Four Operating Model Decisions To Define Your AI Agent Strategy

Agents that can plan, decide, execute, and adapt are now operating inside workflows, processes, and reporting structures that were designed exclusively for human workers. The assumptions embedded in those structures, that a person holds decision authority, that roles have defined boundaries, that work moves sequentially, and that trust is earned through individual judgment, are being tested in ways most mid-market organizations have not yet confronted.

McKinsey’s 2026 research outlines four foundational rules that every company should understand before integrating AI or agents into their ecosystem. Organizations, they argue, were built on the understanding that: humans control decisions, roles are clearly defined, workflows are sequential, and trust is rooted in human judgment. Agentic AI challenges every one of those rules simultaneously. For mid-market leaders responsible for risk, performance, and accountability, the implication is direct: the operating model needs attention before the next deployment does. 

Rule #1: humans hold decision rights.

In most organizations, authority flows through a defined hierarchy. A manager approves a purchase order. A director signs off on a campaign. A CFO authorizes a capital expenditure. When an AI agent executes a decision, even a routine one, the question of who authorized that decision becomes ambiguous. The agent did not seek approval, it simply followed its instructions. If the outcome is favorable, no one asks questions. If the outcome creates a problem, everyone asks the same question at the same time: who was responsible for that? 

Rule #2: roles are clearly defined.

Organizations assign responsibilities to people. Job descriptions, reporting lines, and performance reviews all assume a human occupies the role. Agents do not fit this model. They operate across functional boundaries, handle tasks that span multiple departments, and often perform work that no single role description anticipated. The result is that agents create activity without clear ownership, and ownership gaps become accountability gaps. 

Rule #3: workflows are sequential.

Most business processes were designed with the assumption that one step finishes before the next begins. A human completes a review, sends it to the next person, and that person begins their work. Agents do not wait. They execute in seconds what previously took days. When an agent moves faster than the review cadence it operates within, the controls built into that workflow become irrelevant. Weekly stand-ups cannot govern a process that executes fifty times between meetings. 

Rule #4: trust is built on human judgment.

Organizations have historically trusted experienced individuals to make sound decisions in ambiguous situations. That trust was personal and earned over time. Agents do not earn trust in the same way. They follow instructions, and the quality of their decisions depends entirely on the constraints, data, and guardrails they were given. Trust must shift from the individual to the system. That is a fundamentally different leadership challenge. 

Enterprise organizations are beginning to address these challenges by building formal governance infrastructure: model risk committees, AI ethics boards, documented escalation paths, and dedicated oversight roles. They have the resources and the regulatory pressure to invest in those structures early. 

Mid-market organizations typically do not have those resources, and that creates a specific kind of vulnerability. The same leaders who are responsible for strategy, operations, finance, and technology are also the ones who would need to design and implement agent governance. There is no separate team to hand it off to. The COO managing operations is the same person who needs to define how agents interact with those operations. The CFO overseeing financial controls is the same person who needs to determine how agents touch financial processes. Over-full schedules likely don't allow the time for department leadership to research the skills needed to create and implement these guidelines. This is where partnering with a team of experts comes in. 

Consider a mid-market manufacturer that deploys an agent to manage inventory replenishment. The agent monitors stock levels, analyzes demand signals, and triggers purchase orders automatically. In a well-governed environment, decision thresholds are documented, approval requirements are defined for orders above a certain value, and exception handling is built into the workflow. Alternatively, in an environment where the agent was deployed to solve an immediate efficiency problem without operating model adjustments, the agent may execute purchase orders that no human reviewed, commit spend that no budget holder approved, or create supplier obligations that no procurement leader authorized. The technology worked correctly. The operating model did not account for it. 

A similar pattern appears in healthcare organizations where agents interact with patient scheduling, billing, or records management. The agent follows its logic, but if the workflow was designed for a human to review a flag before an action is taken, and the agent bypasses that review because no one configured it to pause, the compliance exposure is real even though the agent did what it was told. 

These are not edge cases. They are the natural result of deploying capable technology into structures and workflows that lack appropriate guidelines and governance. The underlying risk is that agents succeed at doing exactly what they were configured to do, inside an organization that did not prepare for what that means.

