Deploying AI at Scale: How Enterprises Are Rolling Out AI, and Where It Is Heading

Enterprises are not choosing one way to deploy AI. They are running five patterns at once, mostly by accident, and the ones that scale are the ones that treat control as the product.

• Five patterns are in play: managed desktop assistants, self-hosted open agent runtimes such as OpenClaw, agents embedded in SaaS, custom agents on model APIs, and governed agent platforms. Each suits a different class of work.
• Desktop assistants are the front door, not the whole house. Sanctioned access now reaches about 60% of workers, yet daily use among them has not moved. Value comes from packaged, centrally published workflows, not from licenses.
• Distribution is the unsolved problem. Prompts, skills, scheduled tasks and connectors spread person to person. Vendor admin tooling now covers plugins reasonably well, connectors coarsely, and scheduled tasks only through coarse on or off switches.
• Self-hosted runtimes are a security event, not a strategy. OpenClaw showed tens of thousands of exposed instances within weeks of launch. Most enterprises are discovering it, not deploying it.
• Governance trails adoption by a wide margin. 74% of leaders expect at least moderate agent use by 2027. Only 21% report mature agent governance.
• Cost is the second wall. 73% of organizations exceeded AI cost projections. Agentic workflows cost an order of magnitude more per interaction than chat. Model routing and retrieval quality are bigger cost levers than where the model is hosted.
• Our forecast: agent registries, identity-provider-managed connectors and model-independent enforcement become standard enterprise controls by the end of 2027. Unattended work moves out of personal assistant accounts onto governed platforms.

The practical advice is to assign work to patterns deliberately, put nine controls in place regardless of vendor, and budget by workflow rather than by seat.

No large organization runs one pattern. Most run three or four at once, usually without having chosen to. The useful question is which pattern carries which class of work, and who owns the controls for each.

Pattern 1 is the default on-ramp. Anthropic made its Enterprise plan self-serve in February 2026, with SSO, SCIM and admin controls included, which removed the procurement barrier for mid-market firms (guide). Cowork then added private plugin marketplaces, per-user provisioning and auto-install so admins can push packaged skills and connectors to teams (Anthropic).

Pattern 2 is where the risk concentrates. Microsoft's security team reports self-hosted runtimes like OpenClaw showing up fast in enterprise pilots, and states plainly that OpenClaw ships with limited built-in security controls (Microsoft Security). SecurityScorecard observed 40,214 internet-exposed OpenClaw instances in February 2026, with 35.4% flagged vulnerable (Sangfor summary). Few enterprises are formally rolling OpenClaw out. Far more are discovering it already installed.

Pattern 3 arrives whether you choose it or not. Gartner forecast that 40% of enterprise applications would include task-specific agents by the end of 2026, up from under 5% in 2025 (Gartner). Every SaaS renewal now carries an agent decision.

Pattern 4 is where most failed pilots sit. Custom builds deliver the most differentiated value and the worst completion rate, covered in the trends section.

Pattern 5 exists because of the other four. Once an organization has assistants, embedded agents and custom agents running side by side, it needs one place to answer three questions: what agents exist, what may they do, and what did they do.

Every pattern above also carries a choice of whose model runs, where it is hosted, and what business knowledge it is grounded on. That choice moves unit cost and data posture more than the pattern does. A companion paper covers it in depth; this section is the summary.

Self-hosting is a utilization question, not a price question. Published break-even estimates disagree widely because most hide idle GPU time and staffing. One analysis that includes idle capacity, peak over-provisioning and a senior infrastructure hire puts the break-even at $50,000 to $80,000 per month of premium API spend. A hybrid design, reserved capacity for steady load and API for the spiky tail, lowers that to roughly $25,000. Below $15,000 the API wins on every realistic spreadsheet (Particula). Hosted open-weight APIs undercut both proprietary APIs and self-hosting at light and medium volume (SitePoint). The 500-person firm in the budget section spends about $31,000 per month on usage, which places it in hybrid territory and well short of a pure self-hosting case.

