Bounded Autonomy, Runtime Governance, and the Enterprise Diffusion Gap

The core shift across 8 talks

Outside software engineering, enterprise agents remain near 5% production adoption not for lack of raw model intelligence, but because non-deterministic workers require institutional trust infrastructure—automatic registries, build-time policy DAGs, risk-tiered entitlements, and opinionated workflows—between reckless autonomy and paralyzing lockdown.

Tenex quantified the conference's starkest macro reality: across roughly 100 large enterprises, general-purpose LLM access sits near 90% and coding agents near 50%, yet autonomous agents in non-engineering business workflows sit around 5%. Anthropic, Apollo, GEICO, Basis, and Apify all traced that diffusion gap to governance, process, and trust friction rather than model IQ—with Apify showing that even after eighteen months of agent payment standards, 30-day volume sits near $1M on x402 and $1,500 on MPP because static API keys, untrusted endpoints requiring marketplace middlemen, and deferred-settlement double-spend risks dominate the funnel. The architectural remedy across regulated firms was bounded autonomy: Two Sigma replaces months-long manual review queues and rubber-stamp approval fatigue with automatic framework registration, risk-scored scrutiny, registry-compiled runtime entitlements, and conservative classifiers that escalate only ambiguous calls; Coinbase separates build-time normative policy ('the original institutional system prompt') from mutating runtime state inside compliance DAGs; Basis encodes opinionated, auditable tax and accounting workflows rather than 'Move 37' creativity; and Anthropic scopes financial agents with least-privilege identities and deterministic hooks gated on advisor or SME sign-off. Qualifying this optimism, Daytona showed that host-level policy allowlists collapse if an interpreter command is permitted, while GEICO's one-day war rooms proved outer-loop enterprise inertia can be broken when decision-makers sit inside the loop.

“And then, if you just have policy documents that you just look at, or that are part of your specification for the prompts, that's also not very forceful at runtime. You can't guarantee that will be part of the enforcement controls.”John Feminella · Balancing Acceleration and Safety for AI Agents · 00:05:13

Why non-coding enterprise agents sit at 5%: process, trust, and payment friction

In Process Supervision for Agents That Do Long-Horizon Work (00:17:21), Mitchell Troyanovsky argued that enterprise diffusion depends on predictable, repeatable execution calibrated to blast radius rather than 'Move 37' creative novelty, because organizations scale output through standardized workflows their teams can audit and trust. In Process Supervision for Agents That Do Long-Horizon Work (00:03:42), Mitchell Troyanovsky argued that general-purpose coding-style agent products fail to raise enterprise-wide productivity because pushing prompt, memory, and workflow management onto end users creates both a user competency gap and an unstandardized process gap.

In Process Supervision for Agents That Do Long-Horizon Work (00:06:10), Mitchell Troyanovsky argued that open-ended agents produce inconsistent outputs unless builders encode explicit domain opinions—such as checking primary tax sources or visually inspecting generated slides—while explicitly trading off accuracy against latency. In AI in Practice: An Inside Look at Apollo's Approach (00:11:07), Michael Manapat, Jack McDonald argued that institutional banking and asset management remain early on the AI adoption curve because off-the-shelf research summarization delivers low value compared to automating complex middle- and back-office data workflows.

In Agents can pay. So why don’t they? (00:17:02), Jan Curn argued that variable pay-per-use compute jobs cannot use naive deferred-settlement 'up-to' payment schemes because buyers can double-spend wallet funds before on-chain settlement, forcing providers toward upfront overcharge-and-refund workarounds or on-chain escrow with batch settlement. In Agents can pay. So why don’t they? (00:04:45), Jan Curn argued that despite more than a dozen competing agentic payment protocols launching over eighteen months, actual 30-day on-chain settlement volume is negligible at roughly $1 million on Coinbase's x402 and $1,500 on Stripe's MPP.

In Agents can pay. So why don’t they? (00:07:35), Jan Curn argued that agentic payment protocols lose today not to card rails directly, but to pre-provisioned SaaS accounts and static API keys billed to a developer's credit card, which are far simpler when tool needs are known upfront. In Agents can pay. So why don’t they? (00:13:19), Jan Curn argued that because autonomous agents cannot verify whether an arbitrary external endpoint will deliver promised results or honor pricing, paid tool discovery relies on curated connector directories and marketplaces acting as trust intermediaries.

