.png)
Before You Sign an AI Agent Contract: 8 Questions Every Executive Should Ask
Most AI agent proposals now arrive with the same slide: an autonomous assistant that reads email, updates the CRM and closes tickets while your team sleeps. The demo works. The question for the executive signing the contract is different: will it still work, safely and at a known cost, eighteen months from now, connected to your real systems?
That question matters because the market is moving faster than its discipline. In a September 2026 survey of 314 US C-suite leaders at companies with more than $1 billion in revenue, KPMG found that 62% are building or deploying AI agents, up from 53% one quarter earlier. At the same time, Gartner predicted in June 2025 that over 40% of agentic AI projects will be canceled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls.
The gap between those two numbers is where most of the money will be lost. It is also predictable, and a buyer who asks the right questions before signing can close most of it.
The short answer
How should executives evaluate an AI agent vendor? Judge the agent on four things the demo does not show: how it connects to your systems (open standards such as the Model Context Protocol, not custom connectors you cannot leave), what it costs to run per completed task at your real volume, how it is secured against prompt injection and excessive permissions, and who owns the code, data and workflows when the contract ends. Then tie payment to a measured business outcome, not to activity.
Why agent contracts fail differently
A traditional software contract buys a fixed capability. An agent contract buys a system that reasons, calls tools and acts on your data, which changes three things.
First, cost is variable and driven by usage. Anthropic's engineering team reported in June 2025 that agents typically use about 4 times more tokens than chat interactions, and multi-agent systems about 15 times more. Token prices are falling fast, but volume can rise faster.
Second, the attack surface is the workflow itself. The OWASP Top 10 for LLM Applications 2025 ranks prompt injection first and lists "excessive agency" among the top risks: an agent with more permissions than its task requires.
Third, value is often overstated at signature. Gartner estimates that only about 130 of the thousands of vendors marketing "agentic" products offer genuine agentic capabilities, and calls the rest "agent washing." Its analyst also noted that many use cases positioned as agentic do not need an agentic implementation at all.
The 8 questions
1. Does this problem actually need an agent?
An agent is justified when a task requires judgment across several systems and steps. Many requests are better served by a deterministic workflow, a classic integration or a single model call, which are cheaper and easier to audit. Ask the vendor to explain why a simpler design would not work. A vendor who cannot answer is selling a category, not solving a problem.
2. How does it connect to our systems, and can we leave?
Integration is where agent projects quietly become lock-in. The Model Context Protocol (MCP), introduced by Anthropic in November 2024 and donated in December 2025 to the Agentic AI Foundation under the Linux Foundation, has become the common way for agents to connect to tools and data. According to Anthropic, it is supported in ChatGPT, Gemini, Microsoft Copilot, VS Code and Cursor, with more than 10,000 active public servers.
Ask whether the vendor's connectors use MCP or another open standard, whether you can swap the underlying model, and what you can take with you if you terminate: prompts, tool definitions, evaluation sets and logs.
3. What will it cost to run, per completed task, at our volume?
Build cost is the visible number; run cost is the one that compounds. Inference has become dramatically cheaper. Stanford HAI's 2025 AI Index found that GPT-3.5-level performance fell from $20 to $0.07 per million tokens between November 2022 and October 2024, and Epoch AI measured declines of 9x to 900x per year depending on the task. But agent workflows multiply token use, and OWASP names "unbounded consumption" as a risk in its own right.
Ask for a cost-per-completed-task estimate at your projected volume, the assumptions behind it, and the controls that cap spend. KPMG found that 43% of large US enterprises already use usage or token budgets for AI.
4. What can the agent do without a human?
Autonomy should be a dial, not a default. KPMG reports that 49% of large US companies have defined high-risk use cases in which agents may not decide on their own. Ask the vendor to map every action the agent can take to one of three levels: acts alone, acts with approval, or recommends only. Then ask how that mapping is enforced in software, not in a policy document.
5. How is it protected against prompt injection and over-permissioning?
An agent that reads external content (emails, web pages, supplier documents) can be manipulated by instructions hidden inside that content. The MCP specification itself states that tools represent arbitrary code execution and that the protocol cannot enforce its security principles on its own; the implementation must.
Ask for least-privilege credentials per tool, separation between untrusted content and actions, logging of every tool call, and evidence of adversarial testing against the OWASP categories. The NIST AI Risk Management Framework and its Generative AI Profile (NIST AI 600-1) give your risk team a common vocabulary for this review.
6. Who owns the code, the data and the learning?
Clarify ownership of source code, prompts, workflow definitions, any fine-tuned weights and evaluation datasets. Confirm whether your data is used to train vendor or third-party models, where it is processed and how long it is retained. These terms decide whether the agent is an asset on your side of the ledger or a dependency on theirs.
7. How will we know it works, before and after go-live?
Demand an evaluation set built from your own historical cases, an agreed accuracy threshold for each task, and production monitoring that tracks failures and escalations, not just usage. If a vendor reports success as "conversations handled," ask what share of those were resolved correctly without rework.
