Agentic AI Workflows in Compliance: Why the Best Agents Are Given Less

Agentic AI Workflows in Compliance: Why the Best Agents Are Given LessAgent adoption and agent cancellation are both rising. The difference is not model quality, it is workflow design: fewer tools, one step, and a mandatory…Photo by Miha Meglic on Unsplash ( source ) The most useful thing to know about agentic AI workflows in compliance work is that the systems now succeeding are not the ones given the most freedom, they are the ones given the least. Enterprise deployment of AI agents, meaning systems where a language model plans, calls real tools, and changes the state of a business system rather than only answering a question, has moved from pilot to production quickly enough that the telemetry is now unambiguous: multi-agent workflows on the Databricks platform grew 327 percent between June and October 2025, measured across 20,000 organisations that include 60 percent of the Fortune 500 [1]. Yet across the same period, Gartner projected that more than 40 percent of agentic AI projects would be cancelled by the end of 2027, attributing the failures to escalating cost, unclear business value, and inadequate risk controls rather than to any shortfall in the underlying models [2]. Both things are true at once, and the gap between them is not a capability gap. It is a design gap, and it is one that compliance work exposes faster than almost any other domain. Why agent adoption and agent cancellation are rising at the same time The contradiction resolves once the unit of analysis shifts from the model to the workflow around it. MIT Media Lab's Project NANDA, drawing on 52 executive interviews, surveys of 153 leaders, and an analysis of 300 public deployments, found that roughly 95 percent of organisations were seeing no measurable profit-and-loss return on generative AI, while a small minority were extracting real value, a split the authors named the GenAI Divide [3]. What separates the two groups is rarely which model was chosen. Databricks' own data points at the same conclusion from the other direction: supervisor architectures, in which a coordinating agent routes work to narrower specialists rather than one agent attempting everything, already account for 37 percent of enterprise deployments, and organisations operating a formal AI governance framework ship twelve times more agent projects into production than those without one [1]. Consequently, the implications of this pattern are structural rather than technological. The organisations getting returns are the ones that have decided in advance what the agent is allowed to see, what it is allowed to call, and what it must escalate, and the organisations cancelling projects are largely the ones that deployed a capable model into an undefined process and waited to see what happened. What actually breaks when an agent is given a whole product instead of one step An agent handed an entire product rather than one workflow step fails in measurable, well-documented ways, not mysterious ones. On TheAgentCompany, a Carnegie Mellon benchmark of 175 consequential, long-horizon professional tasks inside a simulated software company, the best-performing model completed 30.3 percent of tasks autonomously and scored 39.3 percent once partial credit was allowed [4], and broader reporting on real office work has put the error rate at roughly 70 percent of tasks attempted [5]. The most instructive failure mode, though, is the one that scales with ambition rather than with difficulty. As the number of tools visible to an agent grows, its ability to choose the right one degrades sharply, with one widely reported Berkeley Function Calling Leaderboard result showing accuracy falling from 43 percent to 2 percent on scheduling tasks as the visible tool count expanded from four to fifty-one [6]. The mechanism is unglamorous: probability mass spreads thin across near-duplicate tool descriptions, attention dilutes, and the model begins either inventing tool names or calling the correct tool with arguments borrowed from a different tool's schema. Recent work has started to formalise the question of how many tools an agent should see at all, with chance-corrected methods rather than anecdote [7]. Anthropic's own published guidance reaches the practical version of the same point, recommending the simplest pattern that passes evaluation, a fixed workflow where the path can be hardcoded, and genuine agency reserved only for problems where the number of steps cannot be predicted in advance [8]. Despite widespread optimism about general-purpose agents, the evidence increasingly suggests that narrowing is the intervention that works. What a scoped agentic workflow looks like inside a compliance product Photo by Jeswin Thomas on Unsplash ( source ) A scoped agentic workflow gives the model a single step, a short tool list, and no way to answer silently. ZigoTrace's intelligence model is built this way across five distinct layers, and the design reads as a fairly direct implementation of what the benchmark literature recommends. Chat is not scoped to the product but to exactly where the user is standing, which module (EUDR, biodiversity, or general farm operations) and which workflow step within it, such as block registry or due-diligence readiness. Before the model sees a message, the backend assembles a system message from that step's real, current findings, pulled live from the same deterministic detector output the scoring endpoint runs, ranked by severity and capped at eight with the true remaining count stated plainly. A question about what is wrong with a given plot is therefore answered from open findings recorded against that node, not from training-data association. That distinction is not theoretical: before an identity-framing layer was added, a broad question about yield tracking pulled in generic industrial-manufacturing associations instead of the product's own agricultural traceability domain, which is a small in-house instance of precisely the dilution effect the tool-count research describes. The remaining layers extend the same principle from context into action. Each module exposes one shared tool registry, used by both the chat surface's slash commands and that module's own tools tab, so the two can never disagree about what exists, and a command like generating a due diligence statement for a lot calls the same backend action the interface button calls rather than a parallel implementation. Structured multi-step runs live in an agent workspace where each plugin carries its own playbook, mapping plots, assessing suppliers, assembling evidence, generating the statement, with chat memory scoped per step rather than pooled across the session. The workspace discloses its own reads: a context event fires before any token is generated, stating what was actually consulted, which means the system reports one open finding rather than answering as though it had read everything. Above the raw findings sits a value-of-information ranking that decides what to fix first, feeding a review queue whose confirmations and corrections recalibrate the confidence scoring underneath. The