UK agentic AI to October 2028: permissions, not models, will shape adoption

The forecast: UK adoption will move from access to accountable action

**Forecast horizon: November 2026 to October 2028.** UK organisations are unlikely to face a simple choice between adopting AI and missing out. Most will have access to increasingly capable AI through the software they already buy. The more difficult question is whether they can allow those systems to act inside consequential workflows without creating unacceptable operational, security or data-protection risks.

For this analysis, an agentic AI system is software that can sequence tasks, use approved tools or enterprise applications, and take bounded actions towards an objective. That distinction matters. A generative AI assistant can draft a reply for a worker to review. An agent may retrieve a customer record, create a service case, update an account, trigger a communication or recommend the next operational step. Its usefulness rises as it is connected to more systems—but so does the consequence of poor data, a manipulated instruction, an inappropriate permission or an unclear business rule.

The central forecast is therefore **controlled workflow integration rather than broad autonomy**. The main adoption divide will be between organisations that can make an agent earn additional permissions through evidence of safe, useful performance, and those that cannot move beyond stand-alone tools, demonstrations and low-value pilots.

This is a more demanding challenge than selecting a model. It requires a named owner for a process, sufficiently consistent data and rules, role-based access, a way to reconstruct actions, and a credible route for people to intervene. These are management and operating-model capabilities as much as technical ones.

The argument should not be read as claiming that model quality is irrelevant. Better reasoning, retrieval and tool use can widen the range of viable tasks. But model improvements alone do not establish who is accountable when an action affects a customer, a payment, a regulated decision or sensitive information. For most UK employers over the next two years, that governance gap will be the binding constraint.

The evidence points to broad interest but shallow integration

The available UK evidence supports a measured forecast. ONS reports that self-reported AI use among businesses with 10 or more employees rose from around 12% in late 2023 to around 35% by 2026. Yet the average number of AI technologies used by an adopting business increased only from around 1.4 to around 1.6. That combination is important: access and experimentation have expanded rapidly, while breadth of operational integration has advanced more slowly (Office for National Statistics, 2026) ↗.

The technology count is not a direct measure of value or maturity. A firm may generate substantial benefit from one well-designed application, while another may hold several unused licences. Nonetheless, the pattern is consistent with a familiar implementation reality: deploying a tool is faster than redesigning work around it. Data quality, fragmented systems, unclear ownership and weak evaluation practices become more visible once AI is asked to do more than assist an individual user.

Research commissioned by the Department for Science, Innovation and Technology reinforces this interpretation. Current and prospective AI users most commonly identified marketing and administration as relevant business areas (72% each), followed by IT (64%). Creative and content work, administration and support, data and analytics, and automation were among the most frequently identified uses. Sixty-five per cent cited efficiency or productivity as a principal motivation; 65% expected to implement off-the-shelf applications and 59% expected to embed AI into existing systems in the following 12 months (Department for Science, Innovation and Technology, 2026) ↗.

These findings suggest that the commercial centre of gravity is not bespoke frontier-model development. It is AI embedded in customer relationship management, helpdesk, productivity, finance, document-management and enterprise-resource-planning software. That matters particularly for SMEs, high-street firms and charities: their practical route to adoption will usually be better use of purchased software and more disciplined processes, not building an agent platform from scratch.

Human oversight remains the normal operating model. Among AI-using businesses in the same research, 84% reported some human input or checking of AI outputs or decisions, and 67% reported significant input or checking. Meanwhile, organisations reported significant barriers more often for agentic AI (32%) than for natural-language processing and text generation (18%) (Department for Science, Innovation and Technology, 2026) ↗. The difference is analytically significant. Text generation can often be deployed as a relatively isolated capability; agentic applications need integration, access controls and decisions about which actions can safely occur without prior approval.

The employment signal points in the same direction. In September 2026, 38% of AI-using UK businesses with 10 or more employees said administrative and clerical roles were the most affected by AI. This does not establish economy-wide job losses or a uniform reduction in headcount. It does indicate that administrative work is an early site of task redesign, making workforce involvement and management capability central to successful adoption (Office for National Statistics, 2026) ↗.

Why permissions become the practical bottleneck

The critical unit of design is not the model but the **permissioned workflow**: a defined process in which an AI system has access to named data and tools, can perform specified actions, and encounters clear limits and escalation points.

The mechanism is cumulative. Giving an assistant access to a knowledge base may create a manageable risk of inaccurate retrieval. Adding the ability to create a case introduces record-quality risk. Allowing it to alter account status, communicate externally or initiate a payment-related process raises the potential cost of error sharply. The same chain can expose an organisation to inappropriate data access or instructions designed to override safeguards. Capability scales through connections; risk scales through the permissions attached to those connections.

A credible early workflow therefore has five features: a measurable operational problem; a named process owner; limited access to the minimum data and tools required; human approval before irreversible, regulated, financial or materially customer-affecting actions; and logs that can reconstruct inputs, actions, hand-offs and overrides. These conditions are not a case for avoiding automation. They are the means by which an organisation can distinguish a reliable improvement from a risky demonstration.

The security baseline is concerning. The UK Cyber Security Breaches Survey found that 43% of businesses experienced a cyber breach or attack in the previous 12 months. Among organisations using, adopting or considering AI, only 24% reported practices or processes to manage AI security risks; 38% planned to implement them within 12 months and 31% had no plans to do so (Department for Science, Innovation and Technology and Home Office, 2026) ↗. The survey does not show that AI caused those incidents. It does show that many organisations are introducing AI into an already challenging resilience environment before control arrangements are mature.

