Feature
Guide
Is AI Making Your Organization More Productive or More Dependent?
Key Takeaways
- AI agents depend on APIs to access data, trigger workflows and act across enterprise systems.
- Fragmented, undocumented and unmanaged APIs can turn agentic AI into a security and governance risk.
- API readiness requires clear ownership, traceable actions and reliable business outcomes, not just uptime.
Organizations want generative AI agents with the ability to answer customer questions, update records, trigger workflows, analyze data and automate business processes. But before agents can do any of that, they need access to systems and information — which almost always comes through application programming interfaces (APIs).
The challenge is that many organizations attempting to build agentic AI are doing so on top of API environments that are already fragmented, poorly documented and difficult to govern. What was once an IT management issue is now a business risk as autonomous systems gain the ability to retrieve information, make decisions and act across enterprise applications.
A recent Harmonic study found nearly two-thirds of AI use on personal accounts is for work, showing just how little visibility many organizations already have into AI usage (often referred to as shadow AI).
As agents begin interacting directly with APIs across internal systems, the challenge becomes significantly more complex.
APIs Are the Foundation of Agentic AI
Much of the conversation around agentic AI focuses on models, reasoning capabilities and orchestration frameworks. Yet APIs remain the mechanism that allows agents to interact with business systems.
Organizations often make the mistake of treating APIs as technical infrastructure rather than governed business capabilities, according to Scott Simari, principal at Sendero Consulting. "APIs define what an AI agent can access and act upon, which effectively defines its scope and impact.”
The issue, explained Simari, extends beyond technology. Unclear ownership, under-resourced governance and loosely managed changes can create situations where agents behave correctly from a technical perspective while still producing incorrect business outcomes.
An API may successfully execute a command, but the underlying business controls might not be designed for autonomous execution.
API Sprawl Leaves Enterprises Flying Blind
Many enterprises have struggled with API sprawl long before agentic AI arrived.
Shari Lava, group vice president of AI, data and automation at IDC, said organizations frequently maintain large collections of APIs spread across multiple management systems, often with limited visibility into what exists and who owns it. In fact, research from her company found many organizations lack reliable methods for detecting unmanaged shadow AI or identifying dormant APIs that remain active despite no longer serving a business purpose.
“The problem now is that this mature but fragmented ecosystem is being reused as the foundation for AI agents,” Lava said, noting that many APIs were never designed for deterministic automation, much less autonomous agents.
Before expanding agentic AI initiatives, organizations should understand:
- Which APIs are actively being used
- Which APIs lack clear ownership
- Where shadow APIs exist outside governance processes
- Which dormant APIs remain accessible
Without clear ownership, organizations may struggle to understand which systems agents can access, what data they can retrieve and which actions they are authorized to perform.
Poor API Documentation Becomes an AI Safety Risk
Poor API documentation has always frustrated developers. In agentic environments, it can directly affect reliability and safety.
“Humans can infer intent and recognize when something feels off, whereas AI agents cannot," said Simari. Agents depend on explicit definitions describing inputs, outputs, constraints and failure conditions. When documentation is incomplete or unclear, agents may execute instructions exactly as written while still producing undesirable results.
Lava addded documentation has evolved from a developer convenience into a critical operational requirement.
“Agents rely on API documentation when making selections about access methods to key systems,” she explained. A lack of documentation can cause agents to create redundant APIs, misuse existing interfaces or expose sensitive information through inappropriate API calls.
AI Agents Can Multiply API Risk in Seconds
Security and compliance concerns become more difficult when agents operate continuously across multiple systems.
Agents can chain actions together without the natural pauses that typically occur during human-led processes, Simari noted. In fragmented environments, that increases the potential for unintended access, privilege escalation and policy violations that may be difficult to detect.
The challenge is often less about individual insecure APIs and more about inconsistent governance across large collections of interconnected endpoints.
Lava added that she sees similar concerns, noting fragmentation widens the security and compliance surface.
Multiple gateways and management systems can result in uneven enforcement of authentication, rate limiting and threat detection controls. Logging and audit trails may also be scattered across systems, making it difficult to reconstruct exactly what an agent accessed or did.
The growing number of machine identities required by agents further complicates governance, particularly when those identities receive broader permissions than necessary.
Every Agent Action Needs an Accountable Owner
Simari argued that API management should be viewed as an operating model rather than a technical checklist. Priority areas include clear ownership, machine-readable contracts, scoped access controls and monitoring tied to business outcomes.
Even strong API practices, however, do not eliminate risk if accountability remains unclear.
“Without aligned data governance and decision accountability, organizations can appear technically ready while remaining operationally exposed,” Simari said. “Even with flawlessly designed APIs, you haven’t mitigated your risk until you explicitly define who owns the decisions those APIs are executing.”
From Automation to Intelligence: How Leading Teams Are Rethinking Operations
Register
Ai4 2026
Register
Content Leaders Collective: When Your Documentation Tools Can't Keep Up
Register
The Next Era of Enterprise Experience: AI, Automation and What It Means for CX Leaders
Register
Lava pointed to unified API catalogs, governance discipline, standardization and the ability to identify unmanaged APIs as foundational requirements before organizations scale agentic AI initiatives.
How to Measure API Readiness for AI Agents
Traditional API metrics such as uptime, latency and availability remain important, but they do not reveal whether an organization is prepared to support autonomous systems.
Business leaders should focus on measures such as agent task success rates, auditability, onboarding speed and the ability to demonstrate exactly what an agent did and why, said Lava. Readiness, she argued, is ultimately measured through trust and outcomes rather than throughput.
| Traditional API Measurement | Agentic AI Readiness Measurement |
|---|---|
| Uptime | End-to-end task success |
| Latency | Reliable business outcomes |
| Availability | Authorized access |
| Error rate | Failure traceability |
| API traffic | Agent activity by identity |
| Response time | Ability to correct or reverse actions |
Organizations evaluating API readiness for agentic AI should be asking:
- Can agents consistently complete end-to-end tasks?
- Are failures visible and traceable?
- Can actions be tied back to specific APIs and datasets?
- Is it clear who owns the underlying business process?
Simari agreed that outcome reliability is the more meaningful benchmark.
Leaders should evaluate whether agents can consistently complete end-to-end tasks, whether failures are observable and attributable and whether corrective action is possible when problems occur.
“If errors cannot be traced back to specific data issues, contract gaps or governance failures, the organization is not ready, regardless of uptime or response times,” said Simari.
Editor's Note: For more on the infrastructure behind enterprise AI agents...
- NVIDIA and 30+ Companies Form Open Secure AI Alliance to Build Shared Cybersecurity Tools — NVIDIA, Microsoft, IBM and more than 30 other companies have formed the Open Secure AI Alliance.
- What Human-in-the-Loop AI Looks Like in Practice — From contract review to IT support, companies are adding human checkpoints to keep AI workflows accurate and trustworthy.
- Google Debuts 3 New Gemini Models for AI Agents — Three new Gemini models promise cheaper tokens, faster throughput and cybersecurity-focused capabilities.