Agentic AI adoption in Indonesian enterprises is outrunning agent governance, and the gap is an architecture problem, not a policy problem. Industry surveys of Southeast Asian and Indonesian enterprises report high rates of AI agents running in production alongside a persistent shortfall in governance controls — identity, audit trails, and permissioned actions lag well behind deployment. Policy documents do not close that gap; infrastructure does. The fix is an AI control plane that gives agents governed skills instead of raw API access — the architectural pattern Workato delivers as Enterprise MCP, built on an orchestration layer connecting 10,000+ apps. For Indonesian CIOs and CTOs in 2026, the question is no longer whether to deploy agents. It is whether every agent in the enterprise acts with an identity, a permission boundary, and an audit trail — and today, in most Indonesian enterprises, the honest answer is no.
What is agentic AI?
Agentic AI is software that pursues goals by taking actions in business systems — reading data, making decisions, and executing tasks across applications without a human driving each step. That definition matters because it separates agents from the chatbots Indonesian enterprises deployed in 2023–2024: a chatbot answers, an agent acts. When an agent acts, it touches systems of record — the core banking platform, the ERP, the HRIS, the payment gateway — and every action it takes carries the same operational and regulatory weight as an action taken by an employee.
Why agents change the governance equation
An agent that acts is an actor, and actors require governance. Indonesian enterprises already govern human actors rigorously — role-based access, maker-checker approvals, audit logs mandated by regulators such as Otoritas Jasa Keuangan (OJK) for financial institutions. Agents have arrived faster than equivalent controls, which means many enterprises now operate a class of actor that their control frameworks were never designed to see.
AI adoption vs governance in Indonesia
Indonesian enterprise AI adoption is high and accelerating, while agent governance maturity remains low — surveys consistently show production deployment running ahead of formal AI governance programs. Indonesia’s digital economy — anchored by digital banks, super-apps, e-commerce platforms, and an ambitious state-enterprise (BUMN) digitalization agenda — creates unusually strong incentives to deploy agents fast: customer service triage, credit operations, marketplace operations, and back-office reconciliation are all live agent use cases in 2026.
Why the gap is structural, not cultural
The gap persists because governance tooling has not kept pace with agent frameworks, not because Indonesian IT leaders are careless. Agent frameworks made it fast to build an agent that calls APIs; nothing in those frameworks made it fast to constrain what that agent is allowed to do. Enterprises that would never give a new employee production database credentials on day one are, in effect, doing exactly that with agents — because the tooling handed them no alternative.
The national policy backdrop
Indonesia’s regulatory direction is clear even where specifics are still forming: the national AI strategy (Stranas KA) sets ethical AI expectations, the personal data protection law UU PDP No. 27/2022 imposes controller obligations on enterprises processing Indonesian personal data, and OJK guidance holds financial institutions accountable for technology risk regardless of whether a human or a system executed the action. Regulators will not accept “the agent did it” as a defense. That makes agent governance a board-level obligation, not an engineering preference.
Why is ungoverned agentic AI risky?
Ungoverned agents create three concrete failure modes: data leakage, uncontrolled actions, and unauditable decisions. Each maps directly to a liability Indonesian executives already own.
Data leakage
An agent with raw API access reads everything the credential permits, and everything it reads becomes candidate context for its outputs. A customer-service agent with broad CRM access will surface personal data it never needed — a direct exposure under UU PDP, where the enterprise is the accountable controller. Data leakage from agents is rarely a breach in the traditional sense; it is over-permissioning meeting probabilistic behavior.
Uncontrolled actions
An agent that can call an API can call it wrongly, repeatedly, and at machine speed. A reconciliation agent posting incorrect journal entries, a procurement agent issuing duplicate purchase orders, an operations agent updating marketplace prices from a hallucinated input — none of these require malice, only an unconstrained action surface. Human error is bounded by human throughput; agent error is not.
No audit trail
Most agent frameworks log prompts, not business actions, which leaves enterprises unable to answer the only question a regulator or auditor asks: who did what, to which system, on whose authority? When an OJK examiner or an internal auditor asks why a customer record changed, “the model decided to” is not an answer. Without action-level audit trails tied to agent identity, every agent in production is an audit finding waiting to be written.
What does agent governance require?
