The Connected Tissue: Who Else Gets Touched When You Deploy an Agent? (Part 2 of 2)

Part 7 of 7 · Agentic SaaS Blueprint series

Part 1 mapped who gets touched when you deploy an agent: the four teams a single Customer Success agent quietly makes load-bearing, and the way one misjudged classification compounds down a chain before anyone can question it. This half is about the edges of that map: the decisions agents shouldn't make, the ways an agent can speak in your name and get it wrong, and what actually rebuilds trust once it's shaken. Start with the edges.

Where Agents Shouldn't Go, and the Autonomy Trade Underneath It

Some domains carry a downside that no efficiency gain justifies legal, financial, and brand-risk decisions where a rare failure costs more than the aggregate savings are worth. In February 2024, a BC tribunal found Air Canada liable for its chatbot's incorrect advice on bereavement fares. (CBC News) Air Canada's defense that the chatbot was a "separate legal entity" not responsible for its own words was explicitly rejected. The airline was ordered to honor the fare the bot promised. The ruling that matters here isn't the dollar amount; it's that "the agent said it, not us" isn't a defense anywhere a court, a regulator, or a customer is involved.

This is really a question about the autonomy trade, made concrete. Human-in-the-loop keeps a named person accountable for the call and measurably reduces the failure modes above, but there's a legitimate case for full autonomy too, on speed, scale, and cost, and the honest framing isn't that autonomy is wrong. It's that autonomy removes the checkpoint that used to catch exactly the failures this section describes. That's a deliberate trade some workflows can justify. Legal, financial, and brand-facing ones, per the Air Canada ruling, usually can't.

When the Agent Sounds Like You, But Isn't

There's a risk category one level more personal than brand damage: an agent that speaks with your voice, or your company's, and says something neither of you meant. In January 2024, DPD's customer service chatbot was goaded into swearing at a customer and writing a poem calling DPD "the worst delivery firm in the world"; screenshots hit 1.3 million views before DPD disabled the bot. (CX Today) A month earlier, a Chevrolet dealership's ChatGPT powered chatbot was talked into agreeing to sell an $81,000 Tahoe for $1, closing with "that's a legally binding offer no takesies backsies," a promise the dealership never made and had to publicly walk back. (autoevolution)

Both are funny. Both are also the same underlying problem as the Air Canada case, playing out faster and more publicly: automation pushed out ahead of judgment produces a message that represents something the company never wanted to say, under its own name, in front of an audience of millions. Scale that pattern down to an individual: a Slack auto-response, an email reply drafted and sent by an assistant, a commitment made in someone's name without their review; and the exposure stops being the brand's. It becomes personal: a promise, a tone, a commitment that isn't really theirs, attached to their name and their credibility, not just the company's.

Who Sells, Who Buys, Who Lives With It

Three parties sit around most agentic deployment decisions, and they want structurally different things. The vendor's monetization model generally rewards more autonomy and less friction; that's the sell side. The economic buyer wants efficiency and a defensible ROI number; that's the buy side. The employee or downstream role absorbs whatever the deployment actually does to their job, their workload, and their standing with the people they serve; that's who lives with it.

None of the three is wrong to want what they want. The gap is that nothing in the transaction automatically aligns them, and that gap is exactly where it's worth being skeptical of technical possibility narratives that outrun a validated business case. "The agent can do this" is not the same claim as "we've weighed what happens when it's wrong against who absorbs that," and a sales conversation built entirely on the first tends to undermine the second.

There's a fourth position on this map, and it isn't a fourth vertex; it's everyone outside the triangle entirely. End customers, users, the communities and facilities and gig workforces affected by an agent's downstream decisions were never in the room for the sell/buy/live conversation, and they're not stakeholders in the deal. They're stakeholders in the consequence. Agentic AI is, at the end of the day, a corporate profit and revenue mechanism that's not a criticism; it's just what it structurally is, and the people who bear the cost of getting it wrong are very often not the people who approved it. A win for the vendor and a win for the buyer isn't automatically a win-win; it's two out of at least three, and often two out of four.

