ZigoTrace

zigotrace

Tag: agentic AI

  • Agentic AI Workflows in Compliance: Why the Best Agents Are Given Less

    Agentic AI Workflows in Compliance: Why the Best Agents Are Given Less

    An operator at a workstation reviewing monitoring screens, illustrating human oversight of agentic AI workflows in compliance.
    Photo by Miha Meglic on Unsplash (source)

    The most useful thing to know about agentic AI workflows in compliance work is that the systems now succeeding are not the ones given the most freedom, they are the ones given the least. Enterprise deployment of AI agents, meaning systems where a language model plans, calls real tools, and changes the state of a business system rather than only answering a question, has moved from pilot to production quickly enough that the telemetry is now unambiguous: multi-agent workflows on the Databricks platform grew 327 percent between June and October 2025, measured across 20,000 organisations that include 60 percent of the Fortune 500 [1]. Yet across the same period, Gartner projected that more than 40 percent of agentic AI projects would be cancelled by the end of 2027, attributing the failures to escalating cost, unclear business value, and inadequate risk controls rather than to any shortfall in the underlying models [2]. Both things are true at once, and the gap between them is not a capability gap. It is a design gap, and it is one that compliance work exposes faster than almost any other domain.

    Why agent adoption and agent cancellation are rising at the same time

    The contradiction resolves once the unit of analysis shifts from the model to the workflow around it. MIT Media Lab’s Project NANDA, drawing on 52 executive interviews, surveys of 153 leaders, and an analysis of 300 public deployments, found that roughly 95 percent of organisations were seeing no measurable profit-and-loss return on generative AI, while a small minority were extracting real value, a split the authors named the GenAI Divide [3]. What separates the two groups is rarely which model was chosen. Databricks’ own data points at the same conclusion from the other direction: supervisor architectures, in which a coordinating agent routes work to narrower specialists rather than one agent attempting everything, already account for 37 percent of enterprise deployments, and organisations operating a formal AI governance framework ship twelve times more agent projects into production than those without one [1]. Consequently, the implications of this pattern are structural rather than technological. The organisations getting returns are the ones that have decided in advance what the agent is allowed to see, what it is allowed to call, and what it must escalate, and the organisations cancelling projects are largely the ones that deployed a capable model into an undefined process and waited to see what happened.

    What actually breaks when an agent is given a whole product instead of one step

    An agent handed an entire product rather than one workflow step fails in measurable, well-documented ways, not mysterious ones. On TheAgentCompany, a Carnegie Mellon benchmark of 175 consequential, long-horizon professional tasks inside a simulated software company, the best-performing model completed 30.3 percent of tasks autonomously and scored 39.3 percent once partial credit was allowed [4], and broader reporting on real office work has put the error rate at roughly 70 percent of tasks attempted [5]. The most instructive failure mode, though, is the one that scales with ambition rather than with difficulty. As the number of tools visible to an agent grows, its ability to choose the right one degrades sharply, with one widely reported Berkeley Function Calling Leaderboard result showing accuracy falling from 43 percent to 2 percent on scheduling tasks as the visible tool count expanded from four to fifty-one [6]. The mechanism is unglamorous: probability mass spreads thin across near-duplicate tool descriptions, attention dilutes, and the model begins either inventing tool names or calling the correct tool with arguments borrowed from a different tool’s schema. Recent work has started to formalise the question of how many tools an agent should see at all, with chance-corrected methods rather than anecdote [7]. Anthropic’s own published guidance reaches the practical version of the same point, recommending the simplest pattern that passes evaluation, a fixed workflow where the path can be hardcoded, and genuine agency reserved only for problems where the number of steps cannot be predicted in advance [8]. Despite widespread optimism about general-purpose agents, the evidence increasingly suggests that narrowing is the intervention that works.

