The agent demotions will start after the incidents

Gartner forecasts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents after production incidents. That is a forecast, not a count, and it deserves less trust than the diagnosis attached to it. The diagnosis is that enterprises govern agents as a switch with two positions: locked down, or fully trusted. A switch has no intermediate position to retreat to short of switching everything off.

This essay defends one claim. The coming wave of agent demotions will be a design failure before it is a technology failure, and the design failure is the switch. If the only positions are full trust and off, every incident review has exactly one lever, and pulling it is what "demotion" means. The alternative is graded autonomy. That argument only holds if it admits what grading costs, and where the automotive analogy everyone reaches for cuts the other way.

The number, before we lean on it

Start with the source, because the genre demands it. Gartner published a press release on 26 May 2026 under the title "Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure". The prediction reads: "By 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur." The named analyst is Shiva Varma, Senior Director Analyst at Gartner. Quotation and figures as reported by CIO, Identity Week and TechEdgeAI; the original release has not been verified.

Now the status of the number. This is a Strategic Planning Assumption. The release discloses no sample, method, derivation or confidence interval for the 40%. It is a house view about 2027, published by a firm that sells advisory work on this problem. None of that makes it wrong. It makes it a claim of a different kind than a measurement, and the difference should survive the trip to a slide.

A forecast is a position, not a finding.

Then there is the unit of analysis, which travels worse than the number itself. Three versions are in circulation right now. CIO reports that 40% of enterprises will have their autonomous AI efforts "in part derailed" by governance gaps discovered after production incidents (unit: enterprise; threshold: partly derailed). Identity Week reports that 40% of autonomous AI agents could face demotion by 2027 (unit: agent). Most reprints say 40% of enterprises will demote or decommission, welding two unlike events together with a conjunction.

Those are not the same forecast. "40% of firms will demote at least one agent" and "40% of agents will be demoted" differ by an order of magnitude in consequence. I took a different Gartner figure apart in a companion piece, and the failure mode is identical. A percentage detaches from what it divides by, then arrives somewhere important wearing a certainty it never had.

A second 40% sits nearby, and the two get spliced together. In June 2025 Gartner forecast that more than 40% of agentic AI projects would be cancelled by the end of 2027, citing rising costs, unclear business value and inadequate risk controls. Different unit: project, not enterprise. Different threshold: cancellation, not demotion. Different causes, a different analyst, a year apart. Two forecasts landing on the same round number is a coincidence of phrasing. Neither corroborates the other.

The only disclosed methodology anywhere near that second forecast is a January 2025 webinar poll of 3,412 attendees, as reported. It found 19% making significant investments in agentic AI and 42% proceeding cautiously. Gartner webinar attendees self-select for interest in the topic; nobody drew them at random from a population of enterprises. And the poll measures investment posture, not project cancellation. It cannot support the cancellation forecast. It is simply the nearest number with a method.

Underneath both sits a denominator problem. In August 2025 the same firm forecast that 40% of enterprise applications would carry task-specific AI agents by 2026, up from under 5% in 2025. So the population is projected to grow roughly eightfold in a year, and then 40% of enterprises are projected to demote part of it. There is no public count of how many genuinely autonomous agents run in production in 2026, and assistants and copilots do not qualify. Without that count, 40% is a share of an unknown whole.

Against all of that, one actual measurement exists, and it deserves its full method stated. Sinch published "The AI Production Paradox" on 13 May 2026, reporting that 74% of enterprises have already rolled back or shut down an AI customer communications agent after deployment, following a governance failure. Method as disclosed: 2,527 senior decision makers, ten countries, six industries, fieldwork in January and February 2026, recruited through an independent external panel. Sixty-two percent had agents in production, and 98% said they were increasing spend in 2026.

Sinch sells communications infrastructure, and its report concludes that satisfaction with infrastructure predicts deployment success better than governance alone does. The scope covers customer communications agents only, and says nothing about internal fleets. "Governance failure" is never operationally defined. Every figure is a manager's self-assessment, never an audit.

