Deloitte: Fix data, identity and governance to scale AI agents

Deloitte advises that companies must prepare data, agent identity and governance before deploying AI agents that can run multi-step transactions without continuous human prompts. The firm warns that generative tools alone yield local productivity gains but usually do not change core revenue or cost structures unless agents can act with verified identity, current data and formal oversight.

Prakul Sharma, principal and AI & Insights Practice Leader at Deloitte Consulting LLP, described autonomous intelligence as a stage beyond assisted or predictive systems, explaining: “Autonomous intelligence pursues an outcome by reasoning over a goal, invoking tools and data, and adapting as conditions change.” He added that organisations need governance that lets humans set guardrails rather than approve every step.

Deloitte recommends beginning with a decision audit focused on one or two value chains where slow or inconsistent decisions limit outcomes. Teams should map who owns the data, who has decision authority, where handoffs fail and what judgments are being made. That mapping identifies where autonomy can create measurable revenue or cost savings and where gaps must be closed before compute resources are allocated.

The firm uses procurement as a concrete example. An agent could compare live inventory levels with current vendor pricing in an enterprise resource planning system and issue purchase orders automatically within approved thresholds, pausing for human approval when exceptions occur. For that to work, the agent needs a verifiable identity inside the ERP, access to contractually current prices and approval limits certified by legal and compliance. Missing any of those dependencies undermines autonomous execution.

Deloitte draws a clear line between reporting-grade and decision-grade data. Many enterprise data systems use nightly batches, aggregated tables and stripped provenance designed for dashboards and analysts. An autonomous agent requires timestamped, traceable values, data freshness that is binding for transactions and access controls that confirm authority to read and act on records. Delivering this capability typically requires event stores and databases that preserve lineage for both structured and unstructured information.

The consultancy also notes common technical failures occur before queries reach large language models. Selecting use cases without mapping workflows risks automating broken processes. Agentic workflows often call models multiple times to reason through a goal, and retrieval-augmented generation to reduce hallucinations increases API calls and compute overhead. Deloitte says firms must forecast variable compute costs and put financial controls in place.

Moving from pilots to enterprise deployment exposes what Deloitte calls governance debt and the production gap. Small pilots can perform well with curated data and a champion team, but full rollouts reveal missing identity integration, absent continuous evaluations, insufficient audit trails and unpaid compliance checks. Deloitte reports that organisations making progress treat pilots as initial production instances, building in identity verification, continuous model evaluation and financial monitoring so subsequent use cases can reuse the platform.

The firm recommends integrating agent architectures with corporate identity providers and cloud security controls across hybrid environments and designing human-in-the-loop checkpoints where required. Deloitte identifies decision-grade data, verified agent identity and formal governance as the conditions needed for AI agents to finalize transactions at scale.