The conversation around AI has moved quickly.
We started with chat interfaces. Then came copilots. Today, the focus is increasingly on agents: systems that can take actions, complete tasks, interact with software, and perform work on behalf of people.
Most discussions stop there.The assumption is that once agents become capable enough, organisations will simply deploy them and productivity will follow.
For enterprise legal operations, compliance teams, financial services organisations and law firms, that is only half the story.
The real challenge is not whether an AI agent can do work.
It is whether that work can be governed.
The enterprise AI gap
Many AI tools still operate outside the systems where work actually happens.
A lawyer might use an AI assistant to analyse a contract. An operations team might use an AI tool to summarise a case. A compliance analyst might ask a model to review documentation.
Useful? Absolutely.
Governed? Often not.
The work frequently sits outside established workflows, outside existing permissions models, outside audit trails, and outside the systems responsible for managing risk and accountability.
That creates a growing disconnect.
As AI capabilities become more powerful, organisations need more than intelligence. They need control.
They need to know:
- Which agent accessed which data
- What permissions it had
- What actions it took
- Why those actions were taken
- Whether those actions complied with policy
- How decisions can be reviewed later
Without those answers, AI remains difficult to operationalise at scale.
From AI tools to AI work
I believe the next phase of enterprise AI adoption will not be defined by better chat interfaces or more sophisticated models.
It will be defined by the ability to embed AI directly into governed business processes.
That means connecting agents to structured records, workflows, documents, tasks and operational data.
It means allowing agents to participate in work rather than simply commenting on it.
Most importantly, it means ensuring that every action remains subject to the same controls, permissions and oversight that organisations already expect from human users.
In legal operations, for example, an agent should be able to:
- Review an intake request
- Identify missing information
- Update structured records
- Draft documentation
- Create follow-up tasks
- Escalate exceptions
- Support lawyers through high-volume process work
But it should do so within an environment that maintains accountability, security and auditability.
The goal is not autonomous AI. The goal is governed AI-enabled work.
Why governance becomes more important as agents become more capable
There is an assumption in some parts of the market that governance slows innovation.
In reality, governance is what enables adoption.
The more capable an agent becomes, the more important governance becomes.
An agent that only answers questions presents one level of risk.
An agent that can update client records, trigger workflows, generate documents and complete tasks presents another.
Enterprise organisations are not looking for unrestricted autonomy.
They are looking for controlled delegation.
They want agents that can operate within defined boundaries, under clear authority, with complete visibility of outcomes.
This is particularly true in regulated industries where confidentiality, privilege, client obligations and operational risk cannot be compromised.
MCP and the future of enterprise AI
This is why Model Context Protocol (MCP) is attracting so much attention.
MCP provides a standardised way for AI agents to interact with enterprise systems and perform meaningful work.
But connecting an agent to a system is only the starting point.
The real value comes from what sits behind that connection:
- Authentication
- Permissions
- Process controls
- Data governance
- Auditability
- Operational oversight
In other words, governance.
As organisations move from experimentation to deployment, these capabilities will become increasingly important.
The winners in enterprise AI will not simply be the organisations with access to the most advanced models.
They will be the organisations that can safely operationalise those models inside their business processes.
The conversation we should be having
The industry is understandably excited about agents.
We should be.
The potential is enormous.
But we should spend less time asking what agents can do, and more time asking how organisations can govern the work they perform.
Because ultimately, AI will not create value simply by being intelligent.
It will create value when it can participate in real work, within real processes, under real governance.
That is where enterprise adoption happens.
And that is where the next chapter of AI begins.
