How to Adopt AI Agents Securely at Scale: The 4 Zones of Automation
When Vercel disclosed its breach in April, the way in was not a zero-day. It was a third-party AI app one employee had connected to their corporate Google Workspace with broad permissions. The attacker compromised the app, took over the account through the existing OAuth grant and pivoted into Vercel's internal systems from there.
That is the exact failure mode Marco van Hurne has been describing for years. He calls it Russian roulette with AI agents, and it was the starting point for a working session with Johannes Keienburg, Founder and CEO at Cakewalk, on adopting AI agents securely at scale.
Van Hurne has been in machine learning since 2008. He runs the AI factory at ASML, the company that builds the lithography machines the semiconductor industry depends on, and he lectures on process automation in the Netherlands. He recently finished a field study covering 177 companies running autonomous agents in production. The findings are not comforting, and they are very useful.
Here is what the session covered.
Key Takeaways From the Session
- Van Hurne's research sorts AI automation work into four zones based on complexity and risk. Zones 1 and 2 form what he calls the identification ceiling, the realistic share of processes today's autonomous agents can take on, currently around 35%.
- Roughly 70% of high-value agent projects in zone 3 still fail. Security and compliance are part of why, but the quieter reason is ROI: the human oversight needed to run agents safely in high-risk processes can cost more than the automation saves.
- To address the security risks specifically, van Hurne's fix is not a new model or another guardrail. It is to stop treating agents like software and start onboarding them like employees, with scoped credentials, their own identity, defined roles and revocation when the job ends.
- Security, permissions, identity and compliance all roll up into trust. Trust is the asset at stake. An agent that sends a bad email from the company's domain has not breached anything technical, but it has spent trust nobody can reclaim.
- The most dangerous agent in most companies is not a zone 3 system under heavy supervision. It is a zone 1 agent with broad, static access and no oversight. Governance risk is shaped by access scope, not task complexity.
- Human-in-the-loop oversight degrades fast. After enough approval prompts, people stop reading and start clicking yes. The fix is fewer, smarter escalations, not more.
- AI is task-oriented, not job-oriented. Job taxonomy data shows the maximum automation level for any given role is around 70%, not 100%. That changes the headcount conversation.
The Vercel Pattern, and Why It Keeps Happening
The Vercel chain is worth pausing on, because it is going to be the template for a lot of incidents.
One employee. One AI app connected to a corporate Google Workspace account with broad scopes. The app's vendor was compromised, and the attacker rode the existing trust relationship straight into the company. No one had to break Vercel's perimeter, because the agent was already inside it with credentials nobody was actively monitoring.
Van Hurne's point in the session was that this is not an edge case. It is the median case for how agents get deployed today. Someone connects a useful app, grants it more access than it needs because that is the easy path, and nobody reviews it again. The agent ends up with static, over-scoped access and an identity that looks exactly like a trusted human.
"Five out of six times the agent does its job. The sixth time costs more than the first five saved."
Vercel's customers were the sixth pull.
The Four Zones of AI Automation
Van Hurne's research produced a map, and it was the most useful framework of the session. He sorts processes into four zones by how repeatable, risky and complex they are.
Zone 1 is highly repeatable, low-risk, high-frequency work with lots of people in it. Invoice scanning. Email triage. Pulling data out of messages and into a spreadsheet. About 27% of the cases he studied sit here, and if a process is correctly identified as zone 1, the chance of automating it successfully is around 70%. The catch: these are point solutions. They work, but they do not move the needle on company economics. His phrase: zone 1 is the cherry, not the cake.
Zone 2 looks like zone 1 with some coordination and a bit of human-in-the-loop. Financial reporting, where an agent collects and organizes data and drafts the PowerPoint, is a good example. Roughly 12% of cases. Together, van Hurne calls zones 1 and 2 the identification ceiling, currently around 35%, which is roughly the share of processes today's autonomous agents can realistically take on.
Zone 3 is where the value actually lives, and where the trouble starts. High process complexity, edge cases, compliance risk and explainability requirements. Van Hurne's example is a gross margin review under Sarbanes-Oxley (SOX), the US financial reporting law that requires every step in financial controls to be explainable and auditable. To automate that kind of review, he says, you essentially need one AI checking another. About 30% of processes sit in zone 3, and they are rich in humans, which is exactly why automating them is so attractive. It is also why roughly 70% of projects in this zone fail with current AI.
Zone 4 is human judgment. Ethics, legal exposure and high-risk strategic decisions, the things we want humans making on purpose. Publishing a company's annual financial report is van Hurne's example: technically zone 3, but treated as zone 4 because the downside is too big. He also points to the kind of automated decision-making that, done badly, has caused tax authorities to wrongly flag citizens as fraudsters. A small share of processes, and in his view it stays human, partly because the EU AI Act now requires it to.
