Key facts.
- WebArena: best agent hits 14.41% task success vs. 78.24% human baseline. That demo that looked clean is running a system that's wrong most of the time.source
- Gartner forecasts 40%+ of agentic AI projects canceled by end-2027, driven partly by inadequate risk controls, governance immaturity by another name.source
- ISO/IEC 42001:2023 defines what governance maturity looks like: policies, roles, controls and review cycles that separate a governed program from an ad-hoc one.source
Why does maturity predict survival better than capability?
Mature governance sits quiet in the demo and decides the production gate; a more capable model alone will not carry it, so rework lands at scale (WebArena). (arXiv:2307.13854)
The pilot proves capability. The production gate tests something else entirely. Getting a good demo is a capability problem and modern models clear that bar regularly. Running an agent in production, one that touches real systems, handles real inputs and has to pass security and compliance review, is a governance problem. The team that stalls has a working agent but no named owner, no audit trail, no approval model, no review cycle. When the production gate asks who's accountable, how you know the agent is behaving, and what happens when it fails, they can't answer. The team that ships built governance first, so answering those questions took five minutes.
A better model doesn't change which gate you're at. WebArena: even the best agents complete about one in seven realistic web tasks against a 78% human baseline. The demo that looked clean is a system that's wrong most of the time. Holding that in production requires boundaries, monitoring and a way to catch failures quickly. Gartner calls it "inadequate risk controls." That's governance immaturity. The programs Gartner expects to survive aren't the ones with the strongest models; they're the ones mature enough to operate a fallible agent without it blowing up.
What does governance maturity look like?
You can see it. A mature program has a named owner per agent, documented limits on what the agent can and can't do, audit trails capturing decisions and context, an approval step for anything consequential, and a review cycle that runs as the agent changes. An immature program has a working demo and gaps in most of those. Score your gaps. Each one is a question the production gate will ask that you can't yet answer. Closing the gaps before the gate is faster than fighting the gate three times in a row while scrambling to build what you should have had already.
| Governance dimension | Immature (stalls) | Mature (survives) |
|---|---|---|
| Ownership | No named owner | Accountable owner per agent |
| Boundaries | Undocumented | Explicit, enforced limits |
| Audit and review | Ad hoc or absent | Trails plus regular review cycles |
The Pattern Intelligence Layer is where governance maturity becomes concrete, so the owners, boundaries, audit trails and review cycles a production gate checks for are enforced at the pattern level rather than assembled in a scramble before launch. The program that builds maturity here clears the gate by construction. Reliability at the pattern level is what turns a promising pilot into an agent that survives.
Frequently asked questions
If the agent works in the pilot, why does it stall?
Because the pilot tested capability and the production gate tests governance: ownership, boundaries, audit, review. A working demo with none of those cannot pass.
Doesn't a better model improve the odds?
Marginally. The agent is still wrong most of the time on realistic tasks, so survival depends on governing a fallible agent, not on closing the gap with capability.
How do I assess our maturity?
Score yourself on ownership, boundaries, audit trails, approval models and review cycles. The gaps are the questions the production gate will ask.