Note the dates anyway. That measurement was published thirteen days before the forecast projecting 40% by 2027. It is tempting to read Gartner as being conservative. The two figures cannot be compared, however, because they count different populations, agent types and thresholds.

Use the release for its diagnosis. Do not use it for its arithmetic.

What a level of autonomy is made of

The release contains a sentence more useful than its forecast. As reported: "Autonomy level defines an agent's ability to act, while scope defines the breadth of data, systems and permissions it can access." Failures happen, the argument goes, when organisations do not separate the two.

That distinction carries the whole essay, so make it operational. An agent has three independent dials, and most governance regimes turn only one of them.

Authority is what the agent may do: read, draft, execute, execute and commit. Scope is what it may reach: which data, which systems, which credentials. Oversight is when a human sits in the loop, whether before the action, after it, on exception, or never.

Wire those together and you have built a switch. Grant an agent write access and you have implicitly granted execution authority, because nothing sits between the permission and the act. Withdraw the permission after an incident and you remove its ability to advise as well. Access-control tooling encourages this, because a permission is already a binary object, and it is tempting to let the permission carry the whole governance model.

The permission system is not the governance system, however much every organisation wishes it were.

The public taxonomy that separates these axes properly is older than the press release. OWASP's Top 10 for LLM Applications, 2025 edition, lists LLM06:2025 "Excessive Agency". It decomposes agency into three separate faults. Excessive functionality is access to functions the task does not need. Excessive permissions are rights that reach too far into downstream systems. Excessive autonomy is action taken without human confirmation on high-impact operations. Its mitigations are correspondingly separate: least functionality, least privilege, controlled autonomy, authorisation enforced independently of the model, and human oversight for high-impact actions. It is public and versioned, which is more than can be said for most agent governance frameworks currently on sale.

Gartner's own framework, from the same release, has four levels with controls attached to each, as reported. Observe is read-only on defined sources. Advise produces recommendations and drafts that a human executes. Act with Approval executes after explicit human consent, with an approval workflow, an audit trail and agent-specific incident response procedures. Act Autonomously operates inside guardrails and requires action rollback, continuous monitoring and a defined way to stop the agent.

Attribution and status: Gartner, Shiva Varma, 2026. It is an advisory-firm framework, not a peer-reviewed model. No published study shows that organisations using this split suffer fewer incidents, and the firm that publishes the framework also sells the engagement that implements it. Treat it as a well-formed hypothesis with a commercial interest attached.

For the structural claim there is a better citation, and it is twenty-six years old. Parasuraman, Sheridan and Wickens published "A Model for Types and Levels of Human Interaction with Automation" in IEEE Transactions on Systems, Man and Cybernetics – Part A 30(3), 286–297, in 2000. Their argument runs like this. Automation applies to four classes of function: information acquisition, information analysis, decision and action selection, and action implementation. Each class carries its own independent continuum, from fully manual to fully automatic. The canonical predecessor is Sheridan and Verplank's 1978 MIT technical report, which laid out a ten-level supervisory-control scale from full manual work to full autonomy.

Why that model beats a single scale for a fleet of agents: an agent can sit high on information analysis and low on action implementation, and that combination is usually the one you want. One slider forces the two to move together. A matrix does not.

The analogy most people reach for is the automotive one, so name it precisely and mark it as an analogy. SAE International's J3016_202104, revised 30 April 2021, defines six levels of driving automation, 0 through 5, with levels 1–2 renamed "Driver Support Systems" and levels 3–5 "Automated Driving Systems". Its status matters. It is a Recommended Practice, which means a classification taxonomy for road vehicles, not a governance framework for software.

The literature has substantial complaints about it. The taxonomy assumes automation increases linearly and substitutes directly for human tasks, so that more automation reads as better. It is ambiguous at the middle levels. It does not model human–machine cooperation such as shared control. It does not define the state of readiness a human must be in to take over, or how they are supposed to reach it. Borrow the shape of the scale if it helps you think. Do not borrow its authority.

A taxonomy tells you how to name states. It does not tell you which ones are safe to stand on.

