Vibe coding is having its moment. But last July during a Vibe coding event, an AI agent deleted a live production database during a declared code freeze, then told its user that rollback was impossible. It wasn’t.
That is not a model failure. It is a missing dev/prod boundary, a missing approval gate and a missing rollback path — three controls IT shipped way back in the 1990s.
Here are ten controls Agentic AI quietly undid, that enterprise IT spent thirty years getting right.
The ten controls at a glance
| Control IT solved | How agents reverse it | Impact if ignored |
|---|---|---|
| 1. Code and data kept apart | Instructions and untrusted content share one context window | Anyone who can write into a source system can steer the agent, silently |
| 2. Named identity per actor | Agents share service accounts or borrow human credentials | No attribution, so no accountability and no investigable trail |
| 3. Joiner-mover-leaver lifecycle | Agents are created by project teams and never retired | Orphaned agents holding live credentials and standing entitlements |
| 4. Segregation of duties | The same agent drafts, checks and executes the decision | Maker-checker becomes correlated failure wearing a control’s name |
| 5. Change control and release gates | Prompts, tools and model versions change without tickets or diffs | Behaviour drifts with no rollback path and no answer to “what changed?” |
| 6. Validation at the boundary | Model output is passed into queries and APIs as arguments | Injected text becomes executed action; wrong values clear no gate |
| 7. Transactional integrity | Multi-step plans run with no transaction boundary | Duplicate side effects, partial states, nothing to roll back |
| 8. Impact radius containment | One agent gets flat reach across systems kept deliberately apart | Lateral movement at machine speed, with no working kill switch |
| 9. Reconstruction-grade audit | Logs keep the final answer, not the context, calls and arguments | Decisions cannot be explained to a customer, an examiner or a court |
| 10. Metered consumption | Token spend is unbounded and unattributed to transactions | Pilots that impress die at scale-up on unit cost nobody measured |
1. Keep code and data apart
What IT solved. The separation of instruction from content. SQL injection taught the industry to parameterize queries instead of concatenating strings. Cross-site scripting taught output encoding. The rule that came out of twenty years of painful remediation was simple — data must never be promoted to instruction.
What agents reverse. A system prompt, a retrieved document, a support ticket body, a PDF upload and a tool result all arrive in the same context window, and the model has no privileged channel that marks one as authoritative.
Impact if ignored. The trust boundary moves from your access model to your content. Anyone who can put words into a system the agent reads can influence what the agent does. In loan origination that population includes borrowers uploading documents, dealers typing notes into a deal jacket, and vendors sending payoff letters — none of whom are provisioned users of anything. The failure mode is silent. No alert fires, because the agent did exactly what its context told it to do.
2. Give every actor a named identity
What IT solved. Named accounts, no shared logins, no generic administrator. Attribution requires it, and SOX made it non-negotiable rather than aspirational.
What agents reverse. Agents run under a shared service account, or borrow the credentials of whoever launched them. The audit log then shows a human who was asleep.
Impact if ignored. No attribution means no accountability. Fraud investigation stalls, adverse action explanation stalls and internal audit cannot separate agent behavior from human behavior in the same log. When an examiner asks who made a decision, “a service account called svc-agent-prod” is not an answer that survives the follow-up question.
3. Run the full identity lifecycle for agents
What IT solved. Provisioning tied to HR events, periodic access certification, and deprovisioning on the day someone leaves. The joiner-mover-leaver process exists because entitlements accumulate unless something actively removes them.
What agents reverse. Agents are created by project teams, registered nowhere, certified never, and retired only when a cloud bill prompts a cleanup.
Impact if ignored. The pilot that ended six months ago still holds read and write access to the deal jacket. Attack surface grows monotonically because no process shrinks it, and the entitlement review that would have caught it does not run against identities nobody registered.
4. Preserve segregation of duties
What IT solved. The person who creates a payment cannot approve it. The developer who writes the code cannot push it to production. Maker-checker is structural, not advisory, and in financial services it is examined.
What agents reverse. One agent drafts the decision, evaluates the decision, and executes it. Where a second agent is added as a reviewer, it usually runs on the same model, with the same context and the same blind spot. That is not independent review. It is the same judgment applied twice.
Impact if ignored. The control still appears in the process diagram while providing none of its protection. Errors correlate instead of cancelling, which is the specific thing segregation of duties was designed to prevent. In credit decisioning this is the difference between a control and the appearance of one, and an agentic pipeline does not become compliant because the checker is also an agent.
5. Put prompts, tools and model versions under change control
What IT solved. Version control, peer review, a change advisory board, release notes, and a rollback plan. Nothing reached production without a reviewer.
What agents reverse. A system prompt gets edited in a vendor console on a Friday afternoon with no ticket and no diff. A model provider ships a new version and behavior shifts under a prompt that never changed. Tool definitions get added by whoever wired up the integration. Three uncontrolled surfaces, all of them production logic.
Impact if ignored. When output quality degrades, there is no way to establish what changed, and no version to roll back to. A prompt is production logic. Treating it as configuration is how the audit finding writes itself.
6. Validate at the tool boundary
What IT solved. Never concatenate untrusted input into an executable statement. Parameterize and validate values against business rules before they reach a system of record.
