Your Agents Are Reading the Wrong Dictionary

Late last year, at an industry event, David Irecki got talking to a chief human resources officer. The CHRO’s company had a rule: Every time someone built an AI agent, that agent went into the HR system and got an employee number.

After that it was treated like staff. Onboarded, monitored, and when it misbehaved, offboarded (in human terms: fired).

“Organizations are definitely looking at different ways of trying to solve that problem,” says Irecki, chief technology officer for Asia Pacific and Japan at Boomi. A Hong Kong power utility I interviewed this year is doing much the same, for reasons that have nothing to do with HR. Nobody there could say who built which agent, or what happened if one reached across a border it shouldn’t.

Three questions underline both stories, and most enterprises can’t answer any of them. How many agents are running? What do they read? Which of them should exist at all?

The first has a vendor answer. The third has a rule of thumb. The second is where most programs quietly break, and almost nobody looks.

Start with counting.

The number nobody can verify

Boomi says more than 90,000 AI agents now run in production across its customer base, up from 75,000 a few weeks earlier and about 33,000 a year before that. It treats that curve as evidence of 2026’s real failure mode: Not weak models, but agents nobody approved.

Of those 90,000, how many did a CDO sign off on, and how many did Boomi’s tooling find afterward? “It’s a very interesting question,” Irecki said, adding that the answer was not obvious.

Instead, he sees the range in person. At previous CDO roundtables, one attendee was still fighting basic data quality while the person beside them has 500 agents live and no idea who built them.

Speed changes the stakes. A human analyst is rate-limited by the accounts they can get. An agent is not: it reaches data at “essentially the speed of light,” Irecki says. The same over-broad permission that once exposed one folder now exposes everything the agent can reach, in a single pass.

What a control tower can and cannot see

Counting is part of what Boomi sells. Agent Control Tower is a console meant to show every agent in the business, whether built in Boomi, Microsoft Copilot, Salesforce or Snowflake Cortex: what data it touches, what prompts it runs, and how many tokens it burns. “If they’re hallucinating, turn them off,” Irecki says.

Ask where the view stops and he doesn’t pretend it doesn’t. The architecture explains the limit. This is federation, not discovery — the pattern Boomi bought in 2024 with APIIDA, whose product governed eight or nine vendors’ API gateways from one pane. Boomi added Snowflake Cortex agents to that view in June. The console never scans your network; it reads what other control planes publish.

“If we can actually get access to the metadata around how the agent’s running, then we can govern it for you,” Irecki says.

“Why would you give payroll to an agent? And the agent goes, oh, do I feel like paying David on the 30th of this month or not? That's a deterministic process.” — David Irecki @ Boomi

The conditional does the work. Some agents publish nothing. Google’s answer is the agent card, an ID badge an agent posts at a fixed address so anything it meets can read what it does; Google handed the underlying protocol to the Linux Foundation and the specification is public. Irecki wasn’t sure where that discussion had landed, which is the point. A published standard is not an adopted one. “You’re not going to cover everything,” he says.

I asked what he tells a customer whose agents were never registered at all. “If the agent was never registered, then there could be a policy issue on the company side,” he says.

He’s right.: No governance product finds what your organization never required anyone to declare. The tool enforces a policy; it does not write one.

The enforcement, at least, keeps getting stronger. At its Sydney event in early September, Boomi launched an Agent Control Plane built on Lunar.dev, an AI and MCP gateway it agreed to buy in May and closed on in July. It sits in the traffic path between an agent and SAP, Oracle or Workday, applies rate limits, and holds high-risk transactions for human approval.

Which is worth digging further on, because it is the whole pattern in miniature. APIs sprawled, then Boomi bought federation. Data pipelines fragmented, then Boomi bought Rivery. Agents sprawled, then Boomi bought a gateway. Put that to Irecki as one architecture versus several acquisitions sharing a login screen, and he rejects the framing — they are capabilities inside one platform, he says, and the pattern itself is the defense. “I’d sum it up in one word: agility.”