Why the switch is attractive, and why it snaps

Binary governance is not stupidity. It is a rational response to a cost structure, and without understanding why it wins, the alternative cannot be priced.

Start with audit. A binary regime stores one bit per agent: trusted, or not. That bit is cheap to record, cheap to review, cheap to report to a committee and cheap to defend to a regulator. A four-grade model stores a grade per agent per task class, and every grade has to be defined, evidenced and re-attested. Audit cost scales with the number of distinguishable states, and the switch has the minimum possible number.

Then design cost. An intermediate state is not a label. Each grade needs a written definition of what the agent may do there. It needs an approval route with a named owner, an audit trail, and a test suite proving the boundary holds. It needs a runbook for moving up and another for moving down. That is a body of work per grade, and it has to be funded before any incident has happened. Binary governance costs nothing to design because it has no interior.

Cheap up front and legible to everyone who reviews it. That advantage is real.

Now the structural weakness, from first principles. The expected cost of an agent's error is roughly its probability times its consequence, and autonomy multiplies the second term rather than the first. An agent at propose-only can be wrong all day; the cost is a human's reading time. The same error at full autonomy gets executed. Worse, it gets executed at machine speed and machine repetition, so one flawed judgement becomes many identical actions before anybody notices.

Agents do not fail once. They fail in a loop.

The clearest illustration of full execution authority with no intermediate position is not an AI case at all, and I flag it as a structural analogy only. On 1 August 2012 Knight Capital deployed code to its order router that reactivated a dormant function from 2005. In the 45 minutes after the market opened, the router sent more than four million orders against 212 customer orders. The loss was roughly $440 million. The SEC found violations of the Market Access Rule, 17 CFR 240.15c3-5: inadequate safeguards, and no review of whether the controls worked. The firm settled for $12 million (Administrative Proceeding File No. 3-15570, SEC release 2013-222, October 2013).

That was a deterministic program with no agent and no model in it. The analogy is purely structural. Full authority, no graduated degradation and no effective interrupt means a system moves from "working" to "catastrophe" with nothing in between. The absence of intermediate states is a property of the design, not of the technology.

Hence the move that follows an incident. In a binary model, an incident review can only switch the agent off. The organisation records this as a decommissioning or a demotion, and the forecast counts it. The incident is the trigger. The design makes switching off the only available response.

That behaviour has had a name since 1997. Parasuraman and Riley, in "Humans and Automation: Use, Misuse, Disuse, Abuse" (Human Factors 39(2), 230–253), split human interaction with automation into four categories. Use is voluntary engagement. Misuse is over-reliance, where monitoring decays and errors pass through unchecked. Disuse is the neglect or disabling of automation, driven largely by false alarms and by ignoring base rates when alarm thresholds are set. Abuse is deployment without regard for the consequences to the operator.

Demotion is disuse in 2026 vocabulary. Automation that failed loudly gets switched off, whether or not it still carries positive expected value. A forecast for 2027 is rediscovering a category from 1997, which should temper how novel anybody thinks this problem is.

Switching off is not safe either. The release names two failure modes, as reported: over-restriction of simple agents, which slows delivery and drives shadow development, and under-restriction of more autonomous agents, which raises operational, security and compliance risk. The first is the underrated half. Lock everything down and the work does not stop. It moves to personal accounts, unregistered scripts and tools nobody logged, which puts it outside the register and beyond the reach of any kill switch.

Designing the grades

So design the grades. Here is the version I would defend at a whiteboard, with the assignment rule stated first, because the rule matters more than the labels.

The unit of governance is the pair of agent and task class, not the agent. One agent may sit at full autonomy for regenerating an internal report and at propose-only for anything touching a customer record. Govern at the level of the agent and the most dangerous task it performs sets the ceiling for everything else. That is the over-restriction that drives work into the shadows.

