Aug14
Two numbers from Stanford's 2026 AI Index Report deserve to be read together, because separately they tell comfortable stories and together they tell an uncomfortable one.
The first: 88% of surveyed organizations now use AI, and 70% use generative AI in at least one business function. The second: deployment of agentic AI — systems that plan, decide, and act with a degree of autonomy — remains in the single digits across nearly every business function. Why? Not capability; agent benchmark performance is improving dramatically year over year. The leading answer, cited by 62% of organizations, is security and risk.
Decades in project management, cybersecurity, and organizational transformation have taught me to pay attention when a technology is ready before the organization is. That gap is never closed by better technology; it is closed by better management structure. MIT's widely discussed 2025 "GenAI Divide" research found that roughly 95% of enterprise generative AI pilots failed to deliver measurable P&L impact — failures attributed primarily to how organizations integrated the tools, not the models.
So here is the question executives should ask. Not "which agents should we deploy?" but "which part of our organization actually knows how to govern delegated authority?"
I believe the answer, for most enterprises, is a function many have spent the last decade trying to shrink: the PMO.
Conventional management rests on a quiet assumption: authority lives in people. We express it through organizational charts, delegation-of-authority matrices, RACI charts, and approval workflows. That is why enterprises built two separate governance systems — one for humans (hiring, performance management, spending limits) and one for software (change control, access management, testing).
Agentic AI breaks this two-column model, because an agent is neither column. It holds delegated decision rights the way an employee does — shortlisting vendors, reprioritizing a backlog, sending communications, triggering downstream workflows. But it scales, replicates, and fails the way software does: instantly, silently, in parallel. An employee who misunderstands a policy makes one bad decision at a time. An agent that misunderstands a policy makes ten thousand consistent bad decisions before lunch.
This is an observation, not a prediction: when you deploy an agent, you are not installing software. You are delegating authority — written in configuration, prompts, and permissions rather than in a job description. Authority has become software. Yet almost no organization has a management instrument for that hybrid. HR governance does not apply; the agent is not a person. IT change control is necessary but insufficient; it governs whether the code is safe to run, not whether the decisions are safe to delegate.
Organizations feel this gap even if they cannot yet name it. The AI Index found documented AI incidents rose from 233 in 2024 to 362 in 2025, while organizations rating their own incident response as "excellent" fell from 28% to 18% — declining confidence even as AI investment surged past half a trillion dollars.
Here is my thesis, drawn from experience rather than any vendor's roadmap: the discipline the enterprise needs to govern agentic AI already exists, and it is project governance. The PMO is the only mainstream corporate function whose core craft is making delegated authority explicit, bounded, monitored, and revocable — inside temporary structures, under uncertainty, across organizational silos.
Consider what a mature PMO actually does. It charters initiatives, defining scope of authority before work begins. It sets tolerances — thresholds within which a project manager may decide alone and beyond which escalation is mandatory. It runs stage gates, scheduled moments where authority must be re-earned, not assumed. It maintains audit trails, so accountability survives personnel changes. All of it for temporary endeavors — entities that, like agents, are created for a purpose, operate for a bounded period, and must be deliberately closed down.
Now reread that paragraph replacing "project" with "agent." Nothing else in the enterprise maps so cleanly. This is why I see agentic AI not as a threat to the PMO but as the strongest argument for its renewal in twenty years: its mandate expands from governing projects run by people to governing a portfolio of delegated authority — human and machine.
Some will object that AI governance committees already exist for this. In my consulting work I see what those committees produce: policies, principles, review boards that meet monthly. These are necessary, but they operate at the wrong altitude. Agents make decisions hourly inside live delivery work; governance that is not embedded in the delivery system arrives after the consequences. The AI Index data is telling: only 36% of organizations report engaging with ISO/IEC 42001 and 33% with the NIST AI Risk Management Framework — and policy-level frameworks still need an operational function to enforce them where work happens. Cybersecurity taught us this expensively: security failed as a compliance document and succeeded as an engineering practice. AI governance will follow the same curve, and the delivery organization — the PMO — is where it must land.
Project managers already know the instrument this moment requires; they have simply never applied it to a machine. Every consequential agent should operate under an Agent Charter, authorized and maintained by the PMO, with five components:
1. Mandate. What, precisely, is this agent authorized to do and to decide? Not what it can do — what it may do. A mandate defines the decision space (e.g., "reprioritize backlog items within an approved release scope") and names what is out of scope. If you cannot write the mandate in plain language, you are not ready to deploy the agent.
2. Materiality. Every delegation-of-authority matrix has spending limits; agent charters need decision-stakes limits. Below the threshold, the agent acts autonomously. Above it — decisions affecting contracts, people, safety, regulatory exposure, or amounts beyond a defined value — the agent may recommend but a named human must decide. Materiality thresholds are where accountability physically lives.