8. What business metric is the contract tied to?
Pick one metric the CFO already tracks (cost per ticket resolved, days sales outstanding, hours of manual reconciliation per month) and agree on a baseline before work starts. Structure milestones, and where possible part of the fee, around movement in that metric.
A scorecard for your shortlist
| Dimension | Red flag | Strong answer |
|---|---|---|
| Need | "Everything can be an agent" | Explains why simpler automation is insufficient |
| Integration | Proprietary connectors only | MCP or open APIs; model can be swapped |
| Run cost | Only a build price | Cost per completed task at your volume, with spend caps |
| Autonomy | Fully autonomous by default | Action-by-action autonomy map, enforced in code |
| Security | "The model is safe" | Least privilege, tool-call logging, adversarial testing |
| Ownership | Vendor retains workflows and data | You own code, prompts, evals and logs |
| Measurement | Activity metrics | Evaluation set from your cases; accuracy thresholds |
| Contract | Open-ended time and materials | Milestones tied to a baseline business metric |
A perspective that challenges the consensus
The prevailing advice is to wait until token prices fall further before scaling agents. Unit prices will keep falling, but total cost depends on how many calls a workflow makes and how well it is bounded. A poorly designed agent stays expensive at any price per token; a well-scoped one is usually affordable today. Design discipline matters more than market timing.
Editorial note: this is DaCodes' interpretation of the Anthropic, Stanford HAI and Epoch AI data above.
What this means for business leaders
- The cancellation risk is mostly decided at signature. Gartner's three causes (cost, unclear value, weak risk controls) map directly to questions 3, 8 and 5.
- Open standards have strengthened the buyer's position. With MCP governed by a neutral foundation and supported by the major AI platforms, accepting proprietary integration is now a choice, not a necessity.
- Falling token prices do not guarantee falling bills. Unit cost and total cost move in different directions when agents multiply calls. Budget for the total.
Your next 90 days
- Days 1–30: List current or proposed agent initiatives and apply question 1 to each. Drop or downgrade those that do not need an agent.
- Days 31–60: For the remaining one or two, set a baseline business metric and build an evaluation set from a few hundred real historical cases.
- Days 61–90: Run the shortlist through the scorecard and negotiate integration standards, data ownership and spend caps before scope.
Frequently asked questions
What is the Model Context Protocol (MCP)? MCP is an open standard, introduced by Anthropic in November 2024, that lets AI agents connect to tools and data sources through a common interface. In December 2025 it was donated to the Agentic AI Foundation, a fund under the Linux Foundation co-founded by Anthropic, Block and OpenAI.
Why do so many agentic AI projects get canceled? Gartner attributes its forecast that over 40% of agentic AI projects will be canceled by end-2027 to escalating costs, unclear business value and inadequate risk controls. It also warns that many vendors relabel chatbots or RPA as agents.
How much does it cost to run an AI agent? It depends on volume and design. Per Anthropic, agents use about 4 times the tokens of a chat interaction and multi-agent systems about 15 times. Ask vendors for cost per completed task at your volume and for hard spend limits.
What is the biggest security risk with AI agents? Prompt injection, ranked first in the OWASP Top 10 for LLM Applications 2025: malicious instructions hidden in content the agent reads. The risk grows with the agent's permissions, which is why least privilege and approval steps matter.
Should an AI agent be allowed to act without human approval? Only for actions whose errors are cheap and reversible. KPMG found that 49% of large US companies have defined high-risk use cases where agents cannot decide autonomously.
Conclusion
The decision in front of most leadership teams is not whether to use AI agents but which contracts to sign and on what terms. Insist on open integration, a known run cost, enforced limits on autonomy, ownership of what is built, and a business metric that defines success. A vendor that welcomes those questions is usually the one worth hiring.
Evaluating an AI agent proposal? DaCodes can review its scope, integration approach, run-cost assumptions and risk controls with your team before you sign. → Talk to DaCodes
Sources
- KPMG, Q3 2026 AI Pulse, Sep 24, 2026
- Gartner forecast, as reported by W.Media: Over 40% of agentic AI projects could face the axe by end of 2027, Jun 27, 2025.
- Anthropic, Introducing the Model Context Protocol, Nov 25, 2024.
- Anthropic, Donating MCP and establishing the Agentic AI Foundation, Dec 9, 2025.
- Model Context Protocol, Specification (version 2026-07-28).
- Anthropic Engineering, How we built our multi-agent research system, Jun 13, 2025.
- Stanford HAI, AI Index Report 2025.
- Epoch AI, LLM inference prices have fallen rapidly but unequally across tasks, Mar 12, 2025.
- OWASP GenAI Security Project, Top 10 for LLM Applications 2025.
- NIST, AI Risk Management Framework and Generative AI Profile, NIST AI 600-1 (Jul 26, 2024).