    What a scoped agentic workflow looks like inside a compliance product

    Aerial view of a coffee plantation divided into mapped plots, the plot-level geodata an EUDR due diligence statement must account for.
    Photo by Jeswin Thomas on Unsplash (source)

    A scoped agentic workflow gives the model a single step, a short tool list, and no way to answer silently. ZigoTrace’s intelligence model is built this way across five distinct layers, and the design reads as a fairly direct implementation of what the benchmark literature recommends. Chat is not scoped to the product but to exactly where the user is standing, which module (EUDR, biodiversity, or general farm operations) and which workflow step within it, such as block registry or due-diligence readiness. Before the model sees a message, the backend assembles a system message from that step’s real, current findings, pulled live from the same deterministic detector output the scoring endpoint runs, ranked by severity and capped at eight with the true remaining count stated plainly. A question about what is wrong with a given plot is therefore answered from open findings recorded against that node, not from training-data association. That distinction is not theoretical: before an identity-framing layer was added, a broad question about yield tracking pulled in generic industrial-manufacturing associations instead of the product’s own agricultural traceability domain, which is a small in-house instance of precisely the dilution effect the tool-count research describes.

    The remaining layers extend the same principle from context into action. Each module exposes one shared tool registry, used by both the chat surface’s slash commands and that module’s own tools tab, so the two can never disagree about what exists, and a command like generating a due diligence statement for a lot calls the same backend action the interface button calls rather than a parallel implementation. Structured multi-step runs live in an agent workspace where each plugin carries its own playbook, mapping plots, assessing suppliers, assembling evidence, generating the statement, with chat memory scoped per step rather than pooled across the session. The workspace discloses its own reads: a context event fires before any token is generated, stating what was actually consulted, which means the system reports one open finding rather than answering as though it had read everything. Above the raw findings sits a value-of-information ranking that decides what to fix first, feeding a review queue whose confirmations and corrections recalibrate the confidence scoring underneath. The two surfaces pointing in the opposite direction, an MCP connector letting external assistants call ZigoTrace’s own scoring and gap tools, and a terminal agent driving the same ingest commands, both keep a confirmation prompt on every command, so nothing skips a gate a human would otherwise hit. It is worth noting that MCP, the Model Context Protocol, became a vendor-neutral standard when it was donated to the Agentic AI Foundation under the Linux Foundation in December 2025 [9], which makes being callable by someone else’s agent a durable design choice rather than a bet on one vendor.

    Why two 2026 deadlines turn the agent’s own log into part of the filing

    Two regulations arriving within five months of each other are about to make the agent’s record of its own work part of the deliverable rather than an engineering nicety. The EU AI Act’s record-keeping obligation requires high-risk AI systems to technically allow automatic logging of events across the system’s lifetime, in full application from 2 August 2026, with deployers separately obliged to retain those logs for at least six months [10]. Non-compliance carries a penalty of up to 15 million euro or 3 percent of global annual turnover, whichever is higher, although the timing is not entirely settled: the Digital Omnibus agreement would defer stand-alone Annex III systems to 2 December 2027, and no finalised technical standard for Article 12 logging yet exists, with prEN 18229-1 and ISO/IEC DIS 24970 both still in draft [11]. In parallel, large operators and traders must comply with the EU Deforestation Regulation from 30 December 2026 under the revision adopted in December 2025, filing a Due Diligence Statement through the EU TRACES system before placing a covered commodity on the market [12][13]. Read together, the two deadlines describe a single requirement: an agent that participates in assembling a regulatory filing must be able to show what it read, what it called, and what it could not determine. A system that cannot produce that account is not merely under-documented, it is unusable upstream of the filing, because a fabricated pass anywhere in the chain would underwrite a false statement submitted to a regulator. This is why the constraint governing every layer described above, that a tool which cannot answer must never produce a verdict, is enforced on the non-language tools as well as on the model, and why a provider without credentials or a satellite pass obscured by cloud returns an inconclusive result rather than a guessed clear one.

    Whether scoping is a durable principle or a temporary workaround remains open

    Yet, it remains to be seen whether tight scoping is a permanent principle of agentic workflow design or an accommodation to the models currently available. The honest position is that the case for narrowing rests on benchmarks and production telemetry rather than on a settled result, and that some of what looks like architectural wisdom today may simply be compensation for context handling that improves in two model generations. ZigoTrace’s own stack reflects that uncertainty rather than papering over it: the deterministic detection layer and the confidence-fusion layer are in production, while the trained-model layer and the next-best-action ranking are built but not yet validated against customer data, having been tested only on synthetic gaps, and the automated public nature-database sources on the biodiversity side report as not connected because a licence review is outstanding. Gartner, for its part, expects roughly 15 percent of day-to-day work decisions to be made autonomously by 2028, up from effectively none in 2024, and a third of enterprise software to carry agentic capability by the same year [2]. If that holds, the organisations positioned to use it will likely be the ones that spent this period deciding what their agents are not allowed to do, since a workflow that has already defined its steps, its tools, and its escalation paths can safely be given more autonomy later, while one that never defined them has nothing to loosen.