Privacy requirements reinforce the same logic. The ICO advises organisations using agentic systems to establish clear purposes for processing, minimise the data used, and avoid granting access simply because information may later prove useful. It also stresses meaningful human intervention where automated decisions affect people (Information Commissioner's Office, 2026) ↗. In practice, these principles favour narrow, evidence-led deployments over general-purpose agents with expansive access.

Sanctuary’s interpretation is that the strongest early use cases will be operational loops with a contained downside: triage, drafting, evidence gathering, record completion, exception detection, knowledge retrieval, quality assurance and next-best-action recommendations. Their value lies in reducing delay, rework and avoidable variation while retaining accountable judgement where it matters.

Three paths to October 2028—and what could change the forecast

**Base case: governed augmentation becomes routine in selected workflows.** Larger organisations, alongside a growing minority of better-prepared smaller firms, move from individual AI tools to embedded assistants and a limited number of action-taking agents. Customer operations, administration, IT service management, sales operations, finance processing and internal knowledge services are likely early targets. Human approval remains common for high-impact actions. This follows from current plans to embed AI in existing systems, the predominance of efficiency-led use cases and the continuing reliance on human checking (Department for Science, Innovation and Technology, 2026) ↗.

**Upside case: assurance becomes easier to buy.** Software providers standardise connectors, identity controls, evaluation tools, audit logs and sector-specific workflow templates. Mid-sized firms can then deploy agents with fewer bespoke integrations and stronger evidence of reliability. The resulting gain is more likely to be faster case resolution, lower rework and greater capacity for complex work than wholesale job replacement. This scenario depends on suppliers making controls usable for ordinary management teams, not merely technically available.

**Downside case: pilots proliferate while operational value stalls.** Organisations purchase agent features faster than they clarify process ownership or improve underlying data. Fragmented records, unclear accountability, shadow deployment, unexpected costs and security failures prompt pauses or reversions to manual work. Generic AI use still grows, but action-taking agents remain confined to low-risk demonstrations or centrally managed IT functions.

Two developments would materially challenge the base case. First, sustained evidence that organisations are retreating from embedding AI in their systems would indicate that implementation friction is greater than anticipated. Second, robust evidence that agents can execute cross-system, high-consequence workflows at consistently low error rates with limited oversight across diverse organisations would support a faster-autonomy scenario. Conversely, a pattern of significant agent-enabled data loss, fraud or regulatory intervention would strengthen the downside case.

This uncertainty is why leaders should avoid treating adoption statistics as productivity statistics. The relevant test is whether a specific workflow improves against a baseline without shifting hidden costs or risks elsewhere.

Compute matters strategically; management capability matters sooner

The UK Compute Roadmap positions AI Growth Zones as possible testbeds for applied AI, automated services, autonomous systems and human-AI collaboration, alongside wider investment intended to strengthen UK capability (Department for Science, Innovation and Technology, 2026) ↗. This can be economically valuable. Places that connect infrastructure with universities, skills provision, suppliers and demonstrator projects may create stronger local innovation networks.

However, new compute capacity should not be confused with widespread local adoption or productivity. Most service businesses, local employers and SMEs will consume AI through cloud platforms and software providers. Their nearer constraints are more likely to be inconsistent processes, poor-quality data, limited procurement capability, weak cyber resilience and uncertainty among managers and staff.

For local economic development, the practical implication is that infrastructure investment creates most value when paired with adoption support: sector-based demonstrators, management training, workforce pathways and shared learning about what can be deployed safely. A town centre business, accountancy practice, manufacturer or community organisation may gain more in the next two years from reducing process variation and deploying one well-governed workflow than from access to more powerful raw compute.

A decision agenda for leaders: make agency earnable

Sanctuary recommends treating the next 90 days as an operating-model exercise rather than a tool-selection exercise.

**Build a workflow portfolio.** Rank opportunities by volume, delay, error or rework, customer impact, data sensitivity and reversibility. Begin where performance can be measured and a mistaken action can be contained.

**Define a permission charter before procurement.** Set out the systems and data fields an agent may access; the actions it may take; decisions that require approval; prohibited actions; retention requirements; escalation routes; and the named accountable owner. This creates a basis for evaluating suppliers rather than accepting generic claims of autonomy.

**Measure outcomes, not usage.** Establish baselines for cycle time, first-time-right rate, backlog age, quality exceptions, customer resolution, staff capacity and cost to serve. Usage counts can show interest; they cannot demonstrate productivity or service improvement.

**Redesign work with the people who do it.** Where administrative tasks change, specify which judgement, customer conversations, quality checks and exceptions remain human work. Staff involvement is not only an employment-relations consideration: it exposes the informal rules and edge cases that determine whether a workflow works in practice.

**Put security and privacy gates inside delivery.** Use least-privilege access, separate testing from production, maintain usable logs, test for instruction manipulation and inappropriate disclosure, and rehearse how a workflow can be paused or rolled back. The government’s AI Cyber Security Code of Practice provides a relevant baseline for secure development and deployment (Department for Science, Innovation and Technology, 2025) ↗.

The strategic objective is not to achieve the greatest possible autonomy immediately. It is to make agency progressively earnable: expand an AI system’s permissions only after it has demonstrated accuracy, operational value, recoverability and workforce acceptance in a bounded setting. Organisations that adopt this discipline are better placed to turn current AI momentum into durable UK productivity gains by October 2028.