7. OperateTriage alerts. Draft the incident summary.

The shared platform

Engineers call this the paved road: the easy, safe, default way to build with AI. If the paved road is good, teams take it by choice and governance comes free. If it is missing, every team lays its own gravel path.

Two decisions to make once, centrally

One gateway. Every model call in the company goes through it. That single decision gives you cost control, a complete audit log, data protection in one place, and the freedom to change model vendors without touching every application.

Open connectors. The Model Context Protocol (MCP) has become the common way to connect agents to tools and data. Since December 2025 it has been governed by the Linux Foundation's Agentic AI Foundation, which now also hosts the A2A protocol for agent-to-agent communication and the AGENTS.md convention you met at Station 2. Building on open standards keeps models and vendors replaceable.

One question follows from that and is worth asking your identity team rather than your AI team: which agent, acting for which person, may reach which system? Until recently the answer was a consent box each employee clicked, once per tool, which is no way to run an estate. Since June 2026 the protocol has carried an enterprise authorisation extension that moves the decision to where it belongs: an administrator enables a server for the organisation, and people get it scoped to the groups and roles they already have. Ask your identity provider when they will support it. The same standards bodies are now working on the approval step, so that an agent stopped by policy receives a structured "this needs approval" instead of a flat refusal.

The operating model: hub and spoke

• A small platform team owns the paved road: gateway, connectors, evaluation tooling, templates.
• Product teams build agents and workflows on it, and own them.
• An enablement group runs training, champions and the cookbook.
• A governance forum sorts use cases by risk and clears the low-risk ones in days.

This is also where the line leaves engineering. The same platform serves knowledge assistants for operations, HR and legal: search the policies, summarise the document, draft the reply. For those teams this is Station 1, and it builds the literacy they will need when agents arrive in their own workflows.

Station 4 of 5, about 17 minutes

Automate

An agent runs a bounded business workflow from start to finish. People approve defined actions and handle the exceptions.

First question: do you need an agent at all?

Use the least autonomy that solves the problem. Workflow first, and an agent where the flowchart runs out. Gartner's blunt assessment is that many use cases sold as agentic do not need an agent, and that much of what is sold as an agent is an older product with a new label.

Choosing the first workflow

The best first candidate is high in volume, varied enough to defeat a script, measurable, and forgiving: errors are cheap and can be undone. Score one of yours.

The worked example: prior authorization intake

1. AgentReadExtracts codes and clinical facts from the request and its attachments.
2. AgentCheckConfirms eligibility and benefits through a connector.
3. AgentMatchFinds the medical policy and tests each criterion against the evidence, citing the page.
4. AgentRouteEvery criterion clearly met: fast-track. Anything else: to a nurse, with the gaps marked.
5. ClinicianDecideReviews an assembled case. Every adverse decision is made by a licensed clinician.
6. PlatformRecordLogs what was read, what was concluded, and which policy and prompt versions were used.

That last row is both good design and regulatory reality: US regulators expect a licensed clinician behind any medical-necessity denial. Your own sector will have its equivalent, and it belongs in the boundary table.

The trust ladder: how autonomy is earned

1. 1. ShadowThe agent runs silently beside the nurses for four weeks. Its output is compared with theirs and used for nothing.
2. 2. AssistNurses see the assembled case and the suggested route. They decide everything.
3. 3. Approve eachThe agent proposes each fast-track. A nurse confirms with one click.
4. 4. SampleThe agent fast-tracks alone. People audit a random sample, plus every flagged case.

Promotion between rungs is a decision made on data: agreement with nurse decisions above a target, no critical errors for a set number of weeks, override rate below a threshold. Demotion is automatic when the numbers slip. Nobody argues about it, because the rule was written first.

Evaluations: the unit tests of agents

• A golden set. Five hundred real past cases with known correct outcomes, including the awkward ones.
• Run on every change of prompt, model, policy or tool, before release.
• Score what matters: extraction accuracy, criteria matching, routing, whether citations point at real evidence, and critical errors such as a wrong fast-track.
• Keep scoring in production by sampling live cases every week.

If a team cannot show you evaluation results, they do not have an agent. They have a demo.

Agent        PA Intake Agent v1.4
Owners       Dr. Lena Ortiz (clinical)   Sam Okafor (technical)
Purpose      Assemble prior authorization cases. Fast-track clear approvals.
Autonomy     Station 4, rung 3: approve each
Tools        eligibility.read  policy.search  documents.read
             case.write  approval.propose
Never        Deny or modify a request. Contact a member.
Escalates    Nurse review queue, within 5 minutes
Evaluation   Golden set v7, 500 cases. Routing agreement 96.2%.
             Critical errors 0.
Limits       $0.40 and 12 tool calls per case
Kill switch  Operations on-call pauses it in one click.
             Work falls back to the manual queue.