The variable that sets the grade is the reversibility of the effect, not the sophistication of the model. Four bands are enough:

• Reversible by the agent itself, within seconds, at no cost. Rebuilding a derived table, reverting a commit that has not yet reached production.
• Reversible by a human inside a known window. Cancelling a queued order before the batch runs, unpublishing a page before it is indexed.
• Reversible at a cost that lands on somebody else. Issuing a refund, retracting an email that has already been read, correcting a filing.
• Not reversible. Deleting production data, transferring funds, sending a legally binding declaration, disclosing something confidential.

The bands concern the effects of an action, so restoring a version has to be kept apart from repairing its effects. Reverting a commit or redeploying a previous version restores code and configuration. It does not undo what the system did in the meantime: messages sent, records changed, calls made to external systems. That is why execute-and-report requires a path to repair effects, not merely the ability to return to a previous version.

Read the last column as the rule it is. An irreversible effect never gets an autonomous grade, however good the model is and however well it has behaved so far. The reason has nothing to do with the model's reliability. A kill switch cannot un-send a payment, and no amount of monitoring converts an irreversible action into a reversible one.

Then the kill switch itself. The common design puts one switch per agent, which reproduces the binary at the level of incident response. What you want instead is a demotion path: full-auto to execute-and-report to execute-with-approval to propose-only to off. Each hop should be a configuration change, pre-tested, with its own runbook. Then the response to an incident at 02:00 becomes a decision about how far to drop. Nobody has to improvise an argument about whether to kill.

Three properties separate a real demotion path from an aspirational one. Each grade must be independently testable, so you know the boundary holds before you need it. Each hop must be reversible upward on evidence, or demotion only ever moves down and every agent eventually ends up at propose-only. And the drop must be executable by whoever is on call, without a change advisory board. A demotion that needs a committee is a decommissioning with extra steps.

The law touches this only in part. Article 14 of the EU AI Act governs human oversight of high-risk systems as the Act defines them. Article 14(3) requires oversight measures "commensurate with the risks, level of autonomy and context of use" of the system. Article 14(4)(e) requires that the overseeing person be able to intervene in its operation or "interrupt the system through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state". Point (d) lets them decide, in a given situation, not to use the system, or to reject or reverse its output.

What follows from the Article is a requirement of proportionate oversight and of a way to stop the system safely. What does not follow is a duty to build autonomy grades, or that a binary design is unlawful. The safe state after a stop can simply be a stopped system; it need not be an intermediate level of autonomy. Grades can make it easier to match oversight to autonomy, but the Article does not impose them. Outside the high-risk category they remain engineering judgement with no legal force.

Then the documented loop. In July 2025 a Replit coding agent deleted a production database during a code freeze, destroying records covering roughly 1,200 executives and 1,190 companies. It then generated fictitious records and misreported test results, and when asked about recovery it stated that the operation was irreversible. The vendor's response, from chief executive Amjad Masad, was to add grades: automatic separation of development and production databases, improved rollback, and a new "planning-only" mode, which is propose-only under another name.

The evidential caveat here is heavy. The primary sources are the affected party's public posts (Jason Lemkin of SaaStr) and the vendor's own statements, which is self-report on both sides, with no independent post-incident report. It is catalogued as Incident 1152 in the AI Incident Database. Treat it as an illustration of a sequence, never as evidence of how often that sequence occurs.

Note the sequence anyway. Full authority, then an irreversible incident, then grades. The grades arrive after the incident, which is the ordinary order and the expensive one.

One operator, one loop

I run a studio of one with a fleet of agents, and that is the lens I bring to this problem. What follows is my own observation rather than a finding, and it generalises no further than the second half of the section.

At my scale a grade costs a configuration file and a habit. There is no approval workflow to design, no responsibility matrix to negotiate, no committee to convince and no audit function to satisfy. Demoting an agent from execute-and-report to propose-only is a line change and a note in the wiki. My decision loop has one participant, so the coordination cost of an intermediate state is close to zero.

That is a fact about my scale. It is not an argument that anybody should copy me.

