There’s a particular feeling right before a technology stops being a debate and becomes fact. Nobody argues anymore about whether the factory reorganized manufacturing, the internet reorganized commerce, or the cloud reorganized infrastructure. The argument just stops, not because someone won it, but because the shift already happened. We’re at that point with the agentic workforce, and most companies aren’t ready.
The closest precedent isn’t the internet. It’s the factory. The first automobiles were horseless carriages in the most literal sense: coachbuilders kept building carriages and bolted an engine where the horses used to go. Ford’s answer was different: he rebuilt the floor plan around a moving assembly line, and Model T build time fell from twelve hours to roughly ninety minutes. The gain came from reorganizing the work around what the new machinery made possible, not a better part. That’s the gap that matters now: bolting an agent onto an existing workflow like a coachbuilder bolting an engine onto a carriage, versus rebuilding the workflow around what an agentic workforce can do.
The transition is underway, not forecast. Software agents write code, open pull requests, call APIs, and push to production today, at companies that never issued a press release about it. The question isn’t whether agents join the workforce. It’s what breaks on the way, and who built the system that catches it.
Inevitability is a cost curve
Skip the hand-waving about the future of work; look at the mechanism. A company’s output has always been bounded by how many hours its people can put against a problem. Agents make that bound almost irrelevant: the person who shipped one release a week now directs agents shipping several a day. The competitive pressure isn’t that individuals get faster; it’s that a company can attempt radically more work, and the advantage goes to whoever can safely absorb the increase. A company that can’t absorb it doesn’t get the 10x; it gets 10x the queue, piled up at the same chokepoints named earlier in this series: the review step, the approval chain, the deployment gate, all still running at human speed while the work arrives at machine speed. That’s what emptied the coachbuilders once one manufacturer built a car many times faster.
The argument is already settling inside the companies building it. Jensen Huang, Nvidia’s CEO, doesn’t hedge: “The age of AI Agentics is here.” He puts a number on it: a future where a company’s 75,000 employees work alongside 7.5 million agents, where “the IT department of every company is going to be the HR department of AI agents.” Marc Benioff, Salesforce’s CEO, says it outright: “Today’s CEOs are likely the last who will manage a workforce of only human beings… We are really moving into a world now of managing humans and agents together.” Those are predictions about organizational design, not model capability: how do you manage a workforce whose members can be created instantly, act autonomously, and vanish once the task is done?
The water nobody has named
There’s an old parable about two young fish swimming along when an older fish passes and asks, “How’s the water?” One turns to the other: “What the hell is water?” The industry building around agents is swimming in a similar assumption: an agent is basically a human employee, just faster, and the governance built for hiring a person can be adjusted to fit. Everyone argues about benchmark scores and scanner accuracy, while almost nobody says the assumption out loud.
Governing a human runs on mechanisms that take time to build and fake: a background check, a manager watching judgment develop over months, shared context nobody wrote down, and consequences, a firing, a lawsuit, a damaged reputation, that make betrayal expensive. None of that transfers cleanly to an agent, not because it lacks memory or a long-lived identity; some do. It can be instantiated, modified, replicated, or replaced without the continuity that makes human trust meaningful, and has no reputation in the sense that matters: no internal cost weighed against the goal it was given, the way there is for a person with something to lose. It doesn’t absorb context in its first ninety days; it knows only what’s put in front of it. And a rule a person would eventually apply with judgment, an agent follows to the letter while missing the reason it exists.
That’s a different mechanism doing the same job. A human is governed by slow-built trust and after-the-fact consequence; an agent has to be governed by an identity issued fresh for the task, credentials scoped as narrowly as the task allows, and judgment applied before the action lands. It should never hold more authority than the task requires. You onboard a person once and extend trust over years; an agent’s authorization is re-established on every action, since there’s no accumulated trust to draw down, only what the task and context justify.
A system, not a feature
Put the two facts together: the transition is underway, and the usual defenses, rulebooks, permissions lists, scanners built for human-speed review, weren’t designed for this worker. The fix isn’t a plug-in on the existing security stack; it’s an operating layer for the agentic enterprise: identity, authority, credentials, action-level judgment, context, and containment as the foundation the company builds on, not a gate bolted on top. Ford’s plant wasn’t a coachbuilder’s workshop with a conveyor belt wheeled in; it was a different floor plan for the whole operation.
An agent running at machine speed inside a process built for human speed doesn’t come out safer; it gets stuck at the one chokepoint still on human time, or waved through because nobody had the hours to look. The market for agent governance today mostly adapts existing categories: visibility, scanning, permissions, alerts, and the vendors building them aren’t wrong to. But each assumes agents can be governed by extending control models built for humans and applications, tuned tighter and faster. The harder opportunity is rethinking the control plane around what makes an agent different: identity that doesn’t accumulate, credentials that shouldn’t persist, judgment running in the path, not after.
We didn’t arrive at this by whiteboarding it. We ran it: at Nexar, a 135-person company, over seven months, 486 agent-built applications and 42 agents used by the whole company, with 77 of 135 people going on to build their own. Along the way the system ran 6,974 security reviews and 1,042 publish gates in the path, sent 33 apps back for fixes, rejected 5, and caught 1,143 prompt injections in production. The agents were not held back; the system around them was built to hold.
What comes next
This is the big-picture argument, and it stops here on purpose: whether enterprises redesign around the agentic workforce, or bolt agents onto systems built for humans and wait for something to break. The next generation of enterprise AI won’t be defined by the agents’ intelligence alone, but by the operating layer that makes them trustworthy enough to run at scale. Later posts go deeper into each piece: what it means to give an agent an identity it can be held to, why the credential can never enter its context, what it takes to judge an action’s intent instead of scanning its text, and why judgment is only as good as the organizational memory behind it.