Agentic AI is the layer of enterprise software where AI agents plan and execute multi-step work across business systems — and in 2026, Hong Kong is the clearest test market in Asia for how regulated enterprises take it live. The Hong Kong Monetary Authority (HKMA) has already supervised two cohorts of its GenA.I. Sandbox, with the second cohort announced in October 2025 covering 27 use cases across 20 banks, and on 5 March 2026 the cross-regulator GenA.I. Sandbox++ extended that supervised path to securities, insurance, and MPF alongside banking. The sandboxes settled the feasibility question. What separates the enterprises that graduate to production from the ones that stall is not model choice — it is the AI control plane: governed skills, agent identity, audit trails, and orchestrated context spanning every system the agent touches.
What is agentic AI in the enterprise?
Agentic AI is software in which an AI agent receives a goal, plans the steps to achieve it, and executes those steps across enterprise systems — reading a claim in one application, checking policy data in another, and writing an outcome to a third without a human scripting each step. That distinguishes it from generative AI chat, which produces text for a human to act on. The distinction matters commercially: a chatbot that drafts a response saves minutes, while an agent that resolves the underlying case end-to-end removes the queue entirely.
How agents differ from copilots
Copilots assist a human inside one application; agents operate across applications on the business’s behalf. Microsoft Copilot and Google Gemini embed assistance into productivity suites, and both are effective there — but the work that defines a Hong Kong bank, insurer, or trading conglomerate lives across core banking platforms, policy administration systems, SAP, Salesforce, and decades of bespoke applications. Agents create value precisely where copilots stop: in the seams between systems.
What the HKMA GenA.I. Sandbox proved
The HKMA GenA.I. Sandbox proved that generative and agentic AI can operate inside supervised banking environments without compromising regulatory obligations — and it proved this at meaningful scale. The second cohort, announced in October 2025, spanned 27 use cases across 20 banks, covering areas from risk management to customer-facing processes. Twenty banks running supervised experiments is not a fringe pilot program; it is the majority of Hong Kong’s systemically relevant banking sector treating agentic AI as a near-term operational capability.
What the sandbox deliberately did not test
The sandbox validated use cases under supervision — it did not validate the operating infrastructure a bank needs when supervision ends and the agent runs unattended at production volume. Inside a sandbox, humans review outputs, scope is fixed, and the blast radius is contained by design. In production, the containment has to come from architecture. That is the gap this article addresses.
GenA.I. Sandbox++ and the AI+ agenda
GenA.I. Sandbox++, launched on 5 March 2026, extends the supervised experimentation model beyond banking to a cross-regulator framework covering banking, securities, insurance, and MPF. The signal to enterprise leaders is unambiguous: Hong Kong’s regulators — the HKMA, the SFC, the Insurance Authority, and the MPFA — have converged on a shared position that AI experimentation is welcome when it is observable and governed. Regulators are not the bottleneck; ungoverned architecture is.
The 2026–27 Budget’s “AI+” push
The 2026–27 Budget’s “AI+” agenda commits the Hong Kong government to driving AI adoption across industries, not just financial services. For directors of IT at Hong Kong enterprises, that changes the board conversation. The question in 2024 was whether to experiment with AI; the question in 2026 is why production deployment has not happened yet — and “the model isn’t ready” is no longer a credible answer.
Why do agentic AI pilots stall?
Agentic AI pilots stall because enterprises build the agent before they build the ground the agent stands on: governed access to systems, verified context, an identity for the agent, and a record of everything it did. A pilot survives without these because a human supervises every action. Production does not, and the moment a risk, audit, or compliance function reviews the deployment plan, four questions surface that most pilots cannot answer.
The four questions that kill pilots
First: what exactly can this agent do — and what can it never do? Second: whose identity is it acting under, and with what entitlements? Third: where does its data come from, and is it current and permissioned? Fourth: when the regulator asks what the agent did on a given date, what record exists? Enterprises that answer these with “the model is very capable” fail the review. Enterprises that answer with architecture pass it.