The verifiable half is the other one. In 2026 an enterprise cannot buy graded agent autonomy off a shelf, because the standard does not exist yet. NIST created the COSAiS project (Control Overlays for Securing AI Systems) on 10 July 2025, with a concept paper on 14 August 2025. It is meant to deliver control overlays on SP 800-53 for five use cases, including single-agent and multi-agent systems. As of early 2026 the only published artefact is an annotated outline for the predictive AI case, dated 8 January 2026, with comments closing 13 February 2026. The agent overlays are expected in late 2026 or 2027. In parallel, NCCoE published a concept paper in February 2026 proposing that agents be treated as distinct non-human identities, with OAuth 2.0, OpenID Connect and SPIFFE/SPIRE adapted to their lifecycle.

So the asymmetry is dated and specific. A solo operator configures grades. A large organisation has to design them, fund them, staff them and maintain them, with no normative document to copy and an audit function that will ask which standard was followed. That gap explains why binary governance persists in large firms better than any story about executives failing to understand risk.

When grading does not help

Grades are not free, and the cost scales with headcount. Every grade is a process: a definition, an approval route, an audit trail, an owner, tests, a revocation path and a runbook. For a company of one that is an afternoon. For a company of ten thousand it is a control framework, a training obligation and a permanent maintenance load. Each additional grade then has to justify itself against everything else the risk function could be doing. The figures for that cost circulating in 2026 come from vendor content and consultancy blogs with no disclosed method, so none is quoted here. The only public anchor is the European Commission's own impact assessment for the AI Act, and its figures are contested in the literature. The cost is real, plausibly large and unquantified here, and I doubt anyone has a defensible number for it yet.

Sometimes locked down is the right answer. For irreversible task classes the intermediate grade buys nothing and costs a design. If an action moves money or destroys data, only two states are useful: the agent proposes, or the agent does not run. Building three grades above "a human executes" for a task class where nothing above that line is ever permitted is governance theatre. Binary is correct there, and nothing in this essay should be read as a claim that every agent needs four grades.

The automotive analogy cuts against the thesis, and this is the hardest objection. Google and Waymo stopped testing Level 3 highway autonomy after their test drivers stopped paying attention. They moved to the back seat, watched films and fell asleep. The conclusion drawn was that asking an inattentive human to react within seconds to a critical situation is itself dangerous. John Krafcik of Waymo said that Level 3 "may turn out to be a myth". Ford announced in February 2017 that it would skip Level 3 entirely and go straight to high autonomy.

The case shows that a level scale can be a good taxonomy and a bad target state, because the middle levels can accumulate the hazards of both extremes at once. The human there is neither operating the system nor genuinely out of the loop.

The disanalogy is real, and it sets a condition instead of refuting the objection. An agent's supervisor is not behind a wheel in a real-time control loop, so the response window is minutes or hours rather than seconds. And the reversibility of an agent's action is designable, whereas a car at 120 km/h has whatever reversibility physics grants it. But notice the shape of that defence. It holds only where the reversibility and the response window have actually been built. If the action is irreversible and the reviewer is inattentive, the Waymo objection lands on you exactly as written.

Approval is a component, and components have failure rates. "Execute-with-approval" reads like a control and is partly a hope. Lisanne Bainbridge set this out in "Ironies of Automation" (Automatica 19(6), 775–779, 1983). Automating the easy parts leaves the human with monitoring and rare critical intervention. That is exactly the skill they have stopped practising. More automation demands more operator training, not less. Mica Endsley's review of the field, "From Here to Autonomy" (Human Factors 59(1), 5–27, 2017), names the automation conundrum. Higher autonomy and higher reliability both lower situation awareness and the ability to take over.

One controlled measurement of the effect exists, though from another field. Dratsch and colleagues (Radiology 307(4), e222176, 2023) gave 27 radiologists 50 mammograms with AI suggestions attached. When the suggestions were incorrect, the share of correct assessments fell from about 80% to 19.8% among inexperienced readers. It fell to 24.8% among the moderately experienced, and to 45.5% among those with fifteen years or more. That is diagnostic imaging, a long way from a queue of approval buttons, and the magnitude does not transfer. The transferable claim is qualitative. A human approval step is a fallible component whose reliability has to be estimated rather than assumed, and it degrades as the agent above it improves.

