AI Agent Guardrails Are Not Evidence: What the Economist Enterprise Survey Means for Teams Deploying Agents
A new Economist Enterprise survey finds 98% of large organisations have already experienced a disruptive agent-related incident. The gap is not a lack of guardrails. It is a lack of evidence that those guardrails actually stopped anything.
Ask a team that has deployed an AI agent why they are confident it will stay in scope, and the answer is usually familiar. The system prompt tells it what it can and cannot do. Its permissions are limited. There are guardrails. It will not do anything without asking.
That confidence is common. A new Economist Enterprise study suggests it is running well ahead of the controls behind it.
What the survey found
The study, "Power without control: Rethinking cybersecurity for the age of agentic AI," was published on June 25, 2026 and supported by Rubrik. According to Rubrik, it surveyed 804 VP-and-above decision-makers at organisations with at least US$500 million in annual revenue, across Australia, France, Germany, India, Italy, Japan, Spain, the UK, and the US.
Fieldwork ran between December 2025 and January 2026. Every respondent already had AI agents operating in their systems.
Three findings stand out:
- 98% had experienced a disruptive agent-related incident.
- 90% said agents were being deployed faster than security teams could evaluate or govern them.
- 87% said agents introduce fundamentally new risks that existing controls were not designed to manage.
The study was supported by a security vendor, and it should be read with that context in mind. Even so, the respondents were senior leaders speaking about live deployments rather than future plans.
Source: Rubrik press release
How these incidents tend to happen
The findings above belong to the survey. What follows is Gateplex's reading of them.
An agent-related incident rarely starts with an agent going rogue. It usually starts with an agent doing its job. An agent is given a narrow task, such as reconciling invoices or handling account-servicing requests. To do that, it needs access to a payment system, CRM, email account, or database.
Granting access that is exactly as narrow as the task can break the workflow, so access often ends up broader than the task. The system prompt says to stay inside the task. Everyone assumes it will.
Then a case arrives that the prompt did not anticipate. The agent finds a path to a result, and that path runs through an action that was technically permitted but never intended. Nothing malicious happened. Nothing asked for permission either, because from inside the agent's own logic, permission was already there.
Guardrails are useful. Prompt instructions shape behaviour. Permission scopes prevent some actions. Model-side safety features catch some bad ideas. But these controls are not sufficient evidence that an agent stayed within authorised scope.
"We instructed it not to" describes an intention. It does not demonstrate a boundary.
Monitoring and prevention are different jobs
Traces, dashboards, and logs are useful for debugging and post-incident review. They answer what the agent did.
For consequential workflows, the question runs the other way: could the agent have done this, and what would have stopped it? A log can only answer after the action has reached a live system.
The control has to sit before execution
Gateplex's view is that consequential agent actions need an independent check between the agent and the system it is acting on. The check should evaluate each action against the organisation's rules before execution, and block actions that fall outside authorised scope.
Every decision should also leave a tamper-evident record that compliance and risk teams can review and defend.
Gateplex is available today. It helps companies control what AI agents can do before execution and produce clear, tamper-evident evidence for compliance and risk teams.
Automate the work. Not the authority.
See how Gateplex works at gateplex.ai.