Act three · the decision
Every decision is a risk decision. The discipline runs on cells.
the registercannot see what the agent can reach
→
so itcannot say what the risk is
→
so itcannot decide against the appetite
→
so itcannot fund the controls
→
pull the plug
0%of organisations track risk in spreadsheets (Secureframe survey)
>0%of agentic AI projects cancelled by the end of 2027, inadequate risk controls among the reasons (Gartner, prediction)
0%of enterprise pilots with no measurable return (MIT NANDA, preliminary, not peer reviewed)
Reviewed in quarters. Needed in seconds, and in advance.
RegScale on the Secureframe 2024 survey · Gartner, June 2025, via MarTech · MIT NANDA, The GenAI Divide, August 2025