53% of developers in Southeast Asia and India report agents in production, but only 38% call their codebase ready for autonomy. Here is the pre-deployment gate that closes that gap — seven artefacts, each with a pass/fail test.
Last Updated: September 24, 2026
Agoda's AI Developer Report 2026 found 53% of surveyed developers across Southeast Asia and India already have agents in production or broad use, while only 38% consider their codebase ready for full autonomy. That 15-point gap is the whole story. Readiness is not a culture score — it is seven artefacts you can either produce on demand or you cannot: a tool-scope inventory, an agent identity and credential model, an eval suite with regression thresholds, a rollback and compensating-action design, a human-escalation SLA, an audit trail schema, and a data-residency map. Each has a pass/fail test you can run in a day. Some workloads stay blocked in 2026 regardless of your score.
The 53/38 gap is the only readiness metric that matters
Agoda published its AI Developer Report 2026 this morning, drawing on developers across Indonesia, Malaysia, Thailand, the Philippines, Singapore, Vietnam and India. The headline numbers: 53% say AI agents are already used in selected production workflows or broadly across the organisation, 28% name cost as the primary barrier to wider adoption ahead of integration complexity (24%) and lack of governance (19%), and 79% still require human approval for production deployment. Only 38% describe their codebase as mostly or fully ready for a fully autonomous agent.
Read those two numbers together. A majority have shipped agents into production workflows. A minority believe the substrate those agents act on is ready for them. That is not a maturity curve, it is a deployment decision being made ahead of the evidence — and the same week's data from two other directions says the same thing. EY's AI Risk and Governance Survey, fielded among 202 senior AI executives at US companies above $1bn revenue, found 91% using agentic AI in pilot or full deployment while 49% of those had not yet updated their governance framework to include agentic requirements at all. Cisco and Omdia's survey of 1,000 IT and network operations leaders, out yesterday, found 51% already run agentic AI that acts in production and 24% are comfortable with agents acting under no human oversight.
The 47% figure is the one to sit with. Nearly all of those executives — 98% — report having formal AI governance policies. Half of them have waived the policy when the deployment was urgent. A readiness framework that can be waived under deadline pressure is decoration. What survives pressure is an artefact someone has to produce before a deploy key works.
Seven artefacts, each with a test you can run in a day
Maturity models score you on strategy, culture and talent. None of those stop a bad tool call. The gate below is deliberately mechanical: for each artefact, either the named person can produce it in under an hour, or the workload does not go live. We use this shape on agent builds because it converts an argument about risk appetite into a checklist with owners.
| Artefact | Pass/fail test (one day) | What failing looks like in production |
|---|---|---|
| Tool-scope inventory | Print every tool the agent can call, with the exact write scope of each and the blast radius of the worst single call. Any tool you cannot classify as read, reversible-write or irreversible-write fails. | An agent reaches a write endpoint nobody remembered was exposed on the same MCP server as the read tools it was given for context. |
| Agent identity and credential model | Answer: whose identity does the agent act under, where is the token minted, how long does it live, and can you revoke one agent without revoking the fleet? Shared service accounts fail. | You detect anomalous activity and the only kill switch available also takes down six other workloads using the same credential. |
| Eval suite with regression thresholds | Run the suite on a deliberately degraded prompt or a smaller model and confirm it goes red. An eval suite that never fails is not measuring anything. | A model or prompt update ships, quality drops on a long tail of cases, and nobody notices for weeks because the happy path still passes. |
| Rollback and compensating-action design | For each irreversible-write tool, name the compensating action and who is authorised to fire it. If the answer is 'we would contact the customer', that tool is not cleared. | The agent completes step four of six, fails, and leaves a half-finished state that no single system owner can unwind. |
| Human-escalation SLA | Fire a synthetic escalation at 02:00 local and measure time to human acknowledgement. No named rota, no pass. | Escalations queue into a Slack channel nobody owns overnight, and the agent's pending actions expire or auto-approve. |
| Audit trail schema | Reconstruct one complete agent run from logs alone: inputs, retrieved context, tool calls with arguments, model version, decision, actor. If you need the vendor console to do it, fail. | A regulator or a customer asks why a decision was made and the trace has the outcome but not the inputs or the model build. |
| Data-residency map | Draw where every byte the agent touches is processed, including model inference, embeddings, vector store, traces and eval datasets. Traces and evals are where this fails. | Prompts containing personal data are fine, but the observability pipeline silently ships the same payloads to a region you are not permitted to use. |
Two of these are new relative to ordinary software governance: the tool-scope inventory and the compensating-action design. Everything else is discipline you already owe your production systems and probably have in partial form. If you want the sequencing of how these get built alongside a live pilot rather than before it, that is the shape of most of our agent implementation work.
