Agentic AI vs. Rebranded Automation: A Vendor Due-Diligence Checklist for Procurement

A short checklist for a long problem: when a vendor says "agentic AI," what are they actually permitted to let the system decide without a person signing off - and can they show you, not tell you?

Key Takeaways

• Gartner estimates that of the thousands of vendors marketing "agentic AI," only around 130 products demonstrate genuinely agentic capability - a practice its analysts call "agent washing": rebranding assistants, RPA and chatbots without adding substantial autonomy (Gartner, 2025).

• The 2026 wave of near-identical "agentic AI use case" vendor content is itself evidence that marketing language has outrun the underlying technical distinction, not evidence of a maturing category.

• Three documented BFSI operating failures - at a major Australian bank, a global fintech lender, and a US insurer - show what happens when an institution or vendor can demonstrate output but not the decision boundary, tool-use scope and failure handling behind it (Sadler, 2025; McKay, 2025; Insurance Journal, 2026).

• Narrower autonomy is frequently the correct engineering decision, not evidence of a weaker product - enterprises with mature AI governance deliberately constrain what agents can do, and regulators are warning against applying one autonomy standard to every use case (Gartner, 2026; Kiteworks, 2026).

• A small number of concrete questions - about decision boundaries, tool-use scope and failure handling - do more diagnostic work than any vendor demo, and this article sets out a specific checklist, the Decision Boundary Audit, to ask them.

Introduction

Open any procurement inbox in financial services in October 2026 and the pattern is identical across vendors: a platform slide titled "agentic AI use cases," a demo in which an assistant drafts an email or routes a ticket, and a claim that the system "autonomously" does something a rules engine has done for a decade. Gartner's own estimate is that this is not the exception but the norm - of the thousands of vendors now marketing agentic AI, perhaps 130 products actually exhibit the autonomous, goal-directed behaviour the term implies (Gartner, 2025). The rest is "agent washing": existing automation, relabelled.

This matters more in banking and insurance than almost anywhere else, because the thing procurement is actually buying when it buys "agentic AI" is a change in who - or what - is permitted to make a decision, and under what conditions. A chatbot that drafts a response for a human to approve is a productivity tool. A system that can approve a claim, release a payment, or close a policy without a human in the loop is a decision-making system, and it needs to be evaluated, contracted and governed as one. The marketing language for both now looks almost identical. That gap - not a lack of AI capability anywhere in the market - is the actual procurement problem this piece addresses.

The Saturation Signal: What a Market Flooded With "Agentic AI Use Cases" Tells You

The clearest evidence that "agentic AI" has become a marketing category rather than a technical one is not any single vendor's overreach - it's the volume. A search for "agentic AI use cases in banking" or "insurance" in late 2026 returns a wall of near-identical listicles, each cataloguing a dozen or two dozen possibilities, from different vendors, in almost the same language. That pattern of saturation is itself a data point: when an entire competitive set converges on the same term for materially different levels of technical capability, the term has stopped doing useful descriptive work.

Independent commentary now treats this as a named phenomenon rather than an isolated complaint. Debevoise & Plimpton, writing for a legal and disclosure audience, describe "agent washing" as an extension of the older "AI washing" problem: companies labelling conventional automation or limited generative AI as "agentic," overstating an agent's autonomy or reliability, or presenting a pilot as if it were a scaled production system (Debevoise & Plimpton, 2026). Their framing is useful precisely because it is not vendor marketing about vendor marketing - it is a warning to companies about the disclosure risk of their own overstated claims, which is a different and more durable kind of evidence that the gap is real.

A second, independent signal: a vendor-side "buyer's scorecard" for agent washing itself appeared in mid-2026, scoring products on axes like autonomy, planning and tool use (Digital Applied, 2026). The existence of a market for tools that detect agent washing is itself confirmation that the underlying claim-versus-capability gap has become common enough to need one.

Why "Agentic" Is Easy to Claim and Hard to Verify

Part of the problem is definitional looseness that vendors can exploit without technically lying. The Cloud Security Alliance's proposed six-level autonomy taxonomy - adapted from the SAE's well-known levels of vehicle automation - is a useful lens: Level 0 is pure human execution, Level 2 is a system that drafts recommendations for a human to act on, Level 3 is a system that decides independently within defined boundaries and escalates outside them, and Level 4-5 describe systems operating with minimal or no supervision (Cloud Security Alliance, 2026). Its author is explicit that Level 5 "is not appropriate for enterprise deployment today" (Cloud Security Alliance, 2026) - which means almost every legitimate production deployment in a regulated industry sits at Level 2 or 3, not the high-autonomy end the word "agentic" implies to a non-technical buyer.