In Welcome Back - Featured Keynotes (00:02:29), Alex Lieberman argued that enterprise diffusion drops by 30 percentage points between provisioning an LLM (90%) and formally training employees to apply those AI surfaces in daily workflows (~60%). In Welcome Back - Featured Keynotes (00:02:29), Alex Lieberman argued that autonomous agents running in non-engineering business functions sit at roughly 5% enterprise adoption, defining a 12-to-36-month diffusion frontier alongside open-source versus fine-tuned model selection and scaling AI engineer hiring.

In Welcome Back - Featured Keynotes (00:02:29), Alex Lieberman argued that roughly 50% of surveyed large enterprises have deployed coding agents inside software engineering and product workflows, making software delivery the leading production agent beachhead. In Welcome Back - Featured Keynotes (00:02:29), Alex Lieberman argued that across roughly a hundred large enterprises Tenex advises in financial services, healthcare, and industrials, foundational employee access to a general-purpose LLM has reached about 90% penetration.

“Nobody wants their agent to move thirty-seven their tax return. They want it done reliably at scale in a way that they can trust, and in a way that their people know how to work with.”Mitchell Troyanovsky · Process Supervision for Agents That Do Long-Horizon Work · 00:17:21

“The first problem is that there is a competency gap, because agents, as you think of them as you think of them today, they outsource the complexity to the user.”Mitchell Troyanovsky · Process Supervision for Agents That Do Long-Horizon Work · 00:03:42

“Not because the process it did was bad, but because the process it did was not opinionated.”Mitchell Troyanovsky · Process Supervision for Agents That Do Long-Horizon Work · 00:06:10

• Mitchell Troyanovsky: Enterprise diffusion depends on predictable, repeatable execution calibrated to blast radius rather than 'Move 37' creative novelty, because organizations scale output through standardized workflows their teams can audit and trust.
• Mitchell Troyanovsky: General-purpose coding-style agent products fail to raise enterprise-wide productivity because pushing prompt, memory, and workflow management onto end users creates both a user competency gap and an unstandardized process gap.
• Mitchell Troyanovsky: Open-ended agents produce inconsistent outputs unless builders encode explicit domain opinions—such as checking primary tax sources or visually inspecting generated slides—while explicitly trading off accuracy against latency.
• Michael Manapat, Jack McDonald: Institutional banking and asset management remain early on the AI adoption curve because off-the-shelf research summarization delivers low value compared to automating complex middle- and back-office data workflows.

Automatic registries, risk-tiered entitlements, and five-layer foundations

In Anthropic: Accelerating frontier AI in Financial Services. (00:09:35), Belinda Neal, Keon Shahab argued that production financial agents enforce operational safety through least-privilege role identities, deterministic hook guardrails, and sandboxed write boundaries where agents can only propose booking amendments that a human SME must approve before execution. In Anthropic: Accelerating frontier AI in Financial Services. (00:01:32), Belinda Neal, Keon Shahab argued that model intelligence is no longer the primary constraint in financial services, shifting the strategic bottleneck from proving individual agent capabilities to building reusable infrastructure that scales deployments from one-by-one builds to many.

In Anthropic: Accelerating frontier AI in Financial Services. (00:15:33), Belinda Neal, Keon Shahab argued that anthropic applied this shared-foundation pattern at the industry level for wealth management by combining twenty-five pre-built custody, CRM, and portfolio connectors with eight open-source workflow skills gated on mandatory advisor approval. In Balancing Acceleration and Safety for AI Agents (00:07:48), John Feminella argued that instead of blocking teams behind an onerous pre-registration gate that drives experimentation into ungoverned shadow IT, approved agent frameworks automatically record each agent's owner, product, declared tools, and endpoints in a central registry.

In Balancing Acceleration and Safety for AI Agents (00:10:00), John Feminella argued that applying uniform manual review to every agent stalls low-risk experiments and drowns reviewers in trivial requests, so governance queues must be risk-scored based on each purpose-built agent's declared tools and target systems. In Balancing Acceleration and Safety for AI Agents (00:11:58), John Feminella argued that managed agent runtimes avoid blunt firm-wide allowlists by querying the agent registry at initialization time and compiling each agent's declared tool, host, and resource entitlements into enforceable runtime boundaries.

In Balancing Acceleration and Safety for AI Agents (00:16:32), John Feminella argued that asking humans to approve every agent action induces rubber-stamp review fatigue, so production runtimes should handle clear rules via deterministic fast paths and filter routine calls with independent conservative classifiers, escalating only genuinely ambiguous actions.

