Publisher: KPMG International
Date: 2025
Focus: Strategy, architecture, and risk management for agentic AI adoption
Audience: CIOs, CTOs, Risk Officers, Enterprise Architects
1. Executive Context
Agentic AI represents the next evolution of enterprise automation, where AI systems:
- Execute complex tasks autonomously using reasoning and memory
- Interact with tools, APIs, and data systems
- Coordinate across multiple steps or agents to achieve business goals
Unlike static chatbots or prompt-based LLM apps, agents exhibit goal-seeking, adaptive, and multi-turn behaviors.
KPMG positions agents as enterprise-native software entities, aligned with business processes, governance, and risk frameworks.
2. Enterprise Use Case Archetypes
KPMG identifies 4 agent archetypes:
| Archetype | Description | Examples |
|---|---|---|
| Decision Agents | Analyze context and make recommendations | Risk scoring, audit insights |
| Action Agents | Execute tasks via systems and APIs | Claims triage, payment ops |
| Design Agents | Create content, systems, workflows | Proposal drafts, marketing plans |
| Interaction Agents | Interface with customers or employees | Chat support, onboarding advisors |
These archetypes map across industries like finance, insurance, retail, and energy.
3. Agent Stack and Reference Architecture
A modular enterprise-grade agent system includes:
| Layer | Function |
|---|---|
| Interface Layer | Human or API entry points (chat, app, webhook, events) |
| Orchestration Layer | Manages task flows, retries, escalations |
| Agent Logic Layer | Memory, planning, reasoning, and delegation capabilities |
| Model Access Layer | LLM execution + embeddings (open or closed models) |
| Tool Integration | API connectors, document readers, CRM, ERP, search |
| Control Plane | Guardrails, evals, audit logs, observability |
Design principle: Separation of concerns across planning, execution, and governance.
4. Trust and Control Framework
KPMG introduces a 4-part agent governance model:
| Pillar | Description |
|---|---|
| Trust | Explainability, accountability, role-bound instructions |
| Control | Access policies, RBAC, secrets management, tool boundaries |
| Resilience | HITL fallback, circuit breakers, retries, safe termination |
| Compliance | Risk scoring, lineage, auditability, regulatory alignment |
Agents must be deployed within standard risk and compliance frameworks (e.g., model governance, internal controls, data residency).
5. Deployment Maturity Model
KPMG defines a 5-level agent adoption curve:
| Level | Stage | Description |
|---|---|---|
| 1 | Tools with LLMs | LLM-enhanced apps with no planning/memory |
| 2 | Single-task agents | Fixed logic; simple tool usage |
| 3 | Multi-tool agents | Planning, sequencing, tool decisioning |
| 4 | Multi-agent systems | Delegation, negotiation, dynamic tasking |
| 5 | Enterprise agent mesh | Cross-org agent networks, decentralized ops |
Progression requires evals, control infrastructure, and architectural scalability.
6. Key Adoption Principles for Enterprises
KPMG advises enterprises to focus on:
- Use-case selection: Start with repetitive, decision-heavy workflows (e.g., onboarding, KYC, reporting).
- Model observability: Log all prompts, tool calls, and reasoning steps.
- Modular orchestration: Use shared components across agents (memory, tools, planning).
- Guardrails by design: Enforce policies at both instruction and action levels.
- Cross-functional governance: Involve legal, risk, IT, data, and business stakeholders.
7. Risk Management Considerations
| Risk Domain | Agent-Specific Threats | Mitigations |
|---|---|---|
| Security | Tool injection, RCE, API abuse | RBAC, sandboxing, allowlists |
| Privacy | PII leakage, memory reuse | PII redaction, scoped memory |
| Operational | Agent failure, infinite loops, tool misalignment | Timeouts, retries, HITL |
| Reputational | Hallucinations, policy violations, wrong tone | Output filters, escalation paths |
| Compliance | Lack of audit trails, model explainability gaps | Eval logging, MRM alignment |
8. Emerging Practices and Standards
- Eval-driven development: Agents must pass functional and safety evals before release.
- Interoperable agent layers: Support for A2A (Agent-to-Agent) protocols and modular agents.
- Model-agnostic design: LLMs should be interchangeable based on task and privacy needs.
KPMG also acknowledges growing open standards like:
- MCP (Model Context Protocol)
- OpenAgents, LangChain, CrewAI
- Cloud-native orchestration from AWS, GCP, Azure
Conclusion
Agentic AI is not just a UX upgrade—it’s a software architecture shift. To unlock the advantage:
- Design for trust, control, and auditability
- Implement shared agent infrastructure
- Move beyond experiments into operational agent deployment
- Align with enterprise risk management and regulatory frameworks
KPMG offers advisory frameworks to guide organizations through responsible scaling of agents in production.
Leave a Reply