Routing beats hosting as a cost lever. Sending routine traffic to a cheap or self-hosted model and hard tasks to a frontier API frequently beats either choice alone, with reported savings of 30% to 50% (KKRF). Self-hosting fits high-volume, narrow, predictable work such as classification, extraction and summarization. It rarely fits bursty knowledge work.

Retrieval and fine-tuning solve different problems. Axionic's position: retrieval is for knowledge, fine-tuning is for behavior. Most requests to teach the model our business are retrieval problems, because the facts change and need citations. Fine-tuning earns its place for format, tone, and making a small, cheap model good at one narrow job. Retrieval quality is also a cost lever in its own right. Fewer, better passages shrink the context on every call and let a smaller model do the work.

Data bleed is mostly a retrieval problem, not a hosting problem. Commercial API terms already exclude training on customer data. The exposure that actually occurs is permission flattening. Indexing content from many systems into one vector store merges their permission models into a single retrieval surface, so a user can receive answers drawn from documents they could never open (Tian Pan). One consultancy's audits reportedly found material oversharing exposure in around 80% of Microsoft 365 Copilot deployments (BuildMVPFast, secondary source). The fix is architectural: tag every chunk with access metadata at index time and filter by the user's permissions inside the query, not after it (Wavect). This risk is identical on premises and in the cloud.

Giving people a desktop assistant is easy. Distributing the working knowledge that makes it useful, and keeping that knowledge governed, is the hard part. Four artifacts need an owner, a version and a distribution channel.

The vendor tooling has improved but still has gaps. In Claude Cowork, admins can run a private plugin marketplace, pre-approve plugins and scope them to SCIM groups. Connectors, however, are org-wide on or off, with no per-group control, and each user then authorizes individually (Anthropic admin guide). Anthropic's own guidance says some governance still requires manual processes outside the product.

A private marketplace is also a supply chain. Harmonic Security notes that a GitHub-synced marketplace pushes updates to all users when a version bump merges, so a compromised commit reaches everyone. It also notes that plugin hooks are not covered by Anthropic's scanning (Harmonic).

Connectors are the sharpest edge. Server-level on or off is too coarse: one payments connector can expose both a balance lookup and a refund action (Zuplo). The June 2026 Enterprise-Managed Authorization extension to MCP moves provisioning to the identity provider, so users get the servers their role allows without per-server consent screens (Snowflake). That is the direction to plan for.

Scheduled tasks are the least governed of the four. All three major assistants now run them server-side, so they keep firing with the laptop shut, but admin control is a coarse switch at best. None offers a fleet-wide inventory of tasks with owners and costs.

Three practical consequences follow. A prompt injection that creates or alters a recurring task persists silently, so task creation is a security signal worth monitoring. Anthropic itself advises against sensitive data or consequential actions in scheduled tasks. And per-user caps limit volume but not risk: 500 users with 10 tasks each is 5,000 unowned automations.

The working rule: personal scheduled tasks are fine for briefings and reminders. Any recurring task that touches money, customers or regulated data belongs on a governed platform with a named owner, a budget and an expiry.

Access is now broad, daily use is not, and governance trails both. Five shifts over the last 12 to 18 months explain where the market sits today.

1. From chat to agents that act. Assistants moved from answering questions to operating files, browsers and business systems. That changed the risk model from data leakage to unauthorized action.

2. From seats to packaged work. Deloitte reports sanctioned AI access grew from under 40% of workers to around 60% in one year, yet fewer than 60% of those with access use it daily, unchanged from the prior year (Deloitte). Vendors responded with plugins, skills and private marketplaces. The unit of deployment is shifting from a license to a packaged role or workflow.

3. From pilots to a production gap. Deloitte's survey of 3,235 leaders in 24 countries found 74% expect at least moderate agent use by 2027, while only 21% report a mature governance model for agents (Deloitte Insights). Gartner predicted over 40% of agentic projects will be canceled by end of 2027, citing cost, unclear value and inadequate risk controls (Gartner). Survey figures for agents in production range from under 10% to over 60% depending on who is asked and how production is defined. Treat any single number with caution.