“Once they approve, then that amendment will be made, and the change will be applied. Guardrails, deterministic guardrails, called hooks around your agent, so that it's never overreaching beyond what you'd like it to do within its confines.”Keon Shahab · Anthropic: Accelerating frontier AI in Financial Services. · 00:09:35

“And our opportunity here is scale — is not the model, our opportunity here is scale, is building the foundation for agents that can go one to many.”Belinda Neal · Anthropic: Accelerating frontier AI in Financial Services. · 00:01:32

“We built a plugin that is available on GitHub that builds eight skills and workflows that an advisor can take out of the box, use today, and implement tomorrow. Layer four approval, the advisor proves everything that comes out of Claude.”Belinda Neal · Anthropic: Accelerating frontier AI in Financial Services. · 00:15:33

• Belinda Neal, Keon Shahab: Production financial agents enforce operational safety through least-privilege role identities, deterministic hook guardrails, and sandboxed write boundaries where agents can only propose booking amendments that a human SME must approve before execution.
• Belinda Neal, Keon Shahab: Model intelligence is no longer the primary constraint in financial services, shifting the strategic bottleneck from proving individual agent capabilities to building reusable infrastructure that scales deployments from one-by-one builds to many.
• Belinda Neal, Keon Shahab: Anthropic applied this shared-foundation pattern at the industry level for wealth management by combining twenty-five pre-built custody, CRM, and portfolio connectors with eight open-source workflow skills gated on mandatory advisor approval.
• John Feminella: Instead of blocking teams behind an onerous pre-registration gate that drives experimentation into ungoverned shadow IT, approved agent frameworks automatically record each agent's owner, product, declared tools, and endpoints in a central registry.

Build-time policy DAGs and breaking outer-loop inertia

In Inside the Fable War Room (00:00:00), Ford Prior argued that although coding agents have collapsed inner-loop coding time and offloaded routine patch work, major enterprise architecture changes remain bottlenecked by the outer loop of cross-functional alignment, risk governance, and decision-making. In Trusting Agents in Policy-Driven Workflows (00:02:29), Evan Kormos argued that in enterprise governance, agents act as a cross-cutting operational model spanning people, process, and technology simultaneously—collaborating with human staff, executing workflow steps directly, and operating within explicit process boundaries.

In Trusting Agents in Policy-Driven Workflows (00:00:18), Evan Kormos argued that regulated systems must architecturally separate build-time policy definition from the run-time production system, which mutates continuously through product changes while remaining bound by policy constraints. In Trusting Agents in Policy-Driven Workflows (00:00:18), Evan Kormos argued that written enterprise and risk-compliance policy—expressed through normative must, may, and should rules—functions as the organization's foundational system prompt governing how operational decisions are made.

“So while we've seen this interloop speed up to use Jean Kim's concept, we find ourselves seemingly stuck within the bounds of this outer, which is to say, everything that happens other than the current moment.”Ford Prior · Inside the Fable War Room · 00:00:00

“So I see them as an operational model cutting across all three. They work with people, execute parts of the process themselves, and they use and are made up of technology.”Evan Kormos · Trusting Agents in Policy-Driven Workflows · 00:02:29

“Everything is expected to still be roughly bound by policy, but ultimately, we separate this from the run state and the build state.”Evan Kormos · Trusting Agents in Policy-Driven Workflows · 00:00:18

• Ford Prior: Although coding agents have collapsed inner-loop coding time and offloaded routine patch work, major enterprise architecture changes remain bottlenecked by the outer loop of cross-functional alignment, risk governance, and decision-making.
• Evan Kormos: In enterprise governance, agents act as a cross-cutting operational model spanning people, process, and technology simultaneously—collaborating with human staff, executing workflow steps directly, and operating within explicit process boundaries.
• Evan Kormos: Regulated systems must architecturally separate build-time policy definition from the run-time production system, which mutates continuously through product changes while remaining bound by policy constraints.
• Evan Kormos: Written enterprise and risk-compliance policy—expressed through normative must, may, and should rules—functions as the organization's foundational system prompt governing how operational decisions are made.

Where speakers pushed back and drew the boundary

No operational pattern at AI Engineer NYC went unqualified. Across the corpus, 2 counter-claims pushed back on naive versions of this shift—highlighting where judges introduce variance, where caches break, or where human judgment stays irreducible.

“the agent used some interesting process to find and distill data to figure out that we can connect a couple dots and save ourselves eight and a half thousand calls per month by giving the customer up-to-date rental information.”Ford Prior · Inside the Fable War Room · 00:05:09

“when you allow your cloud agent to run Python command with Python dash C, he can literally open any sockets, modify a file system, execute code, or do basically everything”Mislav Ivanda · Give the Model a Computer: The One Thing Every AI Agent Framework Agrees On · 00:03:28