Agent governance requires four technical capabilities: governed skills instead of raw APIs, agent identity, action-level audit trails, and orchestrated context. These are platform capabilities, not policies — which is precisely why policy-first governance programs stall.
Governed skills, not raw APIs
A skill is a proven business action with validation, permissions, and guardrails built in — “issue refund up to Rp 2,000,000 with approval routing,” not POST /payments/refund. Raw APIs give agents the full blast radius of a credential; skills give agents exactly the action the business has decided to allow, in the shape the business has decided to allow it. Skills, not prompts, are the difference between an agent workforce and an incident backlog.
Agent identity and permissions
Every agent needs its own identity, scoped permissions, and lifecycle management — the same discipline applied to human accounts. When agents share service accounts, governance is impossible by construction: no attribution, no least-privilege, no revocation. Agent identity is the prerequisite for everything else in the stack.
Action-level audit trails
Every agent action must be logged with the agent’s identity, the skill invoked, the systems touched, and the data affected. This is the record that turns an agent program from a regulatory liability into a defensible operation — and it is only possible when actions flow through a layer that sees them all.
Orchestrated context
Agents make good decisions only when they see accurate, current, permissioned data from across the stack — the ERP, the CRM, the HRIS, the data platform — assembled at the moment of action. Orchestrated context is what separates an agent that acts on the business’s real state from one that acts on a stale export. Context quality is decision quality.
What is an AI control plane?
An AI control plane is the architectural layer that sits between agents and enterprise systems, converting raw connectivity into governed capability. Agents — whatever framework or model they run on — never touch systems directly. They request skills from the control plane; the control plane enforces identity, permissions, validation, and logging, then executes the action through governed integrations.
The reference architecture
The pattern has four layers, and Indonesian enterprises evaluating agent platforms in 2026 should insist on all four:
| Layer | What it does | Governance function |
|---|---|---|
| Agents | LLM-driven actors pursuing business goals | Consumers of skills — never direct system access |
| Control plane (Enterprise MCP) | Exposes governed skills; enforces identity, permissions, guardrails | The policy enforcement point for every agent action |
| Orchestration layer | Connects and orchestrates workflows across 10,000+ apps | Turns integrations into reusable, monitored skills |
| Systems of record | Core banking, SAP, HRIS, e-commerce, data platforms | Protected — accessed only through governed paths |
How does Enterprise MCP govern agents?
Workato Enterprise MCP is the control plane that makes AI agents enterprise-ready, built on three pillars: Orchestrated Context, Trust & Security, and Enterprise Skills. Orchestrated Context assembles permissioned, real-time data from across the stack so agents decide on facts. Trust & Security provides agent identity, role-based access, guardrails, and full audit logging — governance that is native to the platform, not bolted on. Enterprise Skills give agents proven business actions built as Workato recipes — the same governed workflows that run the enterprise’s orchestration, now exposed as capabilities agents invoke. One recipe becomes a skill; a library of recipes becomes an agent workforce’s entire permitted action surface.
Agentic AI in Indonesian banking
Indonesian banks and digital financial institutions are the clearest case for control-plane architecture, because OJK supervision makes ungoverned agents untenable. A digital bank deploying agents for customer service, credit operations, or fraud triage answers to OJK for every action those agents take.
What the pattern looks like
A governed banking agent invokes skills, not core banking APIs: “retrieve customer balance with consent check,” “flag transaction for fraud review,” “initiate KYC re-verification.” Each skill embeds the bank’s validation and approval logic, executes through Workato’s orchestration layer, and writes an audit record an examiner can read. The bank gets agent-speed operations with bank-grade control — which is the only combination OJK-regulated institutions can defensibly run.
Agentic AI for e-commerce operations
E-commerce and marketplace operators gain the most immediate value from agents — and face the most immediate chaos without a control plane. Marketplace operations span order management, inventory sync across Tokopedia-Shopee-TikTok Shop-class channels, pricing, logistics coordination, and settlement reconciliation — high-volume, cross-system work that agents handle well.
Why governance is the scaling constraint
An ungoverned pricing or inventory agent operating across marketplaces multiplies errors at channel scale — one wrong input becomes thousands of mispriced SKUs in minutes. With a control plane, the same agent invokes bounded skills: price changes within approved ranges, inventory updates validated against the ERP, exceptions routed to humans. The control plane is what lets operations leaders scale agent throughput without scaling risk in proportion.