The same pattern in other functions

Station 5 of 5, about 11 minutes

Orchestrate

Many agents work together across functions. People set goals, budgets and limits, and govern the outcomes.

What changes

At Station 4 one agent runs one workflow. At Station 5 specialised agents hand work to each other across team, system and sometimes company boundaries, because your vendors and partners will have agents too. The unit you manage is no longer a tool or a workflow. It is a workforce.

Do the arithmetic before the architecture

Reliability multiplies. A step that works 95% of the time sounds good. Ten of them in a row finish cleanly about 60% of the time. This one calculation explains most multi-agent disappointments.

Four rules follow. Keep chains short. Put a check at every hand-off, and make hand-offs structured so they can be checked. Use ordinary code for anything that has one right answer. Put people where errors are expensive.

Managing a digital workforce

The most useful mental model for leaders is one you already know. Everything you do for an employee has an equivalent for an agent, and an agent without these is an untracked contractor with a master key.

Around that registry sits a control plane: identity, policy, tracing across agents, cost, evaluations. Agents reach tools through MCP and reach each other through A2A, so that an agent from one vendor can work with an agent from another under the same rules.

An honest status report

The line into this station is dotted on the map for a reason. McKinsey's 2026 survey found that 40% of organisations above a billion dollars in revenue say they are scaling agents in at least one function, up from 27% a year earlier, while the share seeing an effect on enterprise profit has not moved. Set that beside Bain's 2026 survey of 951 companies, where only 7% run a fully autonomous agent in production and 38% require a person to approve every decision. "Scaling agents" and "agents running on their own" are not the same sentence. Treat Station 5 as a direction to build toward, not a project to launch. The way to arrive is to run Station 4 well, several times, on a shared platform.

Be honest about the plumbing too. Letting one person delegate authority to one agent is close to solved, and the standards for it shipped in 2026. Letting one agent delegate to another is not. No ratified standard covers that second hop yet, and the proposals that exist stop at the first. If a vendor tells you their agent-to-agent story is settled, that is the question to ask them. The same applies to what you log: there is now an open convention for recording what an agent did, step by step, but it is still changing, so have the gateway emit it and pin the version you adopt. Doing that is what stops your audit trail from becoming one vendor's private format.

The roles that appear along the way: agent product owner, evaluation engineer, AI platform engineer, AI risk partner. The work people move toward: exceptions, judgment, relationships, and designing the system itself.

The four tracks and the law, about 22 minutes

Running the railway

Stations are where the train stops. The tracks are what leaders actually build. This stop covers the three that depend most on you: guardrails, people and value.

Guardrails: govern by risk, not by committee

Make the low tier fast. Governance that is slow for everything gets bypassed for everything.

Seven controls carry most of the weight for agents: its own identity with least privilege, approval before irreversible actions, evaluations before and after release, logging of every action, data protection at the gateway, spending limits, and a kill switch with a fallback.

One risk is new enough to name. Prompt injection: any text an agent reads, such as an email, a web page or an attached document, can contain instructions written by someone else. Treat everything an agent reads as untrusted, and limit what it can do accordingly. This is the reason permissions live in the platform and not in the prompt.

This is now measured rather than argued. A red-teaming competition run by NIST's Center for AI Standards and Innovation with Gray Swan and the UK AI Security Institute, published in March 2026, collected more than 250,000 attack attempts from over 400 participants against 13 frontier models. At least one successful attack was found against every model tested. How many succeeded differed sharply between them, and did not track model capability. Buying a more capable model is not a control.

The useful shape for a board is to ask which agents hold all three of: access to private data, exposure to content someone outside can write, and a way to send information out. An agent with all three can be turned against you. Take one of the three away from each agent and most of the risk goes with it.

What the law now requires

Two years ago this section would have been about principles. It is now about dates. What follows describes what the rules say, not what your organisation should do about them. That second question is for your counsel, and it is worth asking this quarter rather than next.

The European Union's AI Act entered into force in August 2024 and became applicable on 2 August 2026. Most readers of this guide are deployers rather than model builders, and the deployer duties arrive in two waves.

Those last two dates moved. An amending regulation, the AI Omnibus, came into force in July 2026 and pushed the high-risk obligations back. Many people still believe that deadline passed in August 2026. It did not, and the extra time is the window in which to build the controls this guide describes. Penalties run to 35 million euro or 7% of worldwide turnover for the banned uses, and 15 million euro or 3% for most other breaches, including the deployer duties.

