Gravitee CEO argues agent complexity, not autonomy, is enterprise AI's real risk
VentureBeat published a piece labeled "Presented by Gravitee" on the danger of complexity in enterprise AI agent deployments. The text names its author only once, in a closing bio line identifying him as Rory Blundell, CEO at Gravitee, an API governance vendor.
Blundell's central argument is that enterprises rarely run a single agent in isolation. They deploy fleets of agents that call APIs, call each other, and reach into business applications that were never designed for a machine decision maker. He argues the danger compounds with the number of connections between agents rather than with the number of agents itself: adding a second agent to a system adds one connection, but adding a tenth can add not ten new connections but potentially dozens, because any agent might call any other and each of those calls can trigger further calls elsewhere. A support ticket that once touched a single system might now pass through four agents before a human sees it, and each handoff is a decision point nobody explicitly approved.
He writes that most enterprise AI programs stall once the people responsible for their agents lose track of what those agents are doing: security teams often cannot say which agents can reach which systems, or trace which agent triggered a given downstream action several steps back. He argues that treating this as a one-time checklist, approving and logging an agent and moving on, is the wrong instinct, because complexity runs across a chain of actions rather than sitting at a single point in time.
To illustrate where governance breaks down, he offers two scenarios that the piece presents as illustrative rather than as reported incidents. In the first, someone builds an agent to summarize support tickets and grants it broad API access rather than taking the time to scope it properly; months later that agent has a path into the payments system that nobody remembers approving. In the second, five agents touch one workflow, something fails at the fourth step, and no one was ever assigned to own that link in the chain.
Blundell's proposed fix has three parts. First, agent-level identity: every agent should exist as its own entity with its own name in a register, its own scoped authority, and a named human sponsor who answers for what it does, rather than inheriting a shadow permission from whoever deployed it. He calls this necessary but not sufficient. Second, oversight across the full chain of an agent's actions in real time, rather than in a report compiled once a quarter, so that identity records do not simply pile up while the system as a whole stays unexplainable. Third, and what he calls the piece most programs skip, enforcement: the ability to stop an out-of-policy agent call before it executes, rather than only logging the breach for a review weeks later. He distinguishes a dashboard that shows a breach after the fact, which he calls monitoring, from a system that stops the breach from happening, which he calls governance, and argues enterprises need both but usually build only the first.
The piece closes by framing this as urgent without endorsing caution: it argues the enterprises handling agent complexity well are not slowing down but building toward what it calls "Human-Agent Harmony," a term named once without being defined, where scale and accountability grow together instead of trading off against each other. Its closing argument is that the real risk was never a single agent doing what it was built to do, but a hundred of them doing that at once in combinations nobody designed for, and that solving for complexity turns autonomy from the villain into the point. The piece cites no data, statistics, named case study, or third-party research; every scenario used to make its case is a hypothetical, not a reported event.
Key facts
- VentureBeat marks the piece "Presented by Gravitee"; the text names its author only once, in a closing bio line identifying him as Rory Blundell, CEO at Gravitee, an API governance vendor.
- Its central claim: complexity compounds with the number of connections between agents, not with agent headcount, so a tenth agent added to a system can bring not ten new connections but potentially dozens.
- It argues governance needs three layers: agent-level identity (its own name, scoped authority and human sponsor), oversight across the full action chain in real time, and enforcement that stops an out-of-policy call before it executes rather than just logging it.
- Its two illustrations of failure, an agent's permissions creeping into the payments system, and a five-agent workflow breaking at step four with no assigned owner, are presented as hypothetical scenarios, not reported incidents.
- It names "Human-Agent Harmony" once as the goal enterprises should build toward but does not define the term or say whether it is a Gravitee product or framework.
Why it matters
Enterprises are moving from single pilot agents to fleets of them, and this piece argues that the risk scales with the number of connections between agents rather than with how many agents exist, a distinction that changes what governance should even measure. If that framing holds, counting and approving individual agents misses the actual risk surface, which is the graph of calls between them and shifts as fast as the fleet does, not a fixed set of checkboxes signed off once.
Who it affects
Enterprise platform, security and AI teams running or governing more than one agent, particularly whoever signs off on an agent's API scope and any security team asked to trace which agents can reach which systems or which agent triggered a downstream action. It is also relevant to buyers evaluating AI agent governance and API management tooling, the market Gravitee, the piece's sponsor, sells into.
How to use it
The piece lays out a three-part checklist an enterprise could apply directly: give every agent its own named identity, scoped authority and human sponsor in a register; build oversight that tracks an agent's downstream actions across the full chain in real time rather than in periodic reports; and add enforcement that can block an out-of-policy call before it runs, not only log it afterward. It names no specific product, feature list or price, though Gravitee itself sells into this category, so the argument doubles as a case for that kind of tooling without naming one.
How solid is it
This is sponsored content, not independent reporting: VentureBeat labels it "Presented by Gravitee" and the text identifies its author, Rory Blundell, as Gravitee's CEO only in a closing bio line. It cites no data, statistics or named real-world incident. Both scenarios used to make its case, the payments-system permission creep and the five-agent workflow breaking at step four, are explicitly illustrative rather than reported events, and the piece names no third party, study or customer.
Risks and caveats
Read the argument as a vendor's framing of a problem it sells a solution for, not as an audited finding. The specific figures used for effect, such as a tenth agent adding potentially dozens of new connections, are illustrative math rather than a cited measurement, so they should not be read as data. "Human-Agent Harmony" is introduced once and left undefined, so this piece alone does not establish whether it names a Gravitee product, a marketing phrase, or a general philosophy.
“The real risk was never a single agent doing exactly what it was built to do. It's a hundred of them doing exactly that, all at once, interacting in combinations nobody designed for.”
— Rory Blundell, CEO at Gravitee, in a VentureBeat piece presented by Gravitee