    Book a demo to see how ZigoTrace scores what your existing records can actually prove.

    References

    1. Databricks, “State of AI Agents 2026,” January 2026.
    2. Gartner, “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027,” press release, 25 June 2025.
    3. MIT Media Lab Project NANDA, “The GenAI Divide: State of AI in Business 2025.”
    4. Xu, F. et al., “TheAgentCompany: Benchmarking LLM Agents on Consequential Real World Tasks,” arXiv:2412.14161, NeurIPS 2025 Datasets and Benchmarks Track.
    5. The Register, “AI agents get office tasks wrong around 70% of the time,” 29 June 2025.
    6. Berkeley Function Calling Leaderboard tool-count result, as reported in the agent tool-selection literature, 2026.
    7. “How Many Tools Should an LLM Agent See? A Chance-Corrected Answer,” arXiv:2605.24660.
    8. Anthropic, “Building Effective Agents,” engineering guidance.
    9. Model Context Protocol, governance transfer to the Agentic AI Foundation under the Linux Foundation, December 2025.
    10. Regulation (EU) 2024/1689 (EU AI Act), Article 12 (record-keeping) and Article 26 (deployer log retention).
    11. Help Net Security, “What the EU AI Act requires for AI agent logging,” 16 April 2026.
    12. Council of the European Union, “Deforestation: Council signs off targeted revision to simplify and postpone the regulation,” December 2025.
    13. European Commission, Access2Markets, “Delay until December 2026 and other developments in the implementation of the EUDR Regulation.”

    Frequently asked questions

    What is an agentic AI workflow?

    An agentic AI workflow is a process in which a language model plans across multiple steps, calls real tools that change the state of a business system, and escalates what it cannot complete, rather than only generating text in reply to a prompt [8]. Anthropic distinguishes this from a fixed workflow, where the sequence of steps is defined in code and the model fills specific roles within it [8].

    Why do most agentic AI projects fail?

    Gartner attributes the projected cancellation of more than 40 percent of agentic AI projects by the end of 2027 to escalating costs, unclear business value, and inadequate risk controls, not to model capability [2]. Benchmark evidence supports the same reading: even leading models complete only about 30 percent of long-horizon professional tasks autonomously [4].

    Does giving an AI agent more tools make it more capable?

    No. Tool-selection accuracy degrades as the visible tool list grows, with one widely reported leaderboard result showing a fall from 43 percent to 2 percent as the tool count went from four to fifty-one [6]. Scoping an agent to a small, task-specific tool registry is currently the more reliable design [7].

    What do the 2026 regulations require of AI used in compliance work?

    The EU AI Act requires high-risk systems to support automatic event logging across their lifetime from 2 August 2026, with deployers retaining logs for at least six months [10]. Separately, EUDR large operators must file Due Diligence Statements from 30 December 2026 [12][13], which means any agent involved in assembling that filing has to be able to show what it read and what it could not determine.

  • The Agentic AI Trust Gap: What It Takes to Let an Agent Sign Off on Compliance

    The Agentic AI Trust Gap: What It Takes to Let an Agent Sign Off on Compliance

    Abstract visualization of an AI network of connected nodes
    Photo by Growtika on Unsplash (source)

    Why enterprises don’t trust the agents they’ve already deployed

    Enterprise AI agents have crossed a strange threshold in 2026: nearly everyone has deployed one, almost no one trusts what it produces. Eighty-five percent of enterprises are already running AI agents somewhere in their operations, yet only five percent trust those agents enough to let their output ship without a human re-checking it first [1]. Seventy-two percent of enterprises admit their agents operate with unmanaged risk, financial and compliance exposure included, and among security leaders who believe their agents are not over-provisioned, only a third actually enforce the access controls that would make that belief true rather than aspirational [2] [3]. This is the agentic AI trust gap, and it is not a capability problem. The models are fluent, the tool-calling works, the demos are convincing. What is missing, in the large majority of deployments, is a design that tells the difference between an agent that knows something and an agent that is confidently guessing, and that difference is exactly what a compliance decision cannot survive without.