The pre-deployment gate, in sequence
Read, reversible-write, irreversible-write. The classification, not the capability, decides what autonomy the agent gets.
One workload identity per agent instance, short-lived tokens, scoped to exactly the tools in step one. Revocable individually.
Golden set plus adversarial cases, with a numeric regression threshold that blocks the deploy pipeline, not a dashboard someone reads.
Every irreversible-write tool gets a named compensating action and an owner, or it stays behind human approval.
Agent proposes, human executes, both are logged. Compare proposals to human decisions until the disagreement rate stops surprising you.
Grant autonomy on reads and reversible writes first. Irreversible writes remain gated until the audit trail has survived a real incident review.
Identity is the artefact most teams skip, and the standards just moved
The credential model is where readiness quietly fails, because the pilot worked fine with a personal access token pasted into an environment variable and nobody revisited it. EY found 26% of organisations using agentic AI cannot detect unauthorised AI agents operating internally. You cannot detect what was never issued an identity.
The protocol layer is catching up, and the direction is worth building toward now. The MCP 2026-07-28 specification retired protocol-level sessions and the initialize handshake entirely, moved method and tool names into the Mcp-Method and Mcp-Name HTTP headers so gateways can route and authorise without parsing JSON bodies, added RFC 9207 issuer validation, bound client credentials to the issuer that minted them, and formally deprecated Dynamic Client Registration in favour of Client ID Metadata Documents. The August roadmap is blunter still: MCP authorisation was designed around a person approving access in a browser, and the maintainers are now driving DPoP adoption and an opinionated path for agent identity and delegation through workload identity federation and token exchange, with engagement in the IETF OAuth and WIMSE working groups.
Practically: header-based routing means your existing API gateway can enforce per-tool authorisation today, without waiting for the identity standards to finish. That is the single highest-leverage change available to a team with agents already in production.
Giving the agent the developer's credentials
It happens because it is the fastest path from prototype to demo, and because most internal systems have no concept of a non-human principal beyond a service account. The agent inherits a human's full entitlement set, which is always broader than the task. When something goes wrong, the audit trail shows a person, not an agent, and revocation means locking out the person.
Rollback for agents is not a git revert
Deployment rollback restores code. It does not un-send the email, un-issue the refund, un-cancel the booking or un-close the ticket. An agent that took eleven actions before failing has left eleven side effects across systems with different consistency models, and the only real answer is the pattern distributed systems people have used for decades: every forward action needs a defined compensating action, and the orchestrator has to be able to walk them backwards in order.
Most agent frameworks do not give you this. They give you retries, which are worse than nothing on non-idempotent tools — a retried payment is a second payment. Two rules that hold up in practice: make every tool call carry an idempotency key generated by the orchestrator rather than the model, and persist a durable run log so that a compensating sweep can be executed after a crash, not just inside the failing process. This is the difference between an agent and a demo, and it is the part vendor documentation consistently leaves to the reader. We keep worked examples of the pattern in our build write-ups.
Treating human approval as the safety layer
79% of Agoda's respondents require human approval before production deployment, which sounds reassuring until you watch the approval queue. Reviewers approve at high volume, with low context, under time pressure. Approval fatigue converts a control into a rubber stamp within weeks, and Cisco's data shows where this ends: 82% of network operations leaders are already comfortable letting AI make at least some production changes without prior approval.