Three points matter more than the dates. First, no jurisdiction regulates AI agents as a separate legal category. The Commission's own guidance says the term is not legally defined: agents are covered because they are AI systems, and a system built from many parts is assessed as a whole, so no component escapes on its own. Second, the Act's human oversight requirement is specific: a person must be able to disregard or reverse the output, and to interrupt the system so that it comes to a halt in a safe state. The kill switch listed among the seven controls above, and the rubber-stamp reviewer named in the failures below, are now a legal requirement and a legal failure respectively. Third, from 9 December 2026, revised European product liability rules bring software and AI systems inside the strict liability regime for products placed on the market after that date. The separate AI Liability Directive was withdrawn in 2025 and never replaced, so fault-based claims stay with national law.

The United States has no comparable federal statute, and the position is unsettled enough that the most-cited state law is a poor guide: Colorado's AI Act never took effect, having been repealed and replaced before its deadline, with enforcement stayed by a federal court. What is in force are narrower duties, including chatbot disclosure in California and notice requirements for AI in hiring in Illinois. If you operate in both blocs, plan against the European timetable and treat the American one as sector-by-sector.

What to align to while you wait: ISO/IEC 42001, the certifiable management system for AI, which sits in the same family as the information security standard you probably already hold. One caution worth carrying into procurement: certification is not the same as conformity with the Act, so a supplier waving a certificate has not answered the question. In the United States, NIST's AI Risk Management Framework is the voluntary reference, and is being revised.

People: the J-curve is a people curve

• Expect the dip. Output falls while habits change, then recovers past where it started. Teams that are told this in advance get through it. Teams that are not conclude the tool failed.
• Train by role. Executives: this guide. Managers: how to run and measure an AI-assisted team. Engineers: the delegate loop. Business teams: assisting and reviewing. Reviewers: how to check AI work without rubber-stamping it.
• Build a champions network with real time allocated, open office hours and regular show-and-tell. Adoption spreads sideways between peers far faster than downward from memos.
• Say the quiet part. People want to know what this means for their jobs. DORA's 2026 guidance on returns is to reinvest the capacity you free, starting with the rework and backlog nobody could afford, not to lead with headcount cuts. Be specific about where roles will change.
• Protect the apprenticeship, and know why. Stanford's Digital Economy Lab, using payroll data through June 2026, found employment for workers aged 22 to 25 in the most AI-exposed occupations running about 19% below where it would be had it kept pace with less-exposed peers, widened from 15% a year earlier. The adjustment shows up as reduced hiring, not as people being let go. The same authors are careful to say they see no widespread, economy-wide displacement, and that these are descriptive patterns rather than proof of cause. Read together, that is the apprenticeship problem in one sentence: the easiest role to not fill is the one where people used to learn the job. Juniors still need to learn to read, debug and judge, and someone has to decide to keep hiring them.
• Reward sharing. Recognise the team that publishes its playbook, not only the team that ships.

Value: measure at three levels

Remember the McKinsey numbers from the second stop: eight in ten people feel more productive, and 37% of companies see it in profit. The distance between those two figures is levels 2 and 3.

• Baseline before you start. No baseline, no proof.
• Agree the measure with Finance first. A saving Finance does not recognise is a story, not a result.
• Count the full cost: licences, tokens, platform, people, and the time spent reviewing. All five are opened up below.
• Decide where freed capacity goes before it appears. Otherwise it dissolves into slack and nobody can find it.
• Report what did not work. It buys you credibility for what did.

What it costs: three on the invoice, two in the day

Five costs run under the whole line, and the two that never reach an invoice are the ones budgets miss. That is why a plan priced from vendor quotes comes in low, and why a programme that looked affordable starts to slip.

Only tokens and review scale with the work. The other three are closer to fixed, which means the first agent looks expensive and the fifth looks cheap. Judge the platform against the portfolio, not against whichever workflow happened to go first.

Set against all of it, the return that is easiest to defend is not the hours saved on work you already do, because someone will always argue about whether those hours were real. It is the work that was never affordable. The migration at Station 2 is the clearest case: the prize was not the ten weeks, it was that upgrades, test coverage and dependency clean-up moved inside the budget for the first time.

Platform: buy, build or blend

Buy what is a commodity: assistants, models, standard agents inside the software you already license. Build what is specific to you: context, connectors, evaluations, and the workflows that are your business. Keep models swappable. The boundary is moving: McKinsey's 2026 survey found that about a third of organisations have already declined to buy some software because agentic coding tools let them build it in-house.

Fund it as a portfolio. A reasonable starting split is 70% on proven productivity at Stations 1 to 3, 20% on workflow automation at Station 4, and 10% on frontier work toward Station 5. Review it every quarter and move money toward what the numbers support.

The last stop, about 10 minutes

Your route

Find where your organisation is on the line today, see which track is holding the train back, and leave with one page for the leadership table.

