The build curve and the governance curve are diverging, and the gap has a number now

This is the clearest quantified signal yet that Identity Control Surface gaps will trigger operational reversals at scale. Firms that have deployed agents without embedding identity and permission governance into their control architecture are already on the path Gartner describes. The AAI Brand dimension sits at 44, and this data explains part of why: agent deployments that lack auditability corrode the credibility of the broader AI program. The question for every enterprise is whether governance is part of the agent's architecture or a retrofit after the rollout.

The 10,000x growth in agent population from 2025 to 2028 means non-human identity governance will need to operate at a scale that current IAM architectures were never designed for. Fewer than four in ten firms even assessed security at the current, near-zero agent count. Scaling without closing that gap first is how the Gartner demotion scenario in the FTI signal gets populated. The Compiled Corporation framing is instructive: automating firm decisions at this volume requires a parallel automation of identity verification and access control, or the decision surface becomes ungoverned by design.

This is a Decision Surface signal with infrastructure consequences. As agents become primary consumers of web-based services, the assumption that traffic can be bifurcated into human and automated is collapsing. For enterprises deploying agents that interact with external systems, this means the authentication and trust models those systems use are under active revision. Identity architects who design agent access policies today are building on a surface that will shift. The Janus Brand dimension matters here too: customer-facing agents operating on a degraded or contested web infrastructure will produce inconsistent experiences that reflect back on the brand deploying them.

The two-day build time is a Compiled Corporation indicator: domain expertise is now compilable into agent form fast enough that the bottleneck has shifted from build capacity to adoption governance. The 45-colleague adoption cohort before leadership selected it for wider rollout is a meaningful data point on how agent programs organically scale inside firms. With AAI Scaling Maturity up two points to 71, cases like this illustrate the operational pattern behind that movement. The open governance question is whether the identity and permission model for that agent was designed at build time or deferred to the rollout phase.

The structure of this partnership is a Decision Surface signal: governance and observability are being packaged as the primary enabler of production readiness, ahead of model quality or feature completeness. That sequencing is correct. Observability determines where the human-agent interface sits in any given workflow, and without it, firms cannot make informed decisions about which agent actions require human review. The continual learning loop pillar also surfaces an Identity Control Surface question: as agents retrain on production data, the governance of what data they can access, and under what identity context, needs to be part of the loop architecture.