Ask a bank how many servers it runs, and you get an answer to the decimal. Ask how many AI agents it is running, and you get a shrug or a guess.
That line belongs to Florian Douetteau, chief executive of Dataiku, and he delivered it last week not as a confession but as a product pitch. Dataiku has moved its Agent Management tooling into general availability โ a formalization, not an invention. The capabilities first surfaced in March 2026 inside the company's Platform for AI Success launch. What changed is the packaging: a standalone, platform-agnostic layer that sits above the stacks enterprises already bought.
The timing is not accidental. In the same window, NiCE paid $955 million for Cognigy, Collibra shipped Guardian Agents to police runtime behavior against machine-readable Agent Contracts, and at least five separate governance products reached market after September 12 alone. A category is being born in public, and it now has a name: the control plane.
The numbers underneath the shrug are ugly in a familiar way. A Harris Poll commissioned by Dataiku surveyed 685 CIOs across eight countries in July 2026. Eighty-one percent said they lack complete oversight of agents created outside approved systems. Seventy-two percent cannot consistently measure whether those agents deliver business outcomes. Forty-seven percent have already decommissioned more than twenty agents this year โ churn happening in the dark. These are self-reported figures from a vendor-sponsored study, so weigh them directionally. IBM's April 2026 AI in Motion report โ fewer than one in five organizations maintain a complete, current inventory of their AI systems โ points the same direction with less at stake.
The deployment wave broke the ledger. Almost nobody wrote the reconciliation.
For anyone who has watched crypto rebuild its own plumbing twice in a decade, the shape of this problem is recognizable to the point of discomfort. Enterprise software is rediscovering, slowly and with consultants, a class of problem the blockchain world solved structurally years ago โ and then failed to market.
The last three years of enterprise AI read like a liquidity cycle, because structurally they are one. Cheap capital โ the same cheap capital that funded crypto's 2021 build-out โ funded an agent build-out. Every platform vendor needed a story, and every platform vendor got one: AWS Bedrock, Databricks, Google Vertex, Microsoft Copilot Studio, Salesforce Agentforce, Snowflake Cortex. The build layer matured fast because building an agent runtime is a distribution problem, not a research problem. Bolt a runtime onto an existing surface and you have a launch.
What the build layer never included was an operating discipline. The distinction that matters is not monitoring versus logging. It is observation versus control. Monitoring tells you an agent is running. Management tells you whether it has earned the right to keep running. Douetteau's phrasing is blunt: right now, almost nobody can fire an agent.
Vendor-specific tooling made the gap worse by design. A monitoring tab inside Bedrock can only see Bedrock agents. In an estate where 67% of CIOs estimate 51 or more agents in production โ spread across multiple platforms โ a single-vendor pane of glass leaves most of the fleet invisible. Dataiku's architectural bet is to sit above all of them, connecting through native APIs and log streams, supporting custom environments via OpenTelemetry, and avoiding any requirement to rewrite or redeploy. On paper that is a real differentiator. It is also the exact claim every middleware company in history has made, and roughly a third of them have honored.
Now the macro layer, which is where this stops being an enterprise IT story. AI capex has been the marginal buyer of both capital and attention through this cycle. If compute is the supply side of the AI trade, agents are the demand side. Demand without accounting is how every bubble in history has located its ceiling. A control plane is not a feature. It is the reconciliation layer that decides whether the AI trade converts into durable revenue or into precisely the kind of write-down that crypto spent 2022 learning to price.
Consider the funding asymmetry behind it. Enterprise AI absorbed capital at a pace that would have embarrassed the 2021 token cycle, and those returns are now being audited by the same finance teams that signed the purchase orders. When capex outruns measurable output by a wide margin, the correction rarely arrives as a crash. It arrives as a category โ a new line item whose only job is to prove the previous line item was not wasted. Agent governance is that line item. That does not make it fraudulent. It makes it cyclical, and it means the winners will be decided by procurement politics as much as by architecture.
Crypto's own agent history should have prepared it for this moment. Liquidation engines on lending protocols have been autonomous for years. MEV searchers are agents. Vault keepers are agents. Concentrated-liquidity rebalancing on Uniswap v3 is, in practice, a portfolio agent wearing a smart contract's clothes. What crypto never built was an accountability surface for those actors that an outsider โ a regulator, an allocator, a counterparty โ could actually read.
That absence is a pricing problem now, not a philosophical one.
The stack, translated
Enterprise agent governance has four functional layers, and each has a crypto-native cousin that already exists in some form.
Observation sits at the bottom. Dataiku and every competitor reads logs. On-chain, observation is free by default: a wallet's entire history is public, indexable, and immutable. This is the one layer where crypto holds a structural advantage no enterprise vendor can match โ and it is the layer the industry most consistently fails to monetize, because visible data carries no scarcity.
Permissioning comes next. Session keys, scoped delegation, and account abstraction let a user grant an agent a bounded mandate: a spend ceiling, a contract whitelist, an expiry. I stood up exactly that configuration on a testnet earlier this year โ an agent holding a session key authorized to touch a single lending market, capped at a small notional, expiring in seventy-two hours. It behaved for about eleven hours. Then a price dislocation outside its training distribution pushed it toward a path that was technically inside its permissions and economically outside its mandate. The permission held. The intent did not.
That gap โ between what the code allows and what the operator meant โ is where every meaningful agent failure will live. Enterprise vendors answer it with policy documents and human review. Policy documents are prose. Prose does not execute.