One clarification that helped the room: these zones describe the work being automated, not the AI doing it.
Why Most Agent Projects Die Above Zone 2
The interesting part is why zone 3 fails, because the reason is usually not what people expect.
Yes, there are technical failures. But van Hurne's data points more often at ROI failure. Zone 3 needs observability, explainability and a human-in-the-loop team watching it. If that oversight team has to grow to keep the agents safe, the project stops breaking even. And if it is not breaking even, why automate in the first place?
So the project does not fail because the model could not do the task five times out of six. It fails because the sixth time, plus the cost of the people watching for the sixth time, erases the gains. Compliance requirements, deterministic guarantees and the team needed to fix problems are what push otherwise promising projects underwater.
This is the part most agent pilots underestimate. The model demo is the cheap 80%. The governance and oversight are the expensive 20% that decides whether the thing survives contact with an auditor.
Why Trust Is the Umbrella Over Security
Toward the end of the session, the conversation moved from security mechanics to what is actually at stake when an agent acts on a company's behalf.
Van Hurne's framing was that security and trust are not opposed. Security feeds into trust. So do permissions, identity, access and compliance. They are layers underneath one outcome: whether the company can be trusted to do what it said it would do, and nothing else.
His prediction for the next few years sharpens this. As more companies run on similar models and similar processes, the place where they actually compete will narrow. Process advantages will erode. Brand, and the trust that sits underneath it, becomes the durable asset. The moment an agent sends something from a company's domain that it should not have, even without a technical breach, the company has spent trust it cannot get back.
His test for whether a process belongs in zone 3 is a good gut check: would you board a plane flown by an agent? He would not.
The Most Dangerous Agent in Your Stack Is Probably a Zone 1 Agent
Keienburg closed the session with a deliberately unfair question for van Hurne: which scares him more, an autonomous zone 1 agent with no oversight wired into company systems, or a well-supervised copilot stuck in a zone 3 process?
Van Hurne picked the zone 1 agent without hesitation. The reasoning is the key point of the whole session and the part most companies miss.
A zone 1 process is, by definition, low-stakes work. Email triage, data entry, invoice handling. The instinct is to assume the agent doing this work is also low-stakes. That instinct is wrong, because the risk of an agent is shaped by what it can access, not by what it is asked to do. A zone 1 agent connected to Google Workspace with broad OAuth scopes is one compromised app away from being the Vercel pattern, regardless of how innocuous its day job is.
Keienburg pushed the same point from another angle: even if the agent does exactly what it is supposed to do, the moment it can reach sensitive systems on a static, over-scoped credential, the security and trust problem already exists. You do not need a hallucination or a malicious prompt to get burned. You just need an unsupervised agent with access that is broader than its task.
This is the practical implication for any security or IT team running agents today: stop sorting governance priority by task complexity, and start sorting it by access scope. Most agent governance gaps live in zone 1, not zone 3.
The Agents-as-Employees Fix
When Keienburg asked how van Hurne actually handles this operationally, the answer was straightforward. He treats agents like employees.
A process is a collection of tasks. AI is displacing tasks, not jobs. So an agent that performs tasks should be onboarded the way a person is: given a role, the rights that role needs, its own identity and an offboarding when the work is done. He does not let an agent read his inbox as him. He gives it guest access with its own credentials and its own authority level, so when it acts, it acts as itself, not as him.
That distinction matters more than it sounds. It is the difference between an agent inheriting a human's entire footprint and an agent having a scoped identity that can be reasoned about, reviewed and revoked. Onboarding. Roles and rights. Review. Revocation. Revocation in particular is the step most companies forget, and it is the one that would have contained the Vercel incident.
The Consultant Analogy
Keienburg offered an analogy during the conversation that van Hurne agreed with. If a company hires an outside consultant for a specific job, it does not hand them static access to every room in the building, broad permissions to take data out and the ability to modify systems they have no business touching. The access is scoped to the work.
Yet that is exactly how most agent credentials are issued today. The agent gets a broad API key or OAuth grant. The app sees valid credentials and allows the request. Nothing checks whether the specific action the agent is taking right now is inside the scope of what it was actually asked to do.
An agent is not a human identity. It is also not the kind of non-human identity that has been managed for the last decade, because those had far less autonomy. It is a new category, and it needs access tied to the job in front of it, not to whoever signed the agreement.
Authorization Fatigue, and Why Human-in-the-Loop Breaks
Everyone reaches for human-in-the-loop as the safety net. The data, and a lot of personal experience in the room, says it degrades fast.
Keienburg flagged decision fatigue from his own use of coding agents. Early on, he read every proposed action carefully. A few weeks in, he found himself clicking yes, yes, yes, yes to get the work done. At machine speed, that point arrives quickly. When an agent escalates dozens of decisions an hour, the prompts become noise, people auto-approve and the oversight becomes theater. Some attack patterns exploit this directly, slipping past the human who has stopped reading.