AI governance for state enterprises
For Indonesian state-owned enterprises (BUMN), agent governance is an accountability requirement before it is a technology choice. State enterprises carry public accountability, audit obligations, and ministry oversight; an agent program without identity, permissions, and audit trails is structurally incompatible with that mandate. The control-plane pattern fits BUMN reality: agents deliver the efficiency the digitalization agenda demands, while every action remains attributable, permissioned, and auditable — evidence that modernization strengthened control rather than diluted it.
Agentic AI maturity roadmap for 2026
Indonesian enterprises should sequence agent maturity in four stages, and the control plane is the gate between experimentation and scale.
Stage 1 — Inventory (now)
Catalog every agent, copilot, and LLM-driven process already touching production systems, with the credentials each one holds. Most enterprises that run this inventory find more agents than they authorized — shadow agents are the shadow IT of 2026.
Stage 2 — Control plane (this quarter)
Stand up the control plane and route existing agents through it: assign identities, convert their highest-risk actions into governed skills, and turn on audit logging. This step converts the governance gap from an unbounded risk into a managed program.
Stage 3 — Skill library (this year)
Build the enterprise skill library on the orchestration layer — every recipe already running in Workato is a candidate skill. Enterprises that invested in orchestration find their skill library is largely built; the work is exposure and permissioning, not construction.
Stage 4 — Scale (2026–2027)
Expand agents across departments on the governed foundation, measuring both throughput and control coverage. At this stage the control plane becomes the enterprise’s competitive asset: adding an agent is a permissioning decision, not an integration project.
FAQ
What is the difference between agentic AI and generative AI?
Generative AI produces content; agentic AI takes actions. An agent uses a model to decide, then executes tasks across business systems — updating records, moving money, triggering workflows. That action-taking capability is why agents require governance controls — identity, permissions, audit trails — that content-generating tools never needed.
What is an AI control plane?
An AI control plane is the layer between AI agents and enterprise systems that enforces governance on every action. It gives agents governed skills instead of raw API access, assigns each agent an identity and permissions, and logs every action. Workato Enterprise MCP is the control plane built on the Workato ONE platform.
Why shouldn’t agents call APIs directly?
Direct API access gives an agent the full blast radius of a credential — every action the API permits, at machine speed, with no business validation. Skills constrain agents to proven, bounded actions with guardrails and approval logic built in. The difference is between governed capability and unbounded exposure.
Is agentic AI compliant with Indonesian regulations?
Agentic AI is compliant when the enterprise can demonstrate control: attributable actions, scoped permissions, and complete audit trails. UU PDP No. 27/2022 holds enterprises accountable for personal data processing, and OJK holds financial institutions accountable for technology risk. A control plane produces exactly the evidence those obligations require.
How do Workato recipes relate to agent skills?
Recipes are governed workflows built on Workato’s orchestration platform; Enterprise MCP exposes them to agents as skills. A recipe that reconciles payments or provisions an employee becomes a proven action an agent invokes — with the recipe’s validation, permissions, and logging intact. The orchestration investment becomes the agent skill library.
Summary: govern the agent, not just the policy
The bottom line: Indonesian enterprises adopting agents faster than they govern them are carrying unpriced risk, and the fix is architectural — an AI control plane that gives agents identity, governed skills, audit trails, and orchestrated context. Workato Enterprise MCP is that control plane, built on the Workato ONE Enterprise Orchestration platform.
- The adoption-governance gap is an architecture problem; policies without enforcement infrastructure do not close it.
- Ungoverned agents create three liabilities Indonesian executives already own: data leakage under UU PDP, uncontrolled actions at machine speed, and unauditable decisions under regulator scrutiny.
- Agent governance requires four capabilities: governed skills (not raw APIs), agent identity, action-level audit trails, and orchestrated context.
- Enterprise MCP delivers all four through its pillars — Orchestrated Context, Trust & Security, Enterprise Skills — with trust built in, not bolted on.
- The 2026 sequence is inventory, control plane, skill library, then scale — enterprises that stand up the control plane first scale agents fastest and safest.