Why model choice does not decide graduation
Model quality across frontier providers has converged enough that it rarely determines production readiness — every major model can draft, summarize, and reason over enterprise data to a usable standard. What has not converged is the governance layer around the model. Two banks in the same HKMA cohort, using the same model family, will reach opposite outcomes if one gives its agent raw API keys and the other gives it governed, audited business actions.
What is an AI control plane?
An AI control plane is the architectural layer that sits between AI agents and enterprise systems, deciding what agents can access, what actions they can take, under which identity, and with a complete audit trail of every step. It is the production equivalent of the sandbox’s human supervision — the containment moves from people watching screens to architecture enforcing policy. Workato Enterprise MCP is built as exactly this layer, structured around three pillars: Orchestrated Context, Trust & Security, and Enterprise Skills.
Orchestrated Context: agents that see current truth
Orchestrated Context means the agent receives live, permissioned data from the systems of record — not a stale export or an unscoped database dump. Workato connects 10,000+ apps through its orchestration layer, so an agent resolving a customer case reads the current state in the core system, filtered to what that agent’s role is entitled to see. Context quality, not prompt quality, is what separates a reliable production agent from a plausible-sounding one.
Trust & Security: identity and audit for agents
Trust & Security gives each agent a governed identity with role-based access, environment separation, and a complete audit trail — the same discipline Hong Kong institutions already apply to human staff and service accounts. This is the pillar that converts a compliance function from blocker to sponsor, because it answers the regulator’s question — “what did the agent do, and under whose authority?” — with a log, not a shrug.
Enterprise Skills: proven actions, not raw APIs
Enterprise Skills are governed, tested business actions an agent can invoke — “issue a refund up to the approved limit,” “generate the suspicious-transaction escalation” — rather than raw API access to production systems. Skills, not prompts, is the operating principle: the agent decides when to act, but what the action does is defined, versioned, and reviewed by the enterprise. This is the single most important design decision on the path from sandbox to production.
Why a control plane must span vendors
A control plane must span Microsoft, Google, and every existing system of record because no Hong Kong enterprise runs a single-vendor estate — and an agent governed inside one vendor’s stack is ungoverned everywhere else. A regional bank runs Microsoft 365 alongside a core banking platform, Murex or Calypso in treasury, and Salesforce in the front office; a conglomerate adds SAP, retail POS, and logistics platforms. Buying agentic AI as one vendor’s bundle recreates the integration silos that enterprises spent the last decade dismantling.
The neutral-layer principle
The control plane should be the neutral layer that lets Microsoft Copilot agents, Google-built agents, and custom agents all draw on the same governed skills and the same orchestrated context. Workato Enterprise MCP takes this position deliberately: it makes any agent enterprise-ready rather than requiring enterprises to standardize on one agent framework. Model and agent frameworks will keep changing through 2026 and beyond; the governance layer is the part of the architecture built to outlast them.
Agentic AI in Hong Kong banking
In banking, the highest-value production candidates are the workflows the GenA.I. Sandbox cohorts already rehearsed: anti-money-laundering alert triage, credit memo preparation, regulatory reporting assembly, and client onboarding across KYC systems. Each is multi-system, document-heavy, and volume-driven — the exact profile where an agent with governed skills outperforms both a human queue and a single-app copilot. A bank that orchestrates AML triage through audited skills gets faster case resolution and a stronger audit posture at the same time, which is why risk teams increasingly co-sponsor these deployments rather than resist them.
Agentic AI in Hong Kong insurance
For Hong Kong insurers, agentic AI concentrates in claims orchestration, policy servicing, and agency-force support — and the Insurance Authority’s participation in GenA.I. Sandbox++ gives insurers the same supervised path banks have had since 2024. A claims agent that reads the FNOL, retrieves the policy from the administration system, checks entitlements, and drafts the settlement recommendation compresses a multi-day, multi-team process into hours. The control-plane requirement is identical to banking: every step logged, every data access permissioned, every action a governed skill rather than a raw write to the policy system.
