Agentic AI: The Promise and the Peril of AI That Acts

For three years we talked about AI that answers. Now the industry has fallen in love with AI that acts - so-called agentic AI, systems that do not just reply to a prompt but pursue goals across multiple steps, call tools, browse, write to databases and take real actions in the world with limited human supervision. The promise is enormous. So is the peril, and it is far less discussed. My thesis: agentic AI is the most important and the most oversold trend in the field right now, and the winners - especially in Africa - will be the ones who deploy it narrowly, wrap it in hard guardrails, and refuse to hand it autonomy it has not earned.

What an AI agent actually is

A normal chatbot is a conversation. You ask, it answers, the loop ends. An agent is given a goal and a set of tools, and it decides its own sequence of steps to reach that goal. Tell it reconcile these invoices and flag discrepancies and it might read files, query a system, do calculations, and write results back - looping and self-correcting along the way, with the human stepping in only at checkpoints, or sometimes not at all.

That shift from answering to acting is what makes agents powerful and what makes them dangerous. An agent that hallucinates does not just give you a wrong sentence. It can take a wrong action - send the email, approve the payment, delete the record. And unlike a human employee, it can do so hundreds of times in a minute, across every system it can reach, before anyone notices something is off. Speed and scale are the whole point of automation, but they are also what turns a small reasoning error into a large operational one.

The hype is real, and so is the money

This is not a fringe experiment. Gartner has projected that as many as 40% of enterprise applications will include task-specific AI agents by the end of 2026. In a Deloitte survey from late 2025, the share of companies planning to deploy agentic AI moderately or more extensively within two years jumped to 74%, up from 23%. The capital and the corporate attention are unmistakably real.

But look at the same surveys more closely and the gap appears. In one, while most organisations planned to deploy agents, only around 29% felt prepared to secure those deployments. An IDC study found two-thirds of firms said their teams needed more skills to adopt agents, and a majority named lack of skilled personnel as the top obstacle. Everyone is running. Very few are ready.

The perils, named plainly

Security researchers have converged on a clear list of what goes wrong when you give software autonomy. OWASP and others highlight a recognisable set of threats:

• Goal hijacking. A malicious instruction hidden in a document or web page redirects the agent's objective - prompt injection with real-world consequences.
• Tool misuse. The agent uses a legitimate capability in a harmful way, at machine speed, before anyone notices.
• Identity and privilege abuse. Agents accumulate access - "privilege drift" - and traditional identity systems were never designed for non-human actors that act on their own.
• Shadow agents and broken delegation. Agents spawn or call other agents, and errors or attacks propagate quickly across interconnected systems, amplifying a small mistake into a large incident.

An agent is software you have chosen not to fully supervise. Every ounce of autonomy you grant is an ounce of control you give away. Grant it deliberately, never by default.

The guardrails that matter

Governance is racing to catch up. In January 2026, Singapore's IMDA launched what has been described as the first governance framework built specifically for agentic AI. The single most useful principle to come out of this work is what OWASP calls Least-Agency: give an agent only the minimum autonomy required for its specific task, and no more. It is the AI version of least-privilege, a discipline security engineers have trusted for decades.

In practice, that means:

1. Scope the agent tightly. One narrow job, a small set of tools, clear boundaries. Do not build a do-everything agent.
2. Keep a human in the loop for consequential actions. Reading and drafting can be autonomous. Sending money, deleting data, or contacting customers should require a human confirmation until trust is earned.
3. Give every agent its own identity and least-privilege access. Treat agents as first-class actors in your security model, with audit logs, not as anonymous scripts.
4. Sandbox and test against injection. Assume any document or web page the agent reads may try to hijack it, and test for exactly that.
5. Log everything and monitor for drift. You cannot govern what you cannot see.

Realistic near-term uses, especially for Africa

Strip away the science fiction and agents are genuinely useful today in bounded, low-stakes, high-volume work. For African businesses I would look first at:

• Customer support triage - an agent that reads a query, pulls the relevant record, drafts a response and routes anything uncertain to a human.
• Back-office reconciliation - matching invoices, flagging anomalies, preparing summaries for a person to approve.
• Research and monitoring - gathering and summarising information across sources, where a wrong step costs nothing.
• Developer assistance - agents that write, test and fix code inside a controlled environment where output is reviewed before it ships.

Notice the pattern: high volume, bounded scope, and a human owning any irreversible decision. That is where agents pay off now. The fantasy of a fully autonomous digital employee running your operations unsupervised is exactly that - a fantasy, and a liability.

The African angle

There is a real opportunity here. Agentic AI can help small African teams punch far above their headcount, automating the administrative drag that keeps founders from building. But two cautions are specific to our context. First, the skills gap is acute - if firms in richer markets say they lack the people to secure agents safely, the shortage is sharper here, which makes narrow, well-governed deployments even more important than ambitious ones. Second, the temptation to buy an expensive "autonomous" platform before you have the processes, data or oversight to use it safely is strong, and it is a direct route to wasted capital. This is precisely the pattern I warn about when I tell founders not to be pressured into buying AI before your business is ready.

Agentic AI is coming, and it will be genuinely transformative for those who handle it with respect. The organisations that win will not be the ones that gave their agents the most freedom. They will be the ones that gave their agents the least freedom necessary to do real work - and kept a firm human hand on everything that cannot be undone.