4. From shadow AI to shadow agents. The 2024 problem was staff pasting data into consumer chatbots. The 2026 problem is self-installed agent runtimes and local MCP servers holding real credentials. OpenClaw went from launch in late 2025 to tens of thousands of exposed instances within weeks (MintMCP).

5. From buying criteria of speed to criteria of control. In CrewAI's survey of 500 senior executives at large enterprises, security and governance ranked first among platform selection factors at 34%, ahead of integration at 30%. Time to value ranked last at 2% (CrewAI). That is a vendor survey, but it matches the Deloitte and Gartner signals.

The platform vendors have read the same data. Microsoft is converging its agent registries under Agent 365 as one inventory and control plane for Microsoft and non-Microsoft agents, with Entra Agent ID giving each agent an identity, an owner and conditional access (Microsoft Learn). Microsoft's own IT team describes the registry as the foundation for governance, not just an inventory (Inside Track).

The next 36 months look like the cloud decade compressed: uncontrolled adoption, a cost and security wall, then a governed platform layer. These are Axionic's forecasts, not sourced facts, and each is stated so it can be proven wrong.

The common thread is that intelligence becomes a commodity and control becomes the product. Model quality differences narrow for most business tasks. The durable differences are in who can prove what their agents did, stop them when needed, and predict what they cost.

Nine controls apply regardless of which pattern an organization chooses. The test for each is simple: can you show evidence of it to an auditor without asking the AI vendor.

The case for control 4 comes from the OpenClaw experience. Microsoft describes the core issue as the execution boundary shifting from static application code to dynamically supplied content and third-party capabilities, without matching controls on identity, input handling or privilege (Microsoft Security). Prompt injection cannot be fully patched, so defense has to assume hostile input will reach the agent (MintMCP). An agent that reads private data, ingests untrusted content and can communicate externally needs a gate that the model cannot talk its way past.

For desktop assistants specifically, Harmonic's hardening checklist is a reasonable baseline: enable the compliance API before rollout, restrict browser use to a short allowlist, use custom roles so new beta capabilities are not inherited silently, and decide deliberately whether cloud sessions are allowed, since device MDM policy does not reach them (Harmonic).

On regulation, the EU Digital Omnibus entered into force on 27 July 2026. It defers high-risk obligations for stand-alone Annex III systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. Article 50 transparency obligations still applied from 2 August 2026 (Cloud Security Alliance, Winston Taylor). For US firms with EU exposure, the delay is time to build controls 1, 5 and 6 properly, not a reason to wait.

Token prices keep falling and AI bills keep rising, because agents consume far more than chat. Budgets written on per-seat logic in 2025 are wrong for agentic work by a wide margin.

The evidence is consistent across sources:

• The FinOps Foundation's 2026 survey of 1,192 practitioners found 73% of organizations exceeded their original AI cost projections. The share of FinOps teams managing AI spend went from 31% in 2024 to 98% in 2026 (The Source Code).
• EY's example: a customer service interaction cost about $0.04 as a simple retrieve-and-respond flow in 2023 and about $1.20 as an orchestrated agentic flow in 2026, roughly 30 times more (EY).
• Uber reportedly exhausted its 2026 AI coding budget by April after coding-agent adoption jumped from 32% to 84% of about 5,000 engineers. Typical spend ran $150 to $250 per engineer per month, with heavy users near $2,000 (PointFive).

Each pattern has a different cost shape, and the budget owner needs to know which one they are funding.

Four practices hold across all five. Attribute spend to a workflow and an owner, not just a department. Route simple subtasks to cheaper models, including hosted open-weight or self-hosted ones where volume justifies it. Set alerts before the overrun, not after. Review cost in the same forum as quality, because the architecture decides the bill (Correlation One).

List prices for the major assistants

Prices in USD per user per month, checked 19 September 2026. Vendor pricing moves often.

The structural point is that Anthropic's Enterprise plan has already moved to seat plus metered usage. The seat line is fixed by headcount and the usage line is fixed by nothing. Expect other vendors to follow as agentic use grows.

