The Golden Path to Become an Agentic Enterprise
- Asanka Abeysinghe
- Chief Technology Officer, WSO2
Enterprises are moving quickly on AI. Most already have employees using general-purpose AI, teams experimenting with enterprise knowledge, developers adopting coding agents, and business units exploring autonomous workflows. The harder question is no longer whether to adopt AI. It is how to move from isolated experiments to an agentic enterprise without creating a new layer of security, governance, operational, and economic risk.
There is also a sequencing problem. It is tempting to jump directly to autonomous agents, expose enterprise capabilities to external agents, or start thinking about monetization. But those later capabilities depend on foundations that need to exist first. This is the idea behind the Golden Path to Become an Agentic Enterprise: ten concrete achievements that take an enterprise from sanctioned AI access to agents operating as part of the workforce and eventually becoming products themselves.
The path combines two objectives. Some achievements are efficiency plays, focused on productivity, automation, and risk reduction. Others are growth plays, where the same governed capabilities are exposed and monetized. Growth does not appear until the enterprise has established the governance foundation needed to support it.
Start with achievements, not maturity scores
Many enterprise transformation frameworks begin with maturity levels. We deliberately took a different approach. Each step on the golden path represents an achievement that should be genuinely true. You either have an approved and attributable way for employees to use AI, or you do not. You either enforce enterprise access controls when AI retrieves company knowledge, or you do not. You either know which agent acted, under whose authority, and what it did, or you do not.
There is little value in declaring that an organization is “70% agentic.” What matters is whether the capabilities required for the next step actually exist. The path is also roughly sequential. Steps 1 through 4 establish the governance foundation, and most later achievements depend on that foundation. Coding agents, covered in step 5, are the main exception because they can progress in parallel using many of the same governance principles.
The ten achievements
The path moves through ten achievements:
- Sanctioned access gives employees a safe, attributable way to use AI while reducing shadow AI.
- Safe general-purpose use adds guardrails, data protection, and economic controls around general-purpose AI.
- Grounded enterprise knowledge connects AI to enterprise information while enforcing existing access rights at query time.
- Central governance with distributed enforcement establishes common enterprise policy while allowing controls to be enforced close to the teams, systems, and actions they govern.
- Governed coding agents extend the same governance model to software engineering, including access to source code, repositories, development tools, and delivery pipelines.
- Exposure of capabilities to external agents makes enterprise capabilities discoverable and consumable through governed APIs and MCP servers.
- Monetization of capabilities adds entitlement, metering, pricing, and billing so those capabilities can become revenue-generating products.
- Fully automated operational processes move beyond AI assistance toward agent-first execution of complete business processes.
- Agents included in the workforce allows agents to act under explicitly delegated human authority rather than relying on broad standing service credentials.
- Agent Monetization packages agents themselves as products, including the isolation, governance, evidence, and commercial model required to operate them for external customers.
These are not ten unrelated AI projects. Each achievement expands what AI can access, decide, or do, which also increases the importance of identity, policy, authorization, safety, evidence, and economic control.
Build the governance foundation first
The first four achievements are the most important part of the path because they create the foundation everything else depends on. The starting point is basic but necessary: employees need an approved way to use AI. Simply blocking public AI tools does not solve the problem. Without a viable sanctioned alternative, usage moves outside the visibility of the enterprise.
Once access exists, the enterprise needs guardrails around data, prompts, model traffic, and cost. AI consumption is non-deterministic, so a poorly designed workflow can create both a security problem and an unexpectedly large bill. Governance therefore needs to include economic controls from the beginning, not as an operational concern added later.
The next step is grounding AI in enterprise knowledge. At this point, the AI system starts crossing meaningful data boundaries. Retrieval needs to respect the user’s existing entitlements at query time. A vector index or knowledge base that exposes information the user cannot normally access is simply another form of data breach.
The fourth achievement brings these controls together through central governance with distributed enforcement. Centralizing every AI decision does not scale, but allowing every team to implement its own governance model creates fragmentation. Enterprises need centrally authored policies with enforcement distributed to the points where models, tools, data, APIs, and agents are actually used. That pattern is also central to Trusted AI Governance. Governance has to operate where intent becomes action, not only through policies and reviews performed outside the runtime.