The workloads that stay blocked in 2026, whatever your score
Readiness is per-workload, not per-organisation. Some categories should stay behind a human regardless of how many artefacts you can produce, because the compensating action does not exist:
Irreversible movement of money to external parties. Refunds within a bounded limit are reversible enough. Outbound payments, payouts and settlement are not. Keep the agent on the preparation side of the boundary — assemble the payment, let a human release it.
Identity and entitlement changes. Creating accounts, granting roles, rotating or issuing credentials. An agent with write access to the permission system can expand its own blast radius, and the failure is not recoverable by rollback because the window of exposure already happened.
Destructive data operations. Deletions, schema migrations, retention purges, index rebuilds on primary stores. These are exactly the operations where an idempotency key does not save you.
Legally binding external commitments. Contract acceptance, regulated advice, pricing or availability promises to customers, and anything filed with a regulator. The liability is not proportional to the confidence score.
Anything where the only undo is an apology. That is the general test. If you cannot name a compensating action that restores the prior state without human negotiation, the workload is not a candidate for autonomy this year — it is a candidate for a well-instrumented copilot.
The honest version of the trade-off: agents are extremely good at the assembly work in front of these decisions, and the value is mostly there anyway. Cisco's research puts the average organisation at roughly 4,100 monitoring alerts and events a day, enough that clearing the network-alert backlog by hand would need about 100 specialists. Triage, correlation and proposal generation are the win. Execution authority is a separate grant and should be priced as one.
Residency changes the architecture, not just the paperwork
The US-centric readiness reports treat data residency as a compliance annex. Across the Gulf, India and Southeast Asia it is a design constraint that lands in the first architecture diagram, because it collapses your model choice before it touches your policy documents.
India is the clearest example. The DPDP Rules were notified on 14 November 2025 with an eighteen-month phased compliance window, meaning the substantive obligations bite during 2027 — and Significant Data Fiduciaries carry stricter duties including independent audits, impact assessments, additional checks when using new technologies, and government directions on restricted data categories including local storage where required. If your agent is in scope, the question is not whether your privacy notice is updated. It is whether the model you designed around can be served from a region you are permitted to use.
Four consequences that show up in the build, not the policy:
Your model shortlist shrinks. Frontier models are not available in every region, and the in-region variant is often a version behind. An eval suite tuned on the flagship and then deployed against the regional endpoint is a silent quality regression. Re-baseline on the endpoint you will actually call — our model coverage notes track which families are realistically deployable where.
Your observability stack is a data exporter. Traces from agent runs contain the full prompt, retrieved documents and tool arguments. Most managed tracing services process in a small number of regions. This is the single most common residency failure I see, and it is invisible until an audit.
Your eval datasets inherit the same rules. Golden sets built from real production transcripts are production data. They get copied to laptops, notebooks and CI runners.
Cross-border sub-agents break the chain. An orchestrator hosted in-region that calls a tool or sub-agent hosted elsewhere has moved the data, regardless of where the orchestrator sits. Draw the map at the tool-call level, not the service level.
Where the rules differ by sector and jurisdiction — and in the Gulf and SEA they differ a great deal, often by regulator rather than by statute — the right move is to get a written answer from your own counsel on two narrow questions: can inference occur outside the jurisdiction, and can trace data. Those two answers determine your architecture. Everything else is paperwork.
The cost line nobody budgets: making the agent trustworthy
Cost is the top barrier in Agoda's data at 28%, and the report is explicit that AI costs extend beyond model calls to the work needed to design, integrate, review and validate agents. Four in five respondents said they are working under some form of AI usage limit — token quotas, usage caps or budget restrictions. Agoda's CTO Idan Zalzberg framed it directly in the release: the real cost is the work required to make AI trustworthy in production, not the model call.
The organizations that will excel in this next phase will be the ones that manage cost carefully, build the right safeguards, and keep human judgment where it matters most.
