TLDR/: McKinsey’s new research on AI transformation, published August 28, 2026, studied 20 companies that have created real economic value from AI and found that only a small number have reached “Stage 3: Agentic AI enterprise.” The capability that separates Stage 3 from Stage 2, per McKinsey’s own maturity framework, is orchestration layers and automated guardrails: the ability to govern agent actions automatically, in real time, rather than reviewing them after the fact. That capability has to live at the infrastructure layer where agents actually take action, which is exactly the gap meshIQ’s AI Agent and AgentGuard are built to close.
What McKinsey found
McKinsey’s Quantumblack and Technology & AI teams studied 20 large enterprises that have consistently created significant economic value from AI-driven transformation, drawing on companies profiled in the second edition of their book Rewired. The findings are stark: across McKinsey’s broader research, 94 percent of businesses have yet to create meaningful value from AI. The 20 companies that succeeded weren’t the standard “AI-native” names. They were established enterprises like DBS Bank, Freeport-McMoRan, LATAM Airlines, and Toyota that invested years into building organizational capability, not just adopting tools.
The economics for the companies that got it right were substantial: an average 20 percent improvement in steady-state EBITDA, roughly $3 in incremental EBITDA for every $1 invested, and cash-positive results within one to two years.
The three-stage maturity model, and where most companies actually are
McKinsey lays out a three-stage progression every organization moves through:
- Stage 1 (First wins): Point solutions, software and data engineering talent, a data lake, agile delivery
- Stage 2 (Scaling value): End-to-end domain transformation, tech-capable business leaders, unified and productized data, a domain-and-platform operating model
- Stage 3 (Agentic AI enterprise): Cross-domain, real-time AI systems; an agent-human operating model with flatter teams; data enriched with meaning and context; and, critically, orchestration layers and automated guardrails for adoption and scaling
McKinsey is direct about where the market actually sits: the companies in their study have largely mastered Stage 2 and are only now actively developing Stage 3 capabilities. They describe the industry as being in the early innings of agentic AI, with the organizations that master automated guardrails first compounding a lasting advantage over the ones still reviewing agent output manually.
Why “automated guardrails” is the hard part
McKinsey’s framework is an organizational and strategic model, and it’s right about the destination. What it doesn’t specify is the infrastructure question underneath it: where does an automated guardrail actually have to live to work?
Most AI tooling today, LLM gateways, observability dashboards, output guardrails, sit outside the path an agent’s action actually takes. These tools can log or trace what an agent did after the fact, but they can’t intercept a tool call before it executes, pause an action pending approval, or stop a policy violation before it happens. By the time the event is observed, the action already happened. That’s Stage 2 thinking applied to a Stage 3 problem: oversight bolted on after execution instead of built into it.
How meshIQ operationalizes Stage 3 inside the middleware layer
Two products built specifically for the infrastructure gap McKinsey’s framework points to but doesn’t solve:
meshIQ AI Agent grounds agent reasoning in live operational reality instead of a model’s best guess. It queries real-time telemetry, queue depths, consumer lag, channel status, and configuration state across IBM MQ, Apache Kafka, RabbitMQ, ActiveMQ, Solace, TIBCO, and IBM App Connect, and correlates that evidence before recommending a resolution. That’s the “meaning and context” data enrichment McKinsey’s Stage 3 column calls for, applied specifically to middleware operations.
AgentGuard is the automated guardrail itself. It’s an in-flow governance control plane, embedded directly into agent execution through a lightweight SDK, that evaluates every tool call against policy before it runs. Every action resolves to one of four outcomes: allow immediately for low-risk operations, require explicit confirmation for medium-risk actions, escalate high-risk actions to a designated approver while execution state is preserved, or deny outright if it violates policy. Every prompt, tool call, and governance decision becomes part of a tamper-evident audit trail, each event chained to the previous one via SHA-256 hash, producing evidence that maps to frameworks like SOC 2, the EU AI Act, HIPAA, and GDPR.
That’s the difference between an agent-human operating model that works at scale and one that quietly recreates the same manual review bottleneck McKinsey’s own research keeps flagging as the reason AI programs overspend.
The takeaway
McKinsey’s research confirms what the market is already signaling: Stage 3 is coming, most enterprises aren’t there yet, and the deciding capability is automated governance built into execution, not layered on after it. The organizations that build that capability into their middleware and integration layer now, where agents actually connect to real systems and take real actions, are the ones positioned to capture the economics McKinsey describes instead of losing control of costs the way early agentic deployments already have.
Source: Alex Singla, Alexander Sukharevsky, Kate Smaje, Eric Lamarre, and Robert Levin, “The new management playbook for AI: How to move faster and create more value,” McKinsey Quarterly, August 28, 2026.
FAQ
What is McKinsey’s three-stage AI maturity model? Stage 1 (First wins) covers point solutions and early experimentation. Stage 2 (Scaling value) covers end-to-end business domain transformation. Stage 3 (Agentic AI enterprise) covers cross-domain, real-time AI systems governed by orchestration layers and automated guardrails.
What percentage of businesses have created meaningful value from AI? Per McKinsey’s State of AI research cited in the same report, only 6 percent of businesses have created meaningful value from AI so far; 94 percent have not.
What is an automated guardrail in agentic AI? A policy control that evaluates and can stop, confirm, escalate, or allow an AI agent’s action before it executes, rather than only logging or reporting on the action after it has already run.
How does AgentGuard implement automated guardrails? AgentGuard is an in-flow governance control plane embedded directly into agent execution. It evaluates every tool call against policy in real time and resolves each action to one of four outcomes: allow, confirm, escalate, or deny, with a tamper-evident, hash-chained audit trail mapped to compliance frameworks including SOC 2, the EU AI Act, HIPAA, and GDPR.