3. Monitoring. The charter must specify what telemetry the agent produces and who reviews it. The standard is reconstructability: for any consequential action, can we reconstruct what the agent did, what information it acted on, and why? An agent whose decisions cannot be audited retroactively should not hold a mandate at all.
4. Escalation. Under what observable conditions does the agent stop and hand control to a human — and to whom, by name or role? Escalation paths designed after an incident are incident reports. They must be designed into the charter, exactly as tolerances and exception management are designed into stage-gated governance.
5. Renewal. Charters expire. Models drift, contexts change, and an agent that was safe in March may be misaligned by September. Scheduled re-authorization — a stage gate for the agent itself — forces the organization to re-ask the question every good sponsor asks of every project: should this continue to exist, in this form, with this authority?
Mandate, Materiality, Monitoring, Escalation, Renewal. None of this is exotic. That is precisely the point: it is project governance, applied to a new kind of team member.
For project managers, the shift is from directing tasks to administering mandates. A project manager running a hybrid human–agent team spends less time compiling status (agents do that well) and more time on the judgments the charter reserves for humans: materiality calls, escalation responses, and the interpersonal work of stakeholder trust and team health. PMI's Pulse of the Profession 2026 finds complex projects fail at roughly 33% — more than double the general rate — and that success comes from managing complexity, not adding control. Agents will add complexity faster than they remove work.
For PMOs, the agent portfolio becomes a governance object alongside the project portfolio. The PMO maintains the charter register, runs renewal gates, aggregates agent telemetry into portfolio-level risk reporting, and — critically — owns the methodology for writing good mandates, just as it owns the methodology for good business cases.
For executives, the Agent Charter converts a vague anxiety ("are we in control of our AI?") into an answerable question: show me the charter register. A CEO who can see every consequential agent, its mandate, its materiality thresholds, and its last renewal date has something no policy document provides — a live map of delegated machine authority.
For AI governance functions, the PMO becomes the enforcement layer that policy frameworks lack. NIST AI RMF and ISO/IEC 42001 need somewhere to operate. Charters are where principles become controls.
Candor requires naming the failure modes — several of which I have watched emerge in early deployments.
Automation bias is the most insidious: humans approve agent recommendations at a rhythm that gradually becomes rubber-stamping. The countermeasure is structural — materiality thresholds must route consequential decisions to humans rarely enough that each receives real attention. Hallucination and error remain irreducible; the AI Index found inaccuracy concern rising faster than any other risk category, which is why reconstructability, not confidence, must be the audit standard. Accountability diffusion — "the agent decided" — must be foreclosed by design: a charter is signed by a human sponsor who remains accountable for everything within the mandate, exactly as a project sponsor answers for a project. Security deserves special emphasis: an agent with delegated authority is a high-value attack surface, and prompt injection against an agent that can act is not a data breach but an authority breach. Finally, excessive delegation — chartering agents into ambiguity because it is efficient — is a leadership failure, not a technical one. Where decision authority is unclear among humans, deploying an agent does not resolve the ambiguity; it launders it.
My operating rule: humans must remain wherever a decision is difficult to reverse, affects people directly, carries regulatory or safety exposure, or requires accepting accountability on behalf of the organization. Everything else is negotiable. Those four categories are not.
What follows is prediction, not fact. I expect that by 2029 leading PMOs will maintain agent charter registers as routinely as risk registers today, and that "mandate design" will be a recognized project-management competency taught alongside scheduling and stakeholder management. I expect at least one major governance failure — publicly blamed on an agent but actually caused by an ungoverned delegation — to accelerate regulatory interest in exactly the auditability charters provide. And I expect the market to discover that the professionals best prepared for the agentic era were never the most technical ones, but those trained to ask: who authorized this, within what limits, and who answers for the outcome?
The World Economic Forum's Future of Jobs Report 2025 projects that a large share of core workplace skills will change by 2030. For project professionals, I would argue the essential skill barely changes at all; it simply acquires a new object. We have always governed delegated authority under uncertainty. The authority has just learned to run on servers.
For seventy years, management theory has assumed that the fundamental unit of organizational design is the human role. Agentic AI quietly replaces that assumption: the fundamental unit is becoming the mandate — a bounded grant of decision authority that may be held by a person, a team, or a machine. Organizations that learn to design, monitor, and renew mandates deliberately will compound the benefits of AI. Organizations that delegate by accident will discover their real org chart only during the post-incident review.
So I will leave you with the question I now put to every executive team I work with: if I asked you tomorrow morning to show me every decision your AI systems are currently authorized to make on your behalf - could you produce that list? And if not, who in your organization should own it?
Keywords: Agentic AI, AI Governance, Project Management
When Authority Becomes Software: Agentic AI and the New Mandate of the PMO
Friday’s Change Reflection Quote – Saeculum Leadership – Leaders Architect Before Certainty
The Corix Partners Friday Reading List - August 14, 2026
Why Organizations Must Reimagine Their Role In The Ecosystem Age
Immediate Successors vs. Future Leaders: Why Every Succession Plan Needs Both