— Idan Zalzberg, CTO, Agoda, Agoda AI Developer Report 2026
Budget for it explicitly. Eval runs consume tokens at a multiple of production traffic if you run them on every change, which you should. Shadow-running doubles inference on the covered path for the duration. Trace storage is real money at agent volumes, especially with full prompt capture. In my experience these three lines, not the production inference bill, are what turn a cheap-looking pilot into an expensive programme — and the teams that get blindsided are the ones who modelled cost per task from a single-shot prompt rather than from a supervised, evaluated, logged run.
The ecosystem is professionalising around exactly this. The Agentic AI Foundation launched the Model Context Protocol Associate certification on 14 September 2026, a 120-minute vendor-neutral exam in which Security & Governance is the second-largest domain at 24% of the content. When the first certification for the tool-calling protocol devotes a quarter of its weight to trust boundaries and permissions, the industry has already conceded the point Agoda's data makes: the hard part was never the generation.
If you have pilots running and want an outside read on which of the seven artefacts you can actually produce, that is a short, concrete engagement — start here.
Frequently Asked Questions
What does agentic AI enterprise readiness actually mean?
It means you can produce seven artefacts on demand for a specific workload: a tool-scope inventory, an agent identity and credential model, an eval suite with regression thresholds, a rollback and compensating-action design, a human-escalation SLA, an audit trail schema, and a data-residency map. Readiness is assessed per workload, not per organisation. An agent that drafts responses and one that issues refunds have completely different bars.
How long does this pre-deployment gate take to complete?
The pass/fail tests take a day. Closing the gaps they expose takes longer, and the distribution is uneven: tool-scope inventory and escalation SLA are usually a week; the identity model depends entirely on whether your IdP can issue per-workload identities; the eval suite is the long pole because it needs real labelled cases, not synthetic ones. Run the tests first so you are sequencing against evidence rather than assumption.
Which agent workloads should stay blocked in 2026?
Irreversible outbound payments, identity and entitlement changes, destructive data operations such as deletions and schema migrations, and legally binding external commitments including regulated advice. The general test: if you cannot name a compensating action that restores the prior state without human negotiation, the workload is not a candidate for autonomy. Agents can still do the preparation work up to the decision boundary, which is where most of the value sits anyway.
Is human approval enough of a control for production agents?
Not on its own. Approval queues degrade into rubber-stamping under volume, and EY found 47% of organisations have bypassed their own governance process for urgent deployments despite 98% having formal policies. Approve by exception instead: auto-approve reversible classes, route only irreversible writes and low-confidence cases to humans, and monitor override rate. A very low override rate means the review is not functioning as a control.
How do data residency requirements change agent architecture?
They constrain which models you can call, because frontier models are not served from every region and the in-region variant is often a version behind. They also catch three things teams forget: trace data containing full prompts, eval datasets built from production transcripts, and cross-border sub-agent calls. India's DPDP Rules, notified in November 2025 with an eighteen-month phased window, include stricter obligations and possible local-storage directions for Significant Data Fiduciaries.
What changed in MCP that affects agent deployment security?
The 2026-07-28 specification made the protocol core stateless, moved method and tool names into HTTP headers so gateways can route and authorise without parsing request bodies, added RFC 9207 issuer validation, bound client credentials to their issuing authorisation server, and deprecated Dynamic Client Registration in favour of Client ID Metadata Documents. The roadmap published in August targets agent identity and delegation via DPoP, workload identity federation and token exchange.
Why is cost the top barrier rather than capability?
Because the expensive part is not the model call. Agoda's report found 28% cite cost as the main obstacle, with four in five developers working under token quotas or budget caps, and it attributes the real spend to designing, integrating, reviewing and validating agents. In practice the three lines that surprise teams are continuous eval runs, shadow-running duplicate inference, and trace storage with full prompt capture.
Research digest
AI Research Briefing
Honest insights on AI agents, Small Language Models, and local RAG. No hype. Only when we have something worth sending.
- No hype, just measurable outcomes
- Read by 2,400+ engineers
- Unsubscribe anytime