Gartner's own governance guidance makes the same point from the regulator-adjacent side: applying one governance standard to every agent, regardless of its actual autonomy level, causes two separate failures - simple, low-autonomy agents get over-constrained (which slows deployment and pushes teams toward shadow IT), while genuinely autonomous agents get under-controlled, raising real operational, security and compliance risk (Gartner, 2026). The practical implication for a buyer is that the label "agentic" tells you almost nothing about which of these failure modes you are exposed to. Only the specific boundary - what the system can decide, touch and do when uncertain - tells you that.

What Happens When the Gap Surfaces in Production

The theoretical risk of agent washing becomes concrete once you look at documented operating failures in financial services - not AI failures in the sense of a model being wrong, but governance failures in the sense of a system (or an institution's assumptions about a system) being allowed to operate beyond what its actual controls supported.

In mid-2025, Commonwealth Bank of Australia announced it would replace 45 customer-service roles with an AI-powered voice bot, then reversed the decision within weeks. CBA stated the roles "were not redundant" and that its initial assessment "did not adequately consider all relevant business considerations" (Sadler, 2025). The Finance Sector Union's response - that the bank had "been caught out trying to dress up job cuts as innovation" (Sadler, 2025) - captures the underlying issue precisely: a capability claim was used to justify an operating decision the system's actual, demonstrated boundary didn't support. Around the same time, Klarna's CEO publicly admitted that its push to have an AI assistant handle the equivalent of 700 human agents and 75% of customer chats had "gone too far," with cost given too much weight relative to quality, and the company began actively re-hiring human agents (McKay, 2025). Separately, in a Pennsylvania case made public in 2026, GEICO agreed - without admitting wrongdoing - to modify an AI-driven policy-cancellation review process after a customer was left uninsured without adequate notice, including by extending document-submission windows and committing to follow the state insurance department's AI guidance (Insurance Journal, 2026).

None of these three is primarily a story about a model being technically wrong. Each is a story about an institution or vendor being unable to demonstrate, under scrutiny, exactly what the system was permitted to decide, who it notified, and what happened when its inputs were incomplete or ambiguous - the same three questions this article's checklist asks a vendor to answer before signature, not after a union, a journalist or a state regulator asks them after the fact. sourceCode's 17 September 2026 piece on failed AI vendor selections built the Operating Discipline Scorecard around exactly this pattern across these three cases; this piece takes the narrower, pre-signature slice of that same problem - the "agentic" label specifically - and gives procurement a tool to test it at RFP stage, before the operating failure has a chance to happen.

_>> Read more: “What Three Failed AI Vendor Selections Have in Common (A Procurement Post-Mortem)”_

The Counterargument: When Narrower Autonomy Is the Right Decision

A checklist built around "how much can this system do without a human" risks being read as "more autonomy is better, and a vendor who says no is hiding something." That reading is wrong, and a rigorous procurement process should actively guard against it.

Evidence from enterprises that are actually succeeding with agentic AI in production points the other way. A 2026 industry survey found that organisations with the most mature AI governance programmes reported dramatically fewer AI-related security incidents than the least mature tier (34% versus 91%) - and the governance pattern behind that gap is not broader autonomy, it's narrower scope: many single-purpose agents with defined data boundaries, human checkpoints before consequential actions, and containment that limits what a misbehaving agent can reach (Kiteworks, 2026). The same report found that most organisations still cannot reconstruct their own AI decisions on demand - 72% cannot trace an AI output back to its source data, and half cannot produce a complete AI data-access audit record within a business day (Kiteworks, 2026). In that environment, a vendor that has deliberately narrowed what its agent can do, and can prove it, is demonstrating exactly the operating discipline this piece argues procurement should be testing for - not a weaker product.

McKinsey's 2026 AI Trust survey reinforces the same point from the buyer's side: average responsible-AI maturity across roughly 500 organisations rose only from 2.0 to 2.3 (on a four-point scale) year on year, with security and risk concerns - cited by nearly two-thirds of respondents - now the leading barrier to scaling agentic AI, ahead of regulatory uncertainty (McKinsey, 2026). A vendor racing ahead of that curve with broad, unbounded autonomy is a bigger risk than one who has consciously stayed behind it.

There is a second, separate failure mode worth naming honestly: procurement teams that over-rotate on technical purity and treat "is this really agentic" as the only question worth asking. A system that is honestly rules-based automation, clearly priced and scoped as such, with a vendor who has not made an inflated autonomy claim, may be the better commercial fit for a use case that genuinely doesn't need agentic behaviour - Gartner's own analysts make this point directly: "many use cases positioned as agentic today don't require agentic implementations" (Gartner, 2025). The checklist below is not a purity test designed to disqualify every vendor who scores "automation." It is designed to make sure the label on the contract matches the system's actual behaviour, so pricing, governance obligations and the business case are all built on the same claim.