Identity is where the on-chain stack is thinnest. Enterprise buyers can point to Agent Contracts: machine-readable documents defining authorized behavior that a runtime can enforce. Crypto has registries, and a registry is only as valuable as the incentive to register. I spent a weekend this spring querying the public pages of the largest agent-registry projects. The index pages were largely empty. The vanity metrics were not. Data whispers what the gatekeepers refuse to shout, and the whisper here is that on-chain agent identity is a demonstration, not a deployment.
Accountability is the layer crypto actually invented. Bonded stake, slashing conditions, revocation, exit. Collibra's Guardian Agents can block an unauthorized action in real time โ inside Collibra's perimeter, under Collibra's definition of authorized. A cryptoeconomic accountability layer can do something Collibra structurally cannot: it can punish an operator who was permitted to act and acted badly anyway, without requiring the auditor and the operator to be different institutions. That matters, because in banking the operator and the auditor usually share a building and a bonus pool.
Outcome measurement deserves its own treatment, because the 72% figure is the most underrated number in the survey. Measuring an agent's technical health is easy and largely automated. Measuring whether the agent improved a decision is hard, adversarial, and typically performed by the agent's own vendor. On-chain, the equivalent trap is subtler. A yield agent that posts positive P&L every week may simply be holding tail risk that has not resolved yet โ a strategy whose reporting looks immaculate right up to the quarter it does not. Patterns dissolve before the first candle closes, and an agent optimizing a proxy metric will always look competent until the proxy decouples from the outcome. That is not a monitoring failure. It is a specification failure, and no dashboard fixes it.
What the failure rate is actually telling us
IDC and Lenovo research puts the failure rate of custom agent builds at 88%. Read that against the Harris data โ 47% of CIOs decommissioning twenty-plus agents a year โ and the pattern is not that agents are hard to build. It is that agents are built for demonstrations and retired before they reach production economics.
We have the same disease on-chain with different symptoms. Agent wallets spun up during a narrative, months without a transaction, still holding approvals nobody revoked. I have audited contracts for exactly this failure mode. In 2021 I worked through fifteen popular ERC-721 contracts by hand and found critical vulnerabilities in eight of them โ several of which the market reports were then calling blue-chip. The lesson was not that the code was bad. It was that nobody had bothered to look, because looking did not pay. Behind every algorithm lies a moral blind spot, and the blind spot is almost always staffing.
The enterprise control plane is catching up to the deployment wave. But the bottleneck has moved. Visibility is becoming a commodity โ OpenTelemetry is quietly hardening into the interoperability layer that everyone claims to support and few implement at depth. Accountability is the scarce good. We can now see what our agents are doing. We still cannot cheaply answer whether they are doing it well enough to keep running.
There is one layer still forming that neither camp has priced properly: machine-to-machine settlement. When one agent pays another, the rail carries the audit trail. Card networks will offer this with chargebacks and compliance departments. Stablecoin rails will offer it with finality and no recourse. The control plane will eventually have to reconcile both, and whichever rail carries the accountability metadata โ not the cheapest transfer โ will capture the volume.
Where the cycle is mispriced
In a sideways market, categories are manufactured to concentrate capital. I watched the same mechanism during the liquidity-fragmentation boom: a real observation, inflated into a product category, funded long before anyone measured whether the fragmentation was a problem or a feature. Five governance products shipping inside a few weeks is a capital signal, not a demand signal. The routing layer already carries a $955 million price tag. The monitoring layer is shipping. The governance layer is forming. Some of these will become infrastructure. Most will become dashboards with a logo.
Here is where I part company with the consensus reading. The prevailing assumption is that the enterprise governance stack โ compliance-shaped, perimeter-bound, sold as seats โ is the real control plane, and that crypto's version is ideological theater. My read is the inverse, and it rests on a structural fact rather than a preference.
Enterprise governance assumes the auditor is external to the operator. That assumption holds in a regulated utility. It does not hold in a market where the largest agent operators are also the largest model vendors, the largest cloud vendors, and increasingly the largest holders of the assets their agents trade. When the operator, the auditor, and the beneficiary are one entity, monitoring becomes self-reporting with better fonts. Ethics are the unlisted asset in every ledger, and self-audited ledgers are how you discover they were never on the balance sheet.
Cryptoeconomic accountability does not require that separation to be honest. It requires a bond that can be taken. That is a colder guarantee, and colder is what survives a cycle.
The two stacks will not merge. Enterprise buyers need contracts, service levels, and a human to call. Crypto-native operators need permissionless revocation and verifiable slashing. Those are different products for different failure modes, and the market is currently pricing only one of them as legitimate. The gap between those valuations is where the next twelve months of positioning lives.
The off switch is the product
Watch the off switch, not the dashboard. In a market where most custom agents fail and nearly half of large buyers are already retiring fleets they cannot fully see, the scarce capability is not visibility. It is cheap, provable, permissionless revocation โ an accountability primitive that works when nobody in the room is independent.
For the crypto side, that means the interesting build is not another agent framework with a token attached. It is the registry that projects actually populate, the session-key standard that expresses intent rather than permission, and the settlement rail that carries accountability metadata as a first-class field. None of them are dramatic. All of them are the kind of plumbing that gets re-rated after the narrative phase ends โ the same way indexers and oracles did, quietly, long after the dashboards that advertised them went dark.
The enterprise vendors will ship their control planes on schedule. Dataiku's general availability lands in October. Collibra will sell governance by the seat. The question worth holding into next quarter is narrower and less comfortable: when the first agent you cannot fire is holding a wallet instead of a workflow, who exactly is supposed to take the bond?