Find your station

The first two questions place the train. The other four measure how far each track has been built. Remember the rule from the first stop: the train can only go as far as the shortest track.

A first twelve months

A realistic pace for a large enterprise starting near Station 1. If the assessment put you further along, start there. The order matters more than the dates.

1. Months 1 to 3Lay the trackPolicy, approved tools, sign-on, telemetry. Capture the baseline. Train every engineer and name champions. Station 1 in every team.
2. Months 4 to 6DelegateCoding agents in sandboxes with scoped credentials. A context file in every active repository. One agent-led backlog project. Start the gateway.
3. Months 7 to 9IntegrateAll model traffic through the gateway. AI review and test generation in pipelines. Risk tiers with a fast lane. First business workflow scored, baselined and in shadow mode.
4. Months 10 to 12AutomateThe first workflow climbs the trust ladder on data. Agent cards and a registry begin. Results published with Finance. Second and third workflows chosen.

Station 5 is not on this plan, on purpose. You reach it by running Station 4 well, several times, on the platform you built at Station 3.

Five decisions for your next leadership meeting

1. Who owns the line? One accountable executive, with a platform lead and an enablement lead beside them.
2. Which measures has Finance agreed to, and where is the baseline? Settle this before the next rollout, because a baseline cannot be captured afterwards.
3. Will every model call go through one gateway? A yes is the cheapest governance you will ever buy.
4. Which workflow goes first, and who is its business owner? Score three candidates. Choose the forgiving one over the famous one.
5. Where does freed capacity go, and what do we tell people about their jobs? Decide both before the capacity appears.

The engineers who build it need more than this guide. Build the Line, the practitioner course, takes the same Alderline workflow up the same five stations and builds the controls that earn each step: nine modules, about seven hours, nothing to install.

Print the route card

Prints on one landscape page. If nothing happens, open this file directly in a browser tab and try again.

Words worth knowing

A2A

Agent2Agent. An open protocol that lets agents from different vendors find each other and hand over work.

Agent

Software that uses a model in a loop. It plans, uses tools, checks the result and continues until the goal is met or it has to ask.

Agentic AI

The broader term for systems built from one or more agents that act, where a chatbot only answers.

Context file

A plain-text file in a repository, often named AGENTS.md, that tells every agent how this codebase works and what it must not touch.

Evaluation, or eval

A scored test set for AI behaviour. The unit test of agents.

Gateway

One front door for every model call: identity, policy, logging, data redaction, spend limits and routing.

Guardrail

A limit enforced by the system, as opposed to one requested in a prompt.

Human in the loop, human on the loop

In the loop: a person approves each action. On the loop: the agent acts, and a person monitors, samples and can stop it.

LLM

Large language model. The reasoning engine inside assistants and agents.

MCP

Model Context Protocol. The open standard for connecting agents to tools and data.

Prompt injection

Instructions hidden in content an agent reads, written by someone who wants to hijack it.

RAG

Retrieval-augmented generation. The system looks up relevant documents first, and the model answers from them.

Shadow mode

The agent runs on real work, and its output is compared with what people did and used for nothing else.

Token

The unit a model reads, writes and bills by. Roughly three-quarters of an English word.

Sources

Published figures in this guide come from the sources below, checked in September 2026. Alderline Health and everything measured there is illustrative.

1. DORA, State of AI-assisted Software Development, 2025.
2. DORA, report on the return on investment of AI-assisted software development, 2026.
3. METR, randomized trial of early-2025 AI tools with experienced open-source developers, July 2025.
4. METR, update on developer productivity uplift, February 2026.
5. McKinsey, The State of AI, August 2026.
6. Gartner, prediction on cancelled agentic AI projects, press release, June 2025.
7. Linux Foundation, formation of the Agentic AI Foundation, December 2025.
8. Bain & Company, Your AI Budget Is Growing. Your Returns Aren't., June 2026.
9. US Census Bureau, Business Trends and Outlook Survey on AI use, May 2026.
10. Stanford Digital Economy Lab, Canaries in the Coal Mine?, August 2026.
11. NIST Center for AI Standards and Innovation, insights from a large-scale agent red-teaming competition, March 2026.
12. European Commission, the AI Act regulatory framework and guidelines on transparency obligations.
13. European Union, Product Liability Directive (EU) 2024/2853.
14. Model Context Protocol, Enterprise-Managed Authorization, June 2026.
15. US Centers for Medicare and Medicaid Services, Interoperability and Prior Authorization Final Rule (CMS-0057-F).
16. eWeek, report on the July 2025 coding agent that deleted a production database.
17. Klarna, press release on its AI assistant, February 2024, and Bloomberg, report on its return to human customer service, May 2025.
18. Moffatt v. Air Canada, British Columbia Civil Resolution Tribunal, 2024.

Finish the route