What agents reverse. Generated text is passed directly into SQL, shell commands, HTTP calls and internal APIs as arguments.
Impact if ignored. Two distinct failures arrive through the same gap. The security failure is an injected instruction becoming an executed action. The quieter operational failure is a plausible but wrong argument — the right field with the wrong account number, the correct API with an amount off by an order of magnitude — clearing a boundary that validated nothing. The second one produces no alert at all.
7. Make agent actions transactional
What IT solved. Atomic transactions and compensating transactions for work that spans systems and cannot be rolled back in one commit.
What agents reverse. A plan runs fourteen steps across six systems, fails at step nine, retries from an unclear point, and leaves two payments where one was intended. There is no transaction boundary around a plan, and no compensating action defined for a partial one.
Impact if ignored. Duplicate side effects and partial states that no one designed and no runbook covers. The publicly documented incident of July 2025 is the cleanest illustration. An AI agent deleted a live production database during a declared code freeze, then reported that rollback was impossible when recovery was in fact available, which delayed it. Roughly 1,200 executive records and a similar number of company profiles were affected. The fixes the vendor shipped within days were automatic development and production separation, improved rollback and a planning-only mode. Every one of those is an IT control from the 1990s.
8. Contain the impact radius
What IT solved. Network segmentation, environment separation, least privilege, rate limits, circuit breakers and a documented way to stop a runaway process.
What agents reverse. Hands one agent flat reach across systems that were deliberately kept apart, frequently through a single over-privileged credential. When an agent inherits a credential at that level, the distance between authorized to do its job and authorized to do anything is zero.
Impact if ignored. A single compromised or merely confused agent moves laterally faster than any human responder. The diagnostic question I ask is deliberately unglamorous — who can stop this agent mid-run, and how long does it take? If the answer is “restart the container,” there is no kill switch, there is a hope.
9. Keep an audit trail good enough to reconstruct the decision
What IT solved. Logs sufficient to reconstruct a transaction end to end, retained for the required period, tamper-evident, and legible to someone who was not there.
What agents reverse. Logging captures the final response and little else. The retrieved context, the tool calls and their arguments, the paths considered and discarded, and the prompt and model version in force at the time are either absent or sitting in a vendor dashboard with short retention.
Impact if ignored. You lose the ability to explain a decision after the fact, which is the entire job in adverse action notices, dispute handling and complaint response. The model decided” satisfies no one. A decision that cannot be reconstructed cannot be defended and every one of those becomes a settlement rather than an argument.
10. Meter consumption and know the unit cost
What IT solved. Capacity planning, quotas, chargeback and cost per transaction. Mainframe cycles and software licenses were accounted for to the department.
What agents reverse. Token consumption is variable, unbounded and rarely attributed to a business transaction. A retry loop can multiply spend without a ceiling. Very few teams I meet can state the cost of one completed transaction by use case, which means they cannot compare it to the manual baseline it is meant to replace.
Impact if ignored. The pilot that impressed the steering committee dies at scale-up, and it dies on arithmetic rather than capability. Gartner named escalating costs first among the three causes behind its prediction — published 25 June 2025 — that more than 40% of agentic AI projects will be cancelled by the end of 2027. A cost control that exists only as a monthly invoice is not a control.
What the aggregate failure looks like
Read Gartner’s three stated causes again — escalating costs, unclear business value, and inadequate risk controls. Two of the three are IT discipline failures, not AI capability failures. Model quality did not make the list.
Where I would start on Monday
The sequence matters more than the completeness. Three of these controls, done properly, remove more risk than ten done as documentation.
- Inventory the write paths. For every system an agent reads, list who can author content into it and whether that population is internal, contracted or external. That list is where the trust boundary actually sits, and it is always longer than expected.
- Give each agent its own identity and register it. One identity per agent, with a named human owner and an expiry date, entered in the same system that governs employee access.
- Put prompts, tools and model versions in version control. Diffs, reviewers and a rollback target. Nothing exotic — the same pipeline the application code already uses.
- Define the transaction boundary and the compensating action for every irreversible step the agent can take, before it is allowed to take it unattended.
- Publish cost per completed transaction next to the manual baseline, monthly, per use case.
My working principle is intent in, outcomes out — and the path between the intent and the outcome has to be inspectable, attributable and reversible. That is not a new requirement invented for AI. It is what IT has built for over thirty years, and it is what the current generation of agent deployments quietly set aside. The organizations that put it back will not be the fastest movers. They will be the ones still in production in 2028.
© Dr. Harish Kotadia, Ph.D., All Rights Reserved, 2026.
Dr. Harish Kotadia, Ph.D., is an Enterprise AI Architect with 20+ years of IT consulting experience serving Fortune 100 clients, specializing in agentic AI systems built on Anthropic Claude, AWS Bedrock, and Google Vertex AI.
Disclaimer: This blog post is based on recent events and news items drawn from reputed media sources and vendor websites available in the public domain and quoted above. This post is intended for educational purposes, to help the enterprise agentic AI community learn from public information on the application and use of agentic AI tools and technology in Fortune 500 companies.
Views and opinions expressed here are my own and do not represent those of any employer or client, past or present. The analysis presented is my independent interpretation of published news reports quoted above and does not constitute legal, financial, or consulting advice of any kind.