Worked budget: a 500-person firm

A realistic first-year budget for a 500-person firm lands near $680,000, or about $113 per employee per month, and more than half of it is variable. The figures below are planning assumptions, not quotes. They assume Claude Enterprise as the standard assistant; a bundled-seat product changes the first two lines but not the shape.

The heavy-user figure follows the $150 to $250 per developer per month range reported for enterprise Claude Code deployments (Morph). Third-party estimates put all-in Claude Enterprise spend between $60 and $250 per user per month once usage is included (GoSearch).

Three lessons from the model. The seat fee is under 20% of the total, so negotiating seats is the wrong fight. Fifty heavy users cost more than 350 light ones, so usage caps by group matter more than license counts. And the governance lines, gateway plus enablement, are about 16% of spend, which is the cost of making the other 84% defensible.

The right answer is a portfolio, assigned by class of work. Three questions place any piece of work: who benefits, what can it touch, and does it run without a person present.

The flow above sorts a use case by autonomy first, then scope, then risk. Size changes the emphasis. A firm under 200 people can run on a desktop assistant plus embedded agents and a short policy. Past that, or in any regulated sector, the registry, connector governance and an enforcement layer stop being optional.

A sensible sequence for most mid-market firms is four steps. Inventory what is already running, including shadow agents. Standardize on one assistant with SSO and a private plugin marketplace. Put connectors behind a registry or gateway. Then move unattended work onto a governed platform, one workflow at a time, each with an owner and a unit cost.

Axionic works at the two points where this market is weakest: choosing the right mix, and governing the unattended work. The first is advisory. The second is Axionic Agents.

Advisory: AI architect, not AI agency. Most firms do not need more AI. They need a decision about which pattern carries which work, what controls each requires, and what it should cost. The AI Deployment Readiness Review produces four things: an inventory of what is already running, a placement of each use case against the five patterns, a control gap assessment against the nine controls above, and a budget model with unit costs per workflow. Axionic does not resell a model vendor, so the recommendation is not tied to one.

Axionic Agents: a pattern 5 platform. Axionic Agents is built on the premise in this paper, that enforcement has to sit outside the model. Its architecture, which is patent pending, maps directly to the controls most organizations are missing:

The last row addresses a problem the surveys do not yet measure. Once agents produce work faster than people can review it, late human review misses dependencies. Structured agent reporting keeps people in control without asking them to read everything.

How the two connect. Advisory work identifies the unattended, cross-system, regulated workflows where a desktop assistant or an embedded agent is the wrong tool. Those are the workflows Axionic Agents is designed to carry. Everything else stays on the simpler, cheaper pattern it belongs on.

Research conducted 19 September 2026. Several statistics come through vendor blogs and secondary summaries; these are labeled in the text. Scheduled-task controls and list prices are cited inline in their tables.

• Anthropic, Claude Cowork Enterprise Admin Guide and Cowork and plugins across the enterprise
• Harmonic Security, Securing Claude Cowork
• Microsoft Security, Running OpenClaw safely
• Microsoft Learn, Agent Registry convergence with Agent 365; Microsoft Inside Track, Implementing Agent 365
• Sangfor, OpenClaw security risks (secondary for SecurityScorecard data); MintMCP, OpenClaw CVEs explained; TechTarget, OpenClaw risks for CISOs
• Deloitte, State of AI in the Enterprise 2026 and Agentic AI is scaling faster than guardrails
• Gartner, 40% of enterprise apps to feature task-specific agents and over 40% of agentic projects canceled by 2027
• CrewAI, State of agentic AI in 2026 (vendor survey)
• Snowflake, Enterprise MCP gateway guide; Zuplo, What the best MCP gateways do
• EY, Agentic AI enterprise token cost; The Source Code, Token costs and the AI business case (secondary for FinOps Foundation data); PointFive, The 2026 cost visibility gap; Correlation One, Managing AI token costs
• Particula, Self-host vs API break-even; SitePoint, Local LLMs vs cloud APIs; KKRF, Self-hosted LLM vs API
• Cloud Security Alliance, EU AI Act high-risk deadline deferred; Winston Taylor, AI Digital Omnibus agreed