    The distrust is earned, not paranoid. Industries governed by strict accuracy standards, healthcare, financial services, legal, and increasingly agricultural export compliance, face direct exposure whenever an AI system introduces an error into a regulated decision process, because the cost of that error is not a bad customer experience, it is a filing that turns out to be false [7]. Retrieval-augmented generation was supposed to be the fix: ground the model in retrieved evidence, and the hallucination problem mostly goes away. The evidence says otherwise. Retrieval reduces hallucination but does not eliminate it, and retrieval-augmented legal research tools specifically, the closest existing analogue to a compliance-document generator, have shown hallucination rates as high as thirty-three percent even with retrieval in place [9]. That is not a rounding error. It is the difference between a tool that occasionally needs a second look and one that cannot be trusted with a decision at all. The consequences of getting this wrong in a real regulated setting are no longer hypothetical, either: in Hussein v Canada, a 2025 case, a Canadian federal court dealt with legal submissions containing fabricated or misrepresented case law generated through AI-assisted research, and ordered costs personally against the counsel responsible, a clear signal that regulators and courts will not treat a hallucinated AI output as a mitigating circumstance [8]. Based on data like this, it becomes easier to understand why 79% of companies have adopted AI agents in some form while barely one in nine has actually pushed them into production for anything that matters [6]. Adoption is cheap. Trust is the expensive part, and most deployments have not paid for it.

    What closes the gap: a verdict that can’t be produced must not be produced

    A farmer using a mobile device to record field data
    Photo by Mark Stebnicki on Pexels (source)

    ZigoTrace’s own architecture is a useful, concrete counter-example, not because it is unusually clever, but because it was built around one constraint applied with unusual consistency: a tool that cannot answer a question must say so, and that rule is enforced on every tool the system can call, not only the language model sitting on top. The primary interface is chat, but it is scoped tightly to wherever the user actually is, which module and which step within it, and before the model ever sees a message, the backend injects the real, current findings for that exact step, ranked by severity and capped with the true total stated rather than silently truncated. Ask what is wrong with a given plot, and the answer comes from the actual open findings against that plot, not from whatever associations the model’s training data happens to carry. That grounding turns out to matter more than it sounds: a documented failure mode inside the product showed that without an explicit domain-identity layer, a broad question about yield tracking pulled in generic industrial-manufacturing associations instead of the system’s own agricultural-traceability domain, a small, specific illustration of how easily an ungrounded agent drifts into a plausible-sounding wrong answer. Chat in this architecture also does not stop at discussion. A slash command calls the same real backend action the dashboard’s own button calls, drawing from a shared tool registry so the chat surface and the UI surface can never quietly disagree about what is actually available to run. Sitting above the raw findings is a next-best-action layer that ranks what to fix first by value of information rather than just severity, feeding an active-learning loop where a reviewer’s correction recalibrates the underlying confidence scoring rather than being discarded. And the system runs in both directions: an MCP connector lets Claude or ChatGPT call the platform’s own score and gap tools directly, tenant-scoped to the caller’s own credentials, while a terminal agent drives the same ingest commands as tools, still asking for confirmation at every step a human would be asked for. None of this is presented as a checklist of features inside the product itself, it is one governing rule expressed five different ways.

    Why EUDR raises the stakes further than most compliance contexts

    Satellite view of forest and cleared land
    Photo by Geranimo on Unsplash (source)

    Few compliance contexts make the cost of a fabricated verdict as legible as the EU Deforestation Regulation does. Under EUDR, an operator has to file a Due Diligence Statement proving a commodity was not grown on land deforested after a fixed cutoff date, for every plot and every supplier, and enforcement is no longer a distant deadline: large operators must comply from 30 December 2026, with competent-authority enforcement obligations already beginning mid-2026, and inspection rates that scale with country risk, one percent of shipments from low-risk countries, three percent from standard-risk countries, and nine percent from high-risk ones [11] [12]. A deforestation check that guesses “clear” because a satellite pass was cloud-covered, or because a plot sits outside a dataset’s mapped biome, does not fail quietly. It underwrites a Due Diligence Statement that a regulator can later disprove, at exactly the inspection rate that country’s risk tier makes statistically likely. This is why ZigoTrace’s deforestation verification layer queries three independent sources and returns an explicit inconclusive or not-configured result rather than a guessed clear whenever a check genuinely cannot answer, the same rule that governs the chat layer above it, applied to a satellite feed instead of a language model. Calibration research backs up why that distinction matters more than raw accuracy: conformal prediction gives a distribution-free coverage guarantee on a model’s output, meaning the confidence attached to a claim holds up regardless of the true underlying data distribution, which is what turns a score into evidence a regulator or a bank can actually act on rather than a number the vendor is simply asking to be believed [10]. A system that is occasionally wrong but always honest about when it does not know is, for a compliance filing, categorically more useful than one that is usually right and never says so.