The Decision Boundary Audit: A Checklist for Testing an "Agentic AI" Claim

Rather than scoring a demo, the Decision Boundary Audit asks a vendor to produce, in writing or on screen, the specific mechanism behind three boundary lines. Each question has a pass condition (a named, demonstrable mechanism), a partial-pass condition (automation, honestly described), and a fail condition (a narrative answer that restates the marketing claim instead of pointing to a control).

1. The Decision Boundary - autonomous decision-making limits

• Name every decision type this system is permitted to finalise today, in this configuration, without a human sign-off - and the specific threshold (dollar value, risk score, customer-impact tier) at which that permission stops.

• Show the configuration object or policy setting that enforces that threshold, not a slide describing it.
  
  Pass: a named policy engine or rule set, inspectable in the product. Fail: "the model is generally quite accurate at this."
  
  2. The Tool Boundary - tool-use scope
  
  

• List every system, account or API this agent can write to - not merely read from - and which of those actions execute without a queued human approval.

• If the agent can trigger an irreversible action (a payment, a policy cancellation, a customer communication), show the control that stops it, and confirm whether the relevant human is notified before or only after the action executes.
  
  Pass: an explicit allow-list of writable systems, with approval gates mapped to each. Fail: "it integrates with your existing systems" with no scope boundary named.
  
  3. The Failure Boundary - what happens when the system is wrong or unsure
  
  

• Walk through, step by step, what the system does the moment it is uncertain or the input falls outside its training distribution - not what it does when confident.

• Show the audit log entry a genuinely uncertain decision produces, and its retention period.
  
  Pass: a demonstrable escalation path and a real log entry. Fail: the system has no observable concept of "uncertain" - it always produces an answer with equal confidence.
  
  A vendor who answers all three with named mechanisms has a genuine claim to agentic behaviour, bounded appropriately for a regulated environment. A vendor who answers all three honestly with "a human approves every action" is selling well-built automation - which may be exactly the right purchase, at the right price, for the use case. A vendor who cannot answer with a demonstrable mechanism at all - only with narrative about the model's general capability - has an unverified claim, regardless of which label is on the slide deck.

What This Means for the Buying Committee

For Procurement. Build the Decision Boundary Audit into the RFP, not the reference-call stage. Ask for the three answers in writing before a demo, and treat "we'll show you in the demo" as a deferral, not an answer. Price and contract against what the vendor actually demonstrates at each boundary - not the autonomy level implied by the word "agentic" on the cover slide - and be explicit internally that a correctly scoped automation purchase is a legitimate outcome of this process, not a failed one.

For Risk & Compliance. The three boundaries map directly onto existing obligations rather than creating new ones. APRA's April 2026 letter to industry is explicit that human-in-the-loop processes should be maintained for high-risk decisions, and that entities need clear visibility and auditability over their AI supply chain, including fourth-party and foundation-model dependencies (APRA, 2026, via Vanta, 2026). A vendor who cannot answer the Failure Boundary question has already told you they cannot support the audit-trail and human-oversight expectations your own regulator has published - independent of whatever the vendor's marketing calls the system.

The sourceCode’s Perspective

sourceCode sits on both sides of this problem in practice: we build AI-enabled systems for banks and insurers through our AI Solutions and sBrain product line, and we insource and extend client engineering teams who are themselves running these exact vendor evaluations. The pattern we see most often is not vendors lying about what their systems do - it's vendors and buyers using the word "agentic" to mean different things in the same conversation, because nobody in the room has forced the conversation down to a specific, written decision boundary.

Our own default working assumption, consistent with the checklist above, is that the right level of autonomy for a BFSI production system is rarely the highest one technically available - it's the level the institution's own governance, audit and escalation processes can actually support today, with room to extend deliberately as those processes mature. That is as much an argument about institutional readiness as it is about vendor claims, and insourced delivery teams - who stay accountable to the client's own risk function after go-live, rather than handing off after a pilot - tend to be the ones who end up documenting that boundary properly, because they are the ones who have to answer for it in production.

We don't claim a universal answer to where that boundary should sit for any given institution; it depends on the use case, the regulator, and the maturity of the team receiving the system. What we do argue is that the boundary should be decided and documented before the contract is signed, using the vendor's own demonstrated mechanism rather than their marketing language - which is the specific, narrow problem this checklist is built to solve. Talk to us here!

Conclusion

"Agentic AI" is not a single technical standard, and the market's current saturation with the term is a symptom of exactly that: a label elastic enough to cover everything from a drafting assistant to a system that can independently release a payment, deployed by vendors who have every commercial incentive to let a buyer assume the more impressive end of that range.

The fix is not a longer RFP or a more sceptical procurement culture in general - it's three specific, answerable questions about decision boundaries, tool-use scope, and failure handling, asked in a way that requires a demonstrable mechanism rather than a demo narrative.

