BOSTON – Organizations are deploying production agents faster than governance policies can keep pace. There's more code being produced than organizations know what to do with.
That was the premise at Harness Unscripted 2026 in Boston on Wednesday, where executives at the software delivery platform company made the case for putting control around an increasingly automated software development lifecycle.
"Is anyone in the room writing code right now? [Does anyone have] code being produced for them by an agent [right now]?" said Trevor Stuart, SVP of Harness. Some hands floated up. "If I were to ask that question last year, the answer would be no, right?" he said, setting the stage for a day focused on how enterprises can give AI agents greater autonomy without giving up control. "The way we are building software has fundamentally changed. The volume of code that we're producing is astronomical."
That surge is coming as enterprises push deeper into the use of agents. An August Omdia survey of IT leaders found that 81% of organizations viewed agentic AI as a strategic priority, and 80% were making significant infrastructure investments to support new AI initiatives. At the same time, 80% expressed concerns about achieving positive ROI from those initiatives.
In the race to implement agents and derive positive ROI from them, Harness contends that companies risk prioritizing speed over quality or governance. The company’s September 2026 State of Agent DLC survey of 700 engineers and engineering leaders found that surveyed organizations are deploying agents faster than they are adapting their software development processes to govern them.
"I think the surprising part about the report is the amount of people that actually think they're safe and they have the controls in place," Stuart said. "You ask them, OK, are you deploying agents in production?' 80, 90% will say yes. And then you say, 'do you feel safe?' And they'll say, in most cases, 'I feel safe.' And then you ask them, 'what tools do you have at your disposal to feel safe?' Most of them don't have the tools."
Harness introduced AI agents for software delivery in June, followed by Agent DLC in July to address gaps in testing, securing and governing agents in production.
Controlled autonomy for non-deterministic software
Traditional deployment practices also need to apply to agents to bound their behavior, Stuart said. These include progressive, percentage-based delivery, canary rollouts and gradual testing. But unlike traditional software, agents are non-deterministic: The same input can produce different outputs, complicating testing and deployment.
"We're seeing people just haven't brought that to agents yet. They're not thinking about the same patterns of software delivery for non-deterministic software," Stuart said. "As you make changes [tuning the model, changing the temperature settings, changing the prompt], every single one of those changes might mean the agent responds differently. I want to test that with 1% of my customers first and make sure that response is not now going to degrade my brand."
In the keynote, Stuart defined three levels of risk-based autonomy to help organizations determine how much responsibility they are willing to give to an agent. Level 1 means no runtime decisions can be made by an agent. Level 2 means agents can execute with a human in the loop. Level 3 means agents can execute autonomously within the policies users set.
Three levels of risk-based autonomy
Most organizations fall into that second category, said Jim Mercer, analyst at IDC.
"It's not throwing the light switch. It's more of a gradual adoption, in terms of starting to use an agent with a human in the loop,” Mercer said. "What we're seeing is mostly that people are kind of at that human in the loop [stage]. It is a gradual migration."
This is consistent with Omdia data. According to the firm's IT modernization survey from August, nearly half of today's app dev leaders describe their orgs as having a high maturity level when it comes to automating development processes – meaning AI and ML is in regular use. Only 10% claim to use fully autonomous AI though, and a significant portion (40%) use only process-centric or basic automation.
"It really depends on your risk appetite based on the type of change you're making," Braulio Lam, VP of Engineering at EQ Bank said in a panel on the governance gap in enterprise AI. Lam is a Harness customer. "We're still at the point where we need that human in the loop making sure that proper guardrails were put in place for that agent.”
We're still at the point where we need that human in the loop making sure that proper guardrails were put in place for that agent.
Braulio LamVP of Engineering, EQ Bank
Knowledge graph provides context for agents
Giving agents more autonomy requires giving them enough context to make sound decisions, Mercer said.
"One of the challenges with AI in general -- and certainly agents -- is just good context, understanding where you are and what you're doing. Just having that context and understanding can help to make your agents that much smarter," Mercer said.
Harness seeks to address that problem with its software delivery knowledge graph, which brings together data from across the software development lifecycle that agents can use as context.
The context problem is organizational as well as technical, said David Shinnick, head of enterprise architecture at FactSet, a financial data and software company and Harness customer. Developers must account for security, cost controls, architectural standards and other requirements, but that information is often scattered across teams, tickets and meetings.
"Not only do I have to context-switch -- I'm taking time out of my day, and it's inefficient because there's signal loss between teams." Shinnick said. "You've got somebody that's reviewing something that doesn't have the full context of the app. An architecture review agent or a security review agent can get that context."
What should be automated?
Some SDLC- tasks are better candidates for full automation than others, Stuart said. He pointed to change advisory boards, code review and feature flag removal as processes ripe for automation when code production quadruples.
"If you believe that agents are going to be increasing [development velocity], something like a change advisory board just will not scale. It's going to break. It's going to slow you down. It's the reason for the bottleneck," Stuart said.
Deciding what needs a human comes back to the three-level risk-based framework and a scoring system.
"Every change can be scored, every change can have a blast radius, every code submission can have a complexity score or maybe a diff score. If you can score it, you can then put policies and governance in place to essentially determine whether it passes your human gates or not," Stuart said.
Harness's knowledge graph can also ingest telemetry and runtime data to feed agent context. Harness's ability to incorporate runtime data comes in part from its 2025 merger with application security company Traceable. Runtime data gives agents another course of context: information about how software behaves in production.
"Somebody may say I want to build on Cursor, and Cursor gives me some sort of build capabilities, but still, I need to be able to deploy. I need to be able to monitor it at runtime," Mercer said. "[Harness] have rolled that into the platform now, so that gives them a very strong runtime play."
Ben Lutkevich is an award winning writer for TechTarget's infrastructure group.