    Calibration, not capability, is the open question

    Whether the rest of the agentic AI industry closes its own trust gap the same way remains, based on the numbers so far, genuinely uncertain. Forty percent of enterprise applications are expected to contain task-specific agents by 2026, and Gartner projects that more than forty percent of agentic AI projects will be cancelled before the end of 2027, largely over unclear value and inadequate risk controls, not over the models themselves being insufficiently capable [5]. Consequently, the implications of that gap, between how fast agents are being deployed and how slowly the industry is learning to make them verifiably honest about their own limits, will likely matter more over the next two years than any single capability jump in the underlying models. The lesson from a narrow, domain-grounded system built around one consistently enforced rule is not that agentic AI is safe by default. It is that trust in an agent is not something a bigger model produces on its own; it is something a specific design decision, repeated at every layer where the system could otherwise guess, has to earn.

    More on how this works inside ZigoTrace’s own platform: https://agri.zigotrace.com/

    References

    1. VentureBeat, “85% of enterprises are running AI agents. Only 5% trust them enough to ship.”
    2. Kore.ai, “New Kore.ai Survey: 72% of Enterprises Say Their AI Agents Operate With Unmanaged Risk and Create New Operational Burdens.”
    3. Cequence and EMA Research, “94% of Enterprises Trust Their AI Agents Aren’t Over-Provisioned. Only 33% Actually Enforce It,” GlobeNewswire, August 2026.
    4. Businesswire, “Digital Trust Index 2026: AI Skepticism and Identity Access Friction Are Costing Revenue.”
    5. First Page Sage, “Agentic AI Adoption Statistics for 2026.”
    6. Digital Applied, “Agentic AI Statistics 2026: 150+ Data Points Collection.”
    7. Guidepost Solutions, “AI Hallucinations and Other AI Risks: Why Every Organization Needs an AI Compliance Framework.”
    8. SmartDev, “When AI Gets Compliance Wrong: The Hidden Risk of Hallucination,” citing Hussein v Canada, 2025.
    9. arXiv, “Large Language Models Hallucination: A Comprehensive Survey.”
    10. Bellotti, A. and Zhao, X., “Conformal Prediction and Trustworthy AI,” arXiv.
    11. Council of the European Union (Consilium), “Deforestation: Council signs off targeted revision to simplify and postpone the regulation,” December 2025.
    12. Coolset, “EUDR timeline tracker: Delays, U-turns and the latest enforcement plan.”

    FAQ

    What is the agentic AI trust gap? It is the widening distance between how fast enterprises are deploying AI agents and how little they trust those agents’ output: 85% of enterprises run AI agents somewhere in their operations, but only 5% trust them enough to let output ship without human review, and 72% admit their agents carry unmanaged financial or compliance risk [1] [2].

    Why doesn’t retrieval-augmented generation (RAG) solve AI hallucination on its own? RAG grounds a model’s output in retrieved evidence, which reduces hallucination but does not eliminate it. Retrieval-augmented legal research tools, the closest existing analogue to a compliance-document generator, have shown hallucination rates as high as 33% even with retrieval in place [9].

    Why is EUDR compliance a high-stakes test case for agentic AI trust? Under the EU Deforestation Regulation, a fabricated “deforestation-free” verdict does not just look bad, it underwrites a Due Diligence Statement a regulator can later disprove. Large operators must comply from 30 December 2026, and inspection rates scale with country risk, from 1% up to 9% of shipments [11].

    What design principle actually closes the agentic AI trust gap? A tool that cannot answer a question must never produce a guessed verdict, enforced on every tool in the system, language model and non-LLM data checks alike. That single rule, applied consistently, is what lets an agentic system sit upstream of a real compliance decision.

    Ready to see how a domain-grounded agentic AI system handles real compliance decisions? Book a Demo