Agility is the accurate word. It is not the same as foresight. Every capability arrived after the problem it governs, which buys stronger brakes each year and leaves the declaration problem exactly where it was. That matters more than it did two years ago: since Salesforce absorbed Informatica for USD8 billion in November 2025, Boomi is one of the last scaled independents left, and private-equity owned since the USD4 billion Dell buyout in 2021.

Two doors, and a missing dictionary

Say you can see every agent. The second question is harder: what are they reading?

Data gets to an agent through two doors, and CDOs have spent a decade on the wrong one. Door one is structured: rows, fields, and keys. The industry solved it years ago. Change a customer’s address in the CRM, detect the change, replicate it downstream to the ERP. Change data capture, master records, integration. Mature, and billable.

Door two is everything else. PDFs, contracts, audio, video, and the shared mailbox. “How do you feed that into AI and get that same level of quality?” Irecki asks. The mechanism is vectorization, which is chopping documents into fragments and turning each into a numeric representation of meaning so an agent can retrieve the relevant one.

That mechanism carries a flaw worth understanding further. Vector retrieval returns what is semantically similar, not what is correct inside your business. If two departments use a phrase differently, the embedding doesn’t know, and hands the agent the wrong department’s version with total confidence.

“High priority might mean something different to you and something different to someone else in the business.” — David Irecki @ Boomi

So the least glamorous thing in Boomi’s stack matters most. Meta Hub, launched in March 2026, is in Irecki’s words “a business glossary for agents.” It is where the organization writes down what a tag or a phrase actually means. “High priority might mean something different to you and something different to someone else in the business,” he says.

Anyone who has sat through a definition war over ‘active customer’ knows this isn’t academic. It’s why two dashboards disagree. The difference now: a dashboard waits for a human to notice. An agent acts.

That context is also the only durable advantage on offer, Irecki argues. Frontier models are converging; they train on broadly the same internet, and the labs now buying and scanning physical books to differentiate themselves will land in much the same place. “It’s your business knowledge that’s the differentiator,” he says. “That’s your moat.”

The payroll test

Count the agents, fix the meaning, and one question remains. Should this work go to an agent at all?

Irecki’s filter costs nothing and kills a lot of bad projects. Ask whether the problem is probabilistic.

“Why would you give payroll to an agent?” he says. “And the agent goes, oh, do I feel like paying David on the 30th of this month or not? That’s the deterministic process.”

It sounds like a joke. But it’s really a governance rule. Generative systems are good at summarizing, searching and reading messy documents, and a poor fit for work with one correct answer and a legal consequence attached. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027, citing cost, unclear value and weak risk controls. Some of those will be deterministic work handed to a probabilistic system because agents were what the board funded.

Risk tolerance decides the rest. A retail agent recommending a green shirt to someone who hates green harms nobody. A healthcare agent recommending medicine has no margin for error.

What “working” looks like

So what does a CDO who answered all three questions — How many agents are running? What do they read? Which of them should exist at all? — look like in a year? “They have outcomes they can speak back to,” says Irecki.

He points to Lexitas, a U.S. legal services firm that put Boomi agents into payment matching in February. Its bank sends more than 2,500 payment lines a day, many with no invoice number attached, and a small accounting team used to hunt through systems and old email to reconcile them.

The result comes in two numbers that measure different things. Boomi’s case study claims 30% of those payments now resolve with zero human involvement. Constellation Research reported 46% of the process handled by agents. The gap is the human still in the loop, and a CDO should ask which number a vendor is quoting before celebrating either.

His warning sign before signing anything is over-reliance on AI in the delivery estimate. Anyone can demo two systems connecting in eight minutes. Production still asks who holds the credentials, which data exists, who may see it, and where the servers sit. “AI is not a panacea. It’s not a magic pill.”

Which returns us to the HR system and the agent with a staff number. It’s a crude instrument, and it catches only the agents somebody chose to declare. It still beats having no number at all.

But an employee record fixes the first question and leaves the second untouched. An agent with a staff ID and a manager can still read “high priority” the way marketing means it, act on a finance request, and file the result with complete confidence. Counting is the problem a CDO can see. The dictionary is the one that decides whether the count was ever worth having.

Image credit: iStockphoto/mars58