Stakeholder Acceptance: Value × Controlled Risk

Whether a stakeholder accepts an agent isn't really about whether it works. It's the balance between perceived value and perceived controlled risk, and people resist agents deployed where they weren't needed, over-engineered relative to the problem, or imposed without a clear case, because for them it isn't one transaction. It's their job and their trust, repeated every day, and the impact is larger than any single interaction.

Klarna's 2024 rollout is a useful real plot on this matrix, not through the cost-margin lens Article 3 used, but through this one. High technical value, low perceived control: the company led with headcount reduction before it had proven the quality bar would hold, and stakeholder trust, both customers' and employees', moved into resistance before the company reversed course in 2025. The buying-committee split from Section 3 shows up again here as one of the forces that suppress perceived control: the people who feel the risk most acutely are rarely the ones who got to shape how it was managed.

The ADKAR Curve for Agentic Deployment

Change management theory gives a structured way to see why some rollouts hold trust and others don't. ADKAR - Awareness, Desire, Knowledge, Ability, Reinforcement maps cleanly onto agentic deployment, but the two curves below diverge on one design choice: whether stakeholders get upfront visibility into agent-driven actions, or only reconstruct what happened after something goes wrong.

Klarna's rollout is again the cautionary case. Awareness and Desire moved fast because leadership drove them, but Ability and Reinforcement stalled once service quality visibly dropped and customers noticed before the company did; trust had to be rebuilt from a lower point than where it started. GitHub Copilot's rollout is the contrast: gradual, opt-in, transparent about where it helps and where it doesn't, sustaining adoption through Reinforcement rather than losing it. Different industries, same mechanism: the curve bends on whether visibility was designed in from Awareness onward or bolted on after Ability was tested in public.

What Rebuilds Trust

The keynote's governance framework does the heavy lifting here, so I'll keep this to the connective tissue rather than re-deriving it: a named owner for where the red zones sit, visible checkpoints at the moments identified in the diagrams above, an explicit escalation path rather than an implied one, and boundaries on agent authority that are published to the people affected by them, not just assumed by the team that built the agent. Governance, in other words, is what turns "we thought about this" into something the next stakeholder in the chain can actually see and rely on.

The Questions Worth Asking

On visibility. Do you know which of your agent's actions couldn't be reconstructed after the fact, and separately, does the next person downstream see agent-origin and severity before they act, or only if they go looking?

On accountability. For your highest-volume agent workflow, who is Accountable, not just Responsible, for an individual action the agent takes inside its approved scope?

On bias. Is anyone auditing your agent's decisions in aggregate, across the population they affect, or only reviewing individual cases when someone complains?

On red zones. Is there a role or a decision where an agent would technically work but shouldn't be deployed, and who in your organization has the authority to say no?

On the people outside the triangle. Who absorbs the cost if this deployment is wrong, and were they in the room, in any form, when it was approved?

Where This Connects Back

Architecture defined what's possible. GTM defined who you sell it to. Pricing defined what you charge and what earns you a premium. This piece is about who lives with all three, every day, long after the contract is signed, and the through-line across all four is the same: none of these is purely technical decisions, and treating them as if they were is how the failures in this article happen.

Agentic AI, as a business, is a profit and revenue mechanism, sold by people whose incentives favor more autonomy and bought by people whose incentives favor efficiency. Neither is wrong to want what they want. But the true stakeholders the end customers, the employees whose jobs and credibility are on the line, the communities and workforces who never had a seat in the room are real people, with real lives, not a line in a business case. Getting sold on what's technically possible, ahead of a weighted evaluation of what's actually safe, is how organizations end up explaining to a tribunal, a regulator, or their own customers why nobody was watching.

This isn't an argument for or against agentic AI in the workplace. It's an argument for building the architecture, the culture, and the process to be risk-mitigated and managed, deliberately, before scale makes the gaps expensive. Better safe than sorry to yourself, to the people around you, and to an industry that's still deciding what responsible looks like.