of AI agent deployment failures forecast to trace back to insufficient runtime enforcement of governance
Half of agent failures will trace to runtime
Gartner's number for 2030. The interesting part is what it says about where governance currently lives.
Half of all AI agent deployment failures by 2030 are forecast to trace back to one thing: governance that was never enforced at runtime.
Read that as a statement about the present. It means governance today is almost entirely design-time.
The forces
Three things are converging, and only one of them is being budgeted for.
First, agent count is growing faster than the review capacity that gates it. Second, the failures that matter are behavioural — a wrong tool call, a fabricated total, a state written that should not have been — and none of those are visible in a design review. Third, the controls that would catch them have to run continuously, which makes them an operating cost rather than a project.
Old way, new way
How this plays out
The first organisations to treat runtime enforcement as a funded capability will not look more cautious than their competitors. They will look faster, because they will be the ones able to answer a risk committee in a single meeting rather than a quarter.
The ones that do not will keep shipping agents into the bottom-right quadrant — machine pace, no detector — and will discover the failure rate the same way everyone currently does, which is from a customer.
What I would do this quarter
Not 'hallucination'. Three specific, countable behaviours: it cited something that does not resolve, it reported a tool result that differs from what the tool returned, it acted on a state it had not re-read.
Why: A named failure has a detector. An unnamed one has a postmortem.
Citation resolution is usually the cheapest: fetch the reference, check the claim appears in it. It is a scheduled job, not a research programme.
Why: One running detector changes the conversation from whether this is possible to which one is next.
Put the rate on the same dashboard as latency and error codes, with its interval, and let it be seen weekly.
Why: A number nobody looks at routinely becomes a number nobody believes in an incident.
Design-time governance tells you what was intended. Runtime governance is the only kind that can be wrong, which is exactly why it is the kind worth having.
If one of your agents started failing at three times its normal rate tomorrow morning, how long before anyone knew?
Every figure here describes something measured and committed. See the measurements · read the method