When an employee joins a company, a series of things happen that nobody questions. They receive a login, a set of permissions, a manager, a role description and a record of what they did. If something goes wrong, there is a person to ask and a trail to follow.
AI agents that act on their own, booking, approving, coding, reconciling and replying, are now entering the same systems, and in many organizations, none of those things have been arranged for them. Gartner's list of the top strategic technology trends for 2027, released October 20, suggests that is about to become a problem the business can no longer leave to the IT department.
What Gartner Is Flagging
Gartner named ten trends: large quantitative models, speech reasoning models, world models, AI context platforms, agent coding harness, AI agent identity, autonomous exposure remediation, sovereign tech, disposable applications, and wetware as a service. Several concern the technology itself. Three speak directly to who is responsible for what AI does.
AI Agent Identity
Gartner predicts that by 2028, 25 per cent of enterprise security breaches will trace back to AI agent abuse, which it attributes to unmanaged machine privileges and legacy credential practices.
Agent Coding Harness
A control layer for AI-generated code that governs machine-generated software and helps maintain quality, compliance and accountability.
AI Context Platforms
Gartner predicts that by 2027, prioritizing semantics in AI-ready data could increase agentic AI accuracy by up to 80 per cent and reduce costs by up to 60 per cent.
Important distinction: These are forecasts from an analyst firm, not measured results, and the percentages are ceilings (“up to”) rather than expectations. They are useful as a statement of where Gartner thinks attention is heading. What they share is a theme: giving AI more autonomy is a design and governance question as much as a technical one.
Gartner's analysts describe agent identity as connecting “models, prompts and credentials to agent actions, creating trust and accountability.” On context platforms, Gartner's Gene Alvarez warns that “without a dedicated context layer, organizations face severe operational risks.”
The Opening Argument
The critical friction today is that AI systems operate in an architectural vacuum.
Alvarez opened the release with a line that frames the whole list. Organizations, he said, must move “from a passive observer of model capabilities to an active architect.”
Put plainly, many companies have added AI tools to processes that were never redesigned around them. The tool works in isolation, but nobody has decided where it sits, what it can touch, who checks it, and what happens when it is wrong.
What Owning an Agent Looks Like
If an AI agent behaves like a digital worker, the organization needs to manage it like one. In practice that means answering a handful of questions for every agent in production.
Who Is Accountable?
Each agent should have a named human owner, responsible for what it does the way a manager is for a team member. If that person is unknown, the agent is operating without supervision.
What Can It Access?
Persistent credentials that were set up for convenience are the weakness Gartner highlights. Access should be limited to what the task needs and reviewed on a schedule.
What Did It Do?
Logging that links an action back to the agent, its instructions and the credentials it used makes investigation possible. Without it, the first question after an incident cannot be answered.
Who Checks the Work?
Earlier in this edition, we noted that Canadian hiring managers who cut roles for AI reported needing more human oversight and quality control than they expected. That oversight is a job, and it requires someone with the expertise to judge whether output is right.
One more question: What happens when it stops? Business continuity plans written for people leaving or systems failing rarely account for an agent being switched off for a security reason. Someone should know which processes depend on it.
A People Question, Not Only a Technology Question
None of this is solved by buying software alone. Each of the questions above depends on people with specific skills, and those people are not evenly distributed.
Security and Identity Specialists
Professionals who understand machine identities, not only user accounts, and can establish appropriate access and accountability controls.
Data and Platform Engineers
People who can build and maintain the context layer Gartner describes, connecting AI systems to the information they need.
Risk, Compliance and Legal Teams
Specialists who can translate policies and obligations into controls an agent can follow.
Business Process Owners
People who know how work actually flows and can judge when an agent has got it wrong.
Canada's own labour data shows how thin some of these pools are. Research covered earlier this year found cybersecurity postings recovering while skills gaps, not headcount, had become the top workforce challenge in the field. An organization that plans to deploy agents widely will need these skills at the same time as everyone else.
Practical Steps for the Next Two Quarters
Organizations do not need to wait for every strategic technology trend to mature before putting basic governance in place. These steps provide a practical starting point.
Take an Inventory
List every AI agent, assistant or automated workflow in use, including those teams set up themselves. Record owner, purpose, access and data touched. Most organizations find more than they expected.
Assign Owners
Every item on that list should have a named person accountable for it. Where nobody wants the job, ask whether the agent should be running.
Tighten Credentials
Replace static credentials with scoped, time-limited access wherever possible, and remove access that is no longer used.
Decide the Review Model
For each agent, define what a person checks, how often and with what authority to stop it. Include the time this takes in the business case.
Close the Skills Gap Deliberately
Decide which capabilities to build inside, which to borrow through contract specialists and which to bring in through consulting partners. Technology and consulting talent firms, SRA Group among them, are often used to supply scarce security, data and delivery skills for a defined project, so internal teams can focus on running what is built.
Report Upward
If agents act on behalf of the business, the board and senior leadership should see a plain-language summary of what they do and what could go wrong.
The Bigger Picture
The first wave of workplace AI was about speed: do the task faster. The next is about delegation: let the system act. Delegation carries obligations that speed does not. Someone has to be answerable for what the system does, someone has to be able to see it, and someone has to be able to stop it.
Gartner's predictions will not all come true on schedule, and some of the figures are best read as signals rather than targets. The question underneath them is already here. For every agent a company puts to work, it should be able to name an owner.
Building the Skills Behind Responsible AI
SRA Group supports organizations with technology and consulting talent, including access to specialist security, data and delivery skills for defined projects. The right expertise can help businesses strengthen their capabilities while internal teams focus on implementation and ongoing operations.
Sources
Gartner, “Gartner Identifies the Top Strategic Technology Trends for 2027” (press release, October 20, 2026); Gartner, “Top 10 Strategic Technology Trends for 2027”; Canadian Cybersecurity Network Q2 2026 labour market research and SANS Institute 2026 workforce report (as covered in Talent Insider, August 2026); Robert Half Canada survey of hiring managers, as reported by Canadian HR Reporter (2026).