Extend governance to software engineering
Coding agents deserve explicit attention because they are likely to become one of the most widely adopted classes of enterprise agents, and they also have significant reach. A coding agent may be able to read proprietary source code, inspect infrastructure, call development tools, generate dependencies, modify code, and interact with CI/CD systems. The productivity upside is significant, but so is the blast radius.
The answer is not to isolate coding agents from the broader AI strategy. The enterprise should extend the same governance model already established for other AI use cases. That means sanctioned model endpoints, scoped repository access, short-lived credentials, protected branches, security and dependency scanning, license checks, and human review before changes reach production. Getting this right early matters because coding agents are not only another AI use case. They increasingly become part of how the enterprise builds every other AI use case.
Move from governance to growth
Once the governance foundation exists, the path opens a second dimension: growth. The first growth play is exposing enterprise capabilities to external agents. Enterprises already expose capabilities through APIs, and agentic systems add another consumption model through protocols, such as MCP. APIs and MCP tools therefore become part of a broader capability layer that agents can discover and invoke.
This changes the role of the enterprise catalog. It is no longer only for developers finding APIs. It becomes the system of record for capabilities available to internal and external agents, including their owners, scopes, policies, and consumption limits. Once those capabilities are governed, attributable, and metered, monetization becomes much easier.
The underlying principle is simple: build the governed capability layer once, then reuse it across applications, agents, partners, and business models. At that point, charging per API call, tool invocation, token, transaction, tier, or business outcome becomes primarily a product and pricing decision rather than a new integration project.
Move from assistants to agents at scale
The final three achievements represent a significant shift because the enterprise moves from people using AI to AI participating directly in operations. First, agents begin executing complete operational processes. The unit of value changes from individual productivity to process throughput, which requires every agent to have an identity, bounded authorization, observable execution, evaluation, and a reliable way to stop or escalate behavior.
Then comes delegated authority. Most enterprise systems were designed for either human identities or service accounts, and neither model is sufficient for agents acting on behalf of people. An agent should be able to act under explicitly delegated authority that is task-scoped, time-limited, auditable, and revocable. The enterprise needs to preserve the authority chain from the person delegating the task through the agent to the systems where actions occur. Delegation is not impersonation.
Finally, enterprises can package agents themselves as products. At this stage, hard tenant isolation, independent evaluation, agent identity, evidence, controls, cost attribution, and outcome-based commercial models become part of the product architecture. The move from an internal agent to a revenue-generating agent product is therefore much more than changing who can access it. It requires the earlier governance achievements to be real.
Efficiency and growth run on the same foundation
One of the most important ideas in the golden path is that efficiency and growth are not two independent AI strategies. The same governed capability foundation supports both. Sanctioned AI, enterprise knowledge, coding agents, process automation, and delegated agents primarily improve efficiency, while exposing capabilities, monetizing those capabilities, and eventually monetizing agents create growth.
The second set depends on the first. An enterprise cannot safely expose capabilities it cannot inventory. It cannot monetize calls it cannot attribute or meter. It cannot sell an agent as a product if it cannot isolate customers, reconstruct actions, enforce policy, or establish who authorized what. Governance is therefore not something that sits in opposition to AI growth. Done correctly, governance is what makes the growth plays possible.
There is no shortcut to becoming agentic
The goal of the golden path is not to prescribe one technology stack or force every enterprise through an identical transformation program. Enterprises should enter the path wherever they already are. Many organizations have already made progress on sanctioned AI, general-purpose AI, and enterprise knowledge. Some are already experimenting with coding agents and process automation, while far fewer have solved delegated agent authority, external agent ecosystems, or agent monetization.
The important part is understanding the dependencies. You can accelerate the path, execute some parts in parallel, and use different technologies to implement it, but you cannot sustainably skip the foundations. The end state is not simply an enterprise with more AI. It is an enterprise where people, applications, APIs, data, and agents can operate together under a common architecture of identity, governance, integration, engineering, and control.
That is what makes an enterprise genuinely agentic.
Read the full methodology
This article is a summary of the Golden Path to Become an Agentic Enterprise. The full methodology goes deeper into each achievement, including what you need, why it matters, how to measure progress, who owns it, where it can fail, and the controls required to make it work safely.
Read the full methodology on GitHub : https://github.com/wso2/reference-methodology/blob/master/golden-path-agentic-enterprise.md