The answer is not more approvals. It is fewer, smarter ones. Only surface the genuinely ambiguous cases and let policy handle the rest. That requires context, not just a yes/no gate.
The Observability Gap Nobody Has Solved Yet
This was the part where van Hurne got animated, because it is unsolved and he had to build it himself.
In his factory at ASML, a process operator sits in front of a large screen watching processes run, pulling telemetry from different systems, tying it into a flow with red and green lights and intervening when something goes wrong on security, identity, access, operations or compliance. It is the SIEM idea, the Splunk-style dashboard, but for agent operations. It does not exist as a product. He duct-taped it together because the market has not built it. His words, roughly: anyone building this, call me.
He compared the role to a chemical plant operator. In a plant, trained chemists watch the process and know when to open a flare or close a vent. The new agent-operations roles are the same idea applied to software. They require real domain expertise, and the job boards in the US and the Emirates are already paying well for them.
Will AI Take the Jobs? What 177 Companies Actually Show
The session did not skip the obvious question.
Van Hurne is, by his own description, one of the people reducing FTE, although as a European company ASML re-skills rather than lays off. But his read on the numbers is more grounded than the headlines. The World Economic Forum projected 83 million jobs gone by 2030. Goldman Sachs floated 300 million. Anthropic's CEO said 50% of white-collar jobs and 10 to 20% unemployment. In the same period, the International Labour Organization put displacement at 2.3%, with the rest augmented. A 2026 MIT study looking at 22,000 jobs landed where van Hurne's own research did: AI is task-oriented, not job-oriented.
He built a method to calculate this. Job taxonomies like O*NET in the US and ESCO in Europe describe jobs as sets of standardized tasks. Because a process is a collection of tasks, and a job is a collection of tasks, the automation zones map onto roles. The result: the maximum automation level for any given job lands around 70%, not 100%. The job still exists. What changes is how many people are needed in it, and which roles get hit hardest. Junior, zone-1-heavy work is the most exposed.
Keienburg offered a slightly different lens during the session: there is also a world where the productivity bar for a normal worker rises through AI rather than headcount falling. Either way, the practical conclusion is the same. Agents are coworkers that have to be managed, not software that can be installed and forgotten.
What Security and IT Teams Should Do Now
A few concrete starting points from the session.
Inventory the agents. Most organizations cannot say which agents are deployed, what credentials they hold or what scopes those credentials carry. Long-lived human credentials with broad access, attached to an agent that nobody is watching, is the Vercel setup. Start there.
Give every agent its own identity. Not a borrowed human login. A scoped identity with the rights the task needs, that can be reviewed and revoked. If an agent cannot be cleanly revoked, it is not really under control.
Treat tool execution as the security boundary. The risky surface is not what the model says. It is what it does through its tools. That is where irreversible actions happen.
Prioritize governance by access scope, not task complexity. A zone 1 agent with broad scopes is a higher risk than a zone 3 agent under tight oversight. Most governance gaps live in the assumed-safe places.
Make human oversight selective. Approving everything trains people to approve nothing. Escalate the ambiguous cases, let policy handle the rest and design for that from the start.
Build the evidence trail before it is needed. The observability layer auditors will ask for under DORA, ISO 27001 and SOC 2 is hard to reconstruct after an incident. Capture the context now.
FAQ
What Are the Four Zones of AI Automation?
A framework from Marco van Hurne's research on 177 companies. Zone 1 is highly repeatable, low-risk work (about 27% of cases, around 70% automation success). Zone 2 adds coordination and light human-in-the-loop (about 12%). Together they form the realistic automation ceiling, around 35%. Zone 3 is complex, high-risk, compliance-heavy work (about 30%) where roughly 70% of projects fail. Zone 4 is human judgment and ethics, which stays human.
Why Do Most AI Agent Projects Fail?
Above zone 2, failure is often economic rather than technical. The observability, explainability and human oversight needed to run agents safely in high-risk processes can cost more than the automation saves, so the project never breaks even.
What Does "Treat AI Agents Like Employees" Mean?
Onboard each agent with a defined role, only the rights that role needs, its own identity rather than a borrowed human login, ongoing review and revocation when the work ends. It is the opposite of handing an agent a broad, static credential and never looking again.
How Does This Relate to the Vercel Breach?
The Vercel incident started with an AI app connected to a corporate account with broad permissions and no real review. Scoped credentials, a separate identity and revocation are exactly the controls that would have limited that blast radius.
Join the Agent Access Management Waitlist
If the Vercel pattern and the agents-as-employees fix sound like problems the company already has, that is what Cakewalk's Agent Access Management is built for. We help IT and security teams govern access for AI agents and human identities in one place, with scoped, policy-first access and an audit trail for every action.
Be the first to control AI agent access. Get started now.