two surfaces pointing in the opposite direction, an MCP connector letting external assistants call ZigoTrace's own scoring and gap tools, and a terminal agent driving the same ingest commands, both keep a confirmation prompt on every command, so nothing skips a gate a human would otherwise hit. It is worth noting that MCP, the Model Context Protocol, became a vendor-neutral standard when it was donated to the Agentic AI Foundation under the Linux Foundation in December 2025 [9], which makes being callable by someone else's agent a durable design choice rather than a bet on one vendor. Why two 2026 deadlines turn the agent's own log into part of the filing Two regulations arriving within five months of each other are about to make the agent's record of its own work part of the deliverable rather than an engineering nicety. The EU AI Act's record-keeping obligation requires high-risk AI systems to technically allow automatic logging of events across the system's lifetime, in full application from 2 August 2026, with deployers separately obliged to retain those logs for at least six months [10]. Non-compliance carries a penalty of up to 15 million euro or 3 percent of global annual turnover, whichever is higher, although the timing is not entirely settled: the Digital Omnibus agreement would defer stand-alone Annex III systems to 2 December 2027, and no finalised technical standard for Article 12 logging yet exists, with prEN 18229-1 and ISO/IEC DIS 24970 both still in draft [11]. In parallel, large operators and traders must comply with the EU Deforestation Regulation from 30 December 2026 under the revision adopted in December 2025, filing a Due Diligence Statement through the EU TRACES system before placing a covered commodity on the market [12][13]. Read together, the two deadlines describe a single requirement: an agent that participates in assembling a regulatory filing must be able to show what it read, what it called, and what it could not determine. A system that cannot produce that account is not merely under-documented, it is unusable upstream of the filing, because a fabricated pass anywhere in the chain would underwrite a false statement submitted to a regulator. This is why the constraint governing every layer described above, that a tool which cannot answer must never produce a verdict, is enforced on the non-language tools as well as on the model, and why a provider without credentials or a satellite pass obscured by cloud returns an inconclusive result rather than a guessed clear one. Whether scoping is a durable principle or a temporary workaround remains open Yet, it remains to be seen whether tight scoping is a permanent principle of agentic workflow design or an accommodation to the models currently available. The honest position is that the case for narrowing rests on benchmarks and production telemetry rather than on a settled result, and that some of what looks like architectural wisdom today may simply be compensation for context handling that improves in two model generations. ZigoTrace's own stack reflects that uncertainty rather than papering over it: the deterministic detection layer and the confidence-fusion layer are in production, while the trained-model layer and the next-best-action ranking are built but not yet validated against customer data, having been tested only on synthetic gaps, and the automated public nature-database sources on the biodiversity side report as not connected because a licence review is outstanding. Gartner, for its part, expects roughly 15 percent of day-to-day work decisions to be made autonomously by 2028, up from effectively none in 2024, and a third of enterprise software to carry agentic capability by the same year [2]. If that holds, the organisations positioned to use it will likely be the ones that spent this period deciding what their agents are not allowed to do, since a workflow that has already defined its steps, its tools, and its escalation paths can safely be given more autonomy later, while one that never defined them has nothing to loosen. Book a demo to see how ZigoTrace scores what your existing records can actually prove. References Databricks, "State of AI Agents 2026," January 2026. Gartner, "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027," press release, 25 June 2025. MIT Media Lab Project NANDA, "The GenAI Divide: State of AI in Business 2025." Xu, F. et al., "TheAgentCompany: Benchmarking LLM Agents on Consequential Real World Tasks," arXiv:2412.14161, NeurIPS 2025 Datasets and Benchmarks Track. The Register, "AI agents get office tasks wrong around 70% of the time," 29 June 2025. Berkeley Function Calling Leaderboard tool-count result, as reported in the agent tool-selection literature, 2026. "How Many Tools Should an LLM Agent See? A Chance-Corrected Answer," arXiv:2605.24660. Anthropic, "Building Effective Agents," engineering guidance. Model Context Protocol, governance transfer to the Agentic AI Foundation under the Linux Foundation, December 2025. Regulation (EU) 2024/1689 (EU AI Act), Article 12 (record-keeping) and Article 26 (deployer log retention). Help Net Security, "What the EU AI Act requires for AI agent logging," 16 April 2026. Council of the European Union, "Deforestation: Council signs off targeted revision to simplify and postpone the regulation," December 2025. European Commission, Access2Markets, "Delay until December 2026 and other developments in the implementation of the EUDR Regulation." Frequently asked questions What is an agentic AI workflow? An agentic AI workflow is a process in which a language model plans across multiple steps, calls real tools that change the state of a business system, and escalates what it cannot complete, rather than only generating text in reply to a prompt [8]. Anthropic distinguishes this from a fixed workflow, where the sequence of steps is defined in code and the model fills specific roles within it [8]. Why do most agentic AI projects fail? Gartner attributes the projected cancellation of more than 40 percent of agentic AI projects by the end of 2027 to escalating costs, unclear business value, and inadequate risk controls, not to model capability [2]. Benchmark evidence supports the same reading: even leading models complete only about 30 percent of long-horizon professional tasks autonomously [4]. Does giving an AI agent more tools make it more capable? No. Tool-selection accuracy degrades as the visible tool list grows, with one widely reported leaderboard result showing a fall from 43 percent to 2 percent as the tool count went from four to fifty-one [6]. Scoping an agent to a small, task-specific tool registry is currently the more reliable design [7]. What do the 2026 regulations require of AI used in compliance work? The EU AI Act requires high-risk systems to support automatic event logging across their lifetime from 2 August 2026, with deployers retaining logs for at least six months [10]. Separately, EUDR large operators must file Due Diligence Statements from 30 December 2026 [12][13], which means any agent involved in assembling that filing has to be able to show what it read and what it could not determine.