Run the Decision Boundary Audit against your current shortlist before the next vendor meeting, and you will generally know within one conversation which label on the slide actually matches the system behind it.

FAQ

What is "agentic AI washing"? It is the practice of marketing conventional automation, assistants, or robotic process automation (RPA) as "agentic AI" without the system having the autonomous, goal-directed decision-making the term implies. Gartner estimates only a small fraction of vendors marketing agentic AI - roughly 130 out of thousands - demonstrate genuinely agentic capability (Gartner, 2025).

How is agentic AI technically different from rules-based automation? The practical distinction procurement needs is not philosophical - it is the three boundaries this checklist tests: whether the system can finalise defined decision types without human sign-off (decision boundary), which systems it can write to unsupervised (tool boundary), and what it does when uncertain (failure boundary). A system that always requires human approval before acting, regardless of how sophisticated its reasoning looks in a demo, is automation with a drafting layer - not agentic AI.

Is it ever a problem if a vendor's system has narrow autonomy? Not on its own. Evidence from mature AI governance programmes shows that narrower, more bounded autonomy is associated with fewer AI security incidents, not more (Kiteworks, 2026). The problem is a vendor claiming broader autonomy than they can demonstrate - not a vendor who has deliberately kept autonomy narrow and can explain why.

What should procurement actually ask for in the RFP, not just the demo? Ask for the three Decision Boundary Audit answers in writing before any demo is scheduled: the specific decision types and thresholds the system can act on unsupervised, the systems it can write to without approval, and a walkthrough - with a real log entry - of what happens when it is uncertain. A vendor who can only answer in the demo, narratively, has not actually answered.

Reference List

Cloud Security Alliance / Reavis, J. (2026) Levels of Autonomy. 28 January. Available at: https://cloudsecurityalliance.org/articles/levels-of-autonomy (Accessed: 12 October 2026).

Debevoise & Plimpton LLP / Chandrasekhar, C.A., Gesser, A., Pedersen, B.R. and Rodel, P.M. (2026) Agent Washing: Disclosure Risks in the Emerging Market for AI Agents. 25 March. Available at: https://www.debevoise.com/insights/publications/2026/03/agent-washing-disclosure-risks-in-the-emerging (Accessed: 12 October 2026).

Digital Applied (2026) Agent-Washing: Definition and Buyer's Scorecard for 2026. 3 July. Available at: https://www.digitalapplied.com/blog/agent-washing-definition-buyers-scorecard-2026 (Accessed: 12 October 2026).

Gartner (2025) Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027. Press release, 25 June. Available at: https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027 (Accessed: 12 October 2026).

Gartner / Varma, S. (2026) Gartner Warns Against Uniform Governance for All AI Agents. Press release, 28 May, as reported in All About Industries. Available at: https://www.all-about-industries.com/gartner-warns-against-uniform-governance-for-all-ai-agents-a-40afd4e526bc771214917c6778469d2f/ (Accessed: 12 October 2026).

Insurance Journal (2026) After Complaint, GEICO Agrees to Modify Cancellation Process That Uses AI. 26 May. Available at: https://amp.insurancejournal.com/news/east/2026/05/26/871246.htm (Accessed: 12 October 2026).

Kiteworks / Spencer, P. (2026) Why the Enterprises Winning with AI Agents Are Limiting What They Can Do. 25 August. Available at: https://kiteworks.com/cybersecurity-risk-management/governed-orchestration-ai-agents-enterprises (Accessed: 12 October 2026).

McKay, C. (2025) Klarna Dials Back its AI Customer Service Strategy - Now It's Hiring Humans Again. Maginative, 8 May. Available at: https://www.maginative.com/article/klarna-dials-back-its-ai-customer-service-strategy-now-its-hiring-humans-again/ (Accessed: 12 October 2026).

McKinsey & Company / Asaftei, G.M., Roberts, R., Sticha, A. and Prinsen, C. (2026) State of AI Trust in 2026: Shifting to the Agentic Era. 25 March. Available at: https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-forward/state-of-ai-trust-in-2026-shifting-to-the-agentic-era (Accessed: 12 October 2026).

Sadler, D. (2025) CBA Reverses AI-Driven Job Cuts, Admits 'Error'. Information Age (ACS), 21 August. Available at: https://ia.acs.org.au/article/2025/cba-reverses-ai-driven-job-cuts--admits--error-.html (Accessed: 12 October 2026).

sourceCode (2026) sourceCode homepage. Available at: https://www.sourcecode.com.au/ (Accessed: 12 October 2026).

Vanta (2026) APRA AI Guidance for Banks and Insurers in Australia, summarising APRA's Letter to Industry on Artificial Intelligence (30 April 2026). 21 September. Available at: https://www.vanta.com/resources/apra-ai-guidance-banks-insurers-australia (Accessed: 12 October 2026).