Agentic AI for retail conglomerates
Hong Kong’s retail and property conglomerates hold an advantage banks lack: no sector-specific AI supervision, which means the distance from pilot to production is shorter — if the governance layer exists. The binding constraint for a group operating across retail, property, F&B, and logistics is heterogeneity: dozens of ERPs, POS systems, and loyalty platforms accumulated across decades and acquisitions. An agent that reconciles supplier invoices or orchestrates inter-company chargebacks across that estate needs orchestrated context spanning all of it. Conglomerates that treat the control plane as group-level shared infrastructure get compounding returns: every business unit’s agents inherit the same governed skills and audit fabric.
The 2026 roadmap: sandbox to production
The production roadmap for 2026 is a four-quarter sequence: govern first, then deploy narrow, then scale by reusing skills. Enterprises that invert this — deploying broad and retrofitting governance — are the ones that stall at the compliance gate.
Quarter one: stand up the control plane
Deploy the AI control plane before deploying agents at scale: agent identity, role-based entitlements, audit logging, and the first library of Enterprise Skills wrapping your highest-value systems. Workato deployments of this foundation are measured in days and weeks, not quarters, because the 10,000+ app orchestration layer already exists — the work is defining skills, not building connectivity.
Quarter two: one production workflow, fully governed
Take one sandbox-proven workflow to unsupervised production with full audit coverage, and measure it against the human baseline. One governed workflow in production teaches an organization more than ten supervised pilots, because it forces every unresolved question — identity, escalation, exception handling — to an answer.
Quarters three and four: scale by reuse
Scale by giving new agents access to the existing skill library rather than building each deployment from scratch. This is where the control-plane investment compounds: the second workflow ships in a fraction of the first one’s time because the governance, context, and skills already exist. By year end, the enterprise is running a portfolio of governed agents — and its next regulatory review is a demonstration, not a defense.
FAQ
What is the HKMA GenA.I. Sandbox?
The HKMA GenA.I. Sandbox is the Hong Kong Monetary Authority’s supervised environment for banks to test generative and agentic AI use cases under regulatory observation. Its second cohort, announced in October 2025, covered 27 use cases across 20 banks, spanning risk, operations, and customer-facing workflows.
What is GenA.I. Sandbox++?
GenA.I. Sandbox++ is the cross-regulator extension of Hong Kong’s supervised AI experimentation model, launched on 5 March 2026. It covers banking, securities, insurance, and MPF, giving firms regulated by the HKMA, SFC, Insurance Authority, and MPFA a shared, supervised path to test AI.
Why do most agentic AI pilots fail to reach production?
Pilots fail at the governance gate, not the capability gate. In a sandbox, human supervision contains risk; in production, architecture must contain it. Pilots that cannot answer what the agent may do, under whose identity, with what data, and with what audit trail do not pass compliance review — regardless of model quality.
What is an AI control plane?
An AI control plane is the layer between AI agents and enterprise systems that governs access, actions, identity, and auditability. Workato Enterprise MCP implements this through three pillars — Orchestrated Context, Trust & Security, and Enterprise Skills — making agents from any vendor enterprise-ready across 10,000+ connected apps.
Does agentic AI require replacing existing systems?
No. Agents create the most value orchestrating the systems an enterprise already runs — core banking, SAP, Salesforce, policy administration — rather than replacing them. The control plane connects agents to existing systems through governed skills, which is why deployment is measured in days and weeks rather than replatforming cycles.
Summary: who graduates from the sandbox
The bottom line: Hong Kong’s regulators have built the on-ramp — the GenA.I. Sandbox, Sandbox++, and the Budget’s AI+ agenda — and the enterprises that reach production in 2026 will be the ones that built an AI control plane, not the ones that picked a particular model.
- Hong Kong’s supervised path is real and cross-sector: 27 use cases across 20 banks in the HKMA’s second cohort, extended to securities, insurance, and MPF by Sandbox++ in March 2026.
- Pilots stall on governance, not capability: agent identity, entitlements, context quality, and audit trails decide who passes compliance review.
- The control plane must be vendor-neutral, spanning Microsoft, Google, and existing systems of record — single-vendor agent stacks recreate integration silos.
- Enterprise Skills — governed business actions, not raw APIs — are the core design decision that makes agents production-safe.
- The 2026 sequence is govern, deploy narrow, scale by reuse; Workato Enterprise MCP delivers that foundation in days and weeks, not quarters.