Addressing this challenge does not require a complete organizational overhaul, but focused attention on the four specific areas that correspond to the foundational rules. 

Redefine decision rights.  

Every process that an agent touches needs a documented answer to a straightforward question:  

• Who owns the outcome of this decision?  

• If the agent triggers a financial transaction, who is accountable for the accuracy and appropriateness of that transaction?  

• If the agent sends a communication to a customer, who is responsible for the content and timing of that communication?  

Decision rights cannot remain implicit when agents are involved. They must be explicit, documented, and reviewed regularly. This is a governance exercise that belongs on the leadership agenda. 

Redesign role definitions.  

When agents absorb routine execution, the human role changes. The value a person brings shifts toward supervision, exception handling, judgment in ambiguous situations, and quality assurance of agent outputs. Those are meaningfully different skills than the ones most role descriptions emphasize today. Organizations that do not update role definitions, performance expectations, and development plans to reflect this shift will find themselves with teams that are unclear about what they are supposed to do and how their performance is measured. A financial analyst whose reporting work is now handled by an agent needs to understand that their value lies in interpreting the reports, identifying anomalies, and making recommendations, not in producing the spreadsheet. 

Rearchitect workflow design.  

Sequential, human-paced workflows cannot govern agent-speed execution. Slowing agents down to human pace eliminates the value of deploying them. The solution is redesigning workflows with intentional human checkpoints at decision-critical moments. Not every step needs a human review, but the steps where judgment, context, or accountability matter need clearly defined intervention points. This requires leadership teams to examine existing processes with a new lens: not "how does this work today?" but "where in this process does a human need to remain involved, and why?" 

Rebuild accountability frameworks.  

Most organizations cannot currently answer a simple question: if our agent made a wrong decision, who is responsible? Legal, financial, ethical, and reputational accountability all converge on this question, and the answer cannot be "the agent." Accountability must trace back to a person or a function that owns the agent's scope, constraints, and outcomes. Boards and audit committees are already beginning to ask these questions. The organizations that can answer them clearly will maintain confidence. The ones that cannot will face uncomfortable scrutiny when something goes wrong. 

The operating model decisions made in the next twelve to twenty-four months will compound in ways that are difficult to reverse. Agents introduced into structures with unclear ownership and weak guardrails create technical and organizational debt. That debt surfaces over time and shows up when…

…an agent decision produces an unexpected outcome

…an audit reveals an uncontrolled process

…a board member asks a question that no one can answer. 

If those decisions about ownership and guardrails are deferred, each new agent deployment adds complexity without governance. A business in early deployment may move faster in the short term but accumulates exposure that becomes progressively harder and more expensive to address. By the time leadership recognizes the problem, the remediation effort is significantly larger than the governance effort would have been. 

This pattern repeats across industries, with more or less complexity depending on their relative rules and regulations already in place. Organizations that establish a thoughtful agent operating model now will have a structural advantage that allows them to both move quickly and scale with confidence.  

What makes building out an agentic AI operating model particularly challenging is that it does not belong to a single function. IT often owns the deployment. Operations owns the workflow. Finance owns the budget. Legal owns the risk. Human resources owns the role definitions. No single function owns the agent itself, and no single function can redesign the operating model alone, meaning an integrated perspective is now essential. Organizations that treat agent governance as a technology problem will miss the process, financial, and human dimensions. Organizations that treat it as a process problem will miss the technology constraints and financial implications. The challenge requires a cross-functional and cross-departmental approach that connects how agents interact with systems, how those interactions affect operations, how the financial controls accommodate agent activity, and how people's roles evolve alongside the technology. 

This is why KDG approaches agentic AI as an operating model challenge, not as a standalone technology implementation. The work is not limited to selecting tools or configuring automations. It requires understanding where the business is trying to create value, how work currently moves through the organization, which decisions require human judgment, what data the agent relies on, and how accountability should be preserved as execution becomes more automated. Technology is only one part of the system and cannot be separated from the business structure it is expected to serve.