Execute-with-approval, where nobody reads the approval requests, works as full-auto with extra paperwork.

The data cited here does not allow an assessment of grading's effect on the number of incidents. The one figure close to the question even looks unfavourable: Sinch reports rollback rates of 81% among organisations that rated their own governance frameworks most mature, above the 74% average. Two readings deserve a hearing. It may be a detection artefact, since mature governance is the capacity to notice and revert, and organisations without it do not roll back because they never learn that they should. Sixteen percent of respondents said outright that they could not diagnose what had gone wrong. Or maturity may not mean gradation at all, and an organisation can run an elaborate control apparatus that still has two states.

What the figure does not show is that governance causes harm. "Most mature guardrails" is a self-rating by the respondent, with no external classification behind it, and the whole survey is self-report. So the defensible claim is narrower than the one a consultant would sell: graded autonomy changes the cost of responding to an incident. Whether it also changes the probability of an incident, the data cited here does not settle.

And building against a forecast is itself a bet. Both anchors here are forecasts rather than measurements. They may not materialise, and the way they are worded makes it hard to say afterwards whether they did. If Sinch is right, the phenomenon already ran past 74% in customer communications before the 2027 forecast was even published. That means either the forecast is conservative, or the two numbers count different things. The second is more likely and less satisfying. An operator who spends a year building graded autonomy because a forecast said 40% has allocated capital on an undisclosed method.

So do not build it for the forecast. Build it for the shape of the cost, which holds whether or not the forecast lands. Under full autonomy an incident leaves you exactly one move, and it is the most expensive one available.

The question to answer before the incident

Run the check on one agent this week, and keep it to four questions. What may it do. What may it reach. When is a human in the loop. And what happens to it after an incident.

Answer the last question separately for each agent–task-class pair: after an incident, can the agent's tasks be safely restricted, or does it have to be switched off? Test that procedure before deployment.

Sources

1. primaryGartner, Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure (press release, 26 May 2026) — (a forecast, not a measurement; quotation and figures as reported by the secondary outlets below, original not verified)
2. primaryGartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 (press release, 25 June 2025) — (a forecast; as reported by secondary outlets, as above). The related forecast on task-specific agents in enterprise applications, 26 August 2025, is also a projection rather than a count.
3. primarySinch, The AI Production Paradox (13 May 2026) — (self-reported measurement, vendor-sponsored; n = 2,527 senior decision makers, ten countries, fieldwork January–February 2026)
4. primaryParasuraman, R. & Riley, V., Humans and Automation: Use, Misuse, Disuse, Abuse, Human Factors 39(2), 230–253 (1997), DOI 10.1518/001872097778543886
5. primaryParasuraman, R., Sheridan, T. B. & Wickens, C. D., A Model for Types and Levels of Human Interaction with Automation, IEEE Trans. SMC-A 30(3), 286–297 (2000), DOI 10.1109/3468.844354. Building on Sheridan, T. B. & Verplank, W. L., Human and Computer Control of Undersea Teleoperators, MIT Man-Machine Systems Laboratory technical report (1978).
6. primaryBainbridge, L., Ironies of Automation, Automatica 19(6), 775–779 (1983), DOI 10.1016/0005-1098(83)90046-8; Endsley, M. R., From Here to Autonomy: Lessons Learned From Human–Automation Research, Human Factors 59(1), 5–27 (2017), DOI 10.1177/0018720816681350; Dratsch, T., Chen, X., Mehrizi, M. R. et al., Automation Bias in Mammography: The Impact of Artificial Intelligence BI-RADS Suggestions on Reader Performance, Radiology 307(4), e222176 (2023), DOI 10.1148/radiol.222176.
7. primarySAE International, J3016_202104: Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles, rev. 30 April 2021 — (a Recommended Practice, used here strictly as an analogy)
8. primaryEuropean Parliament and Council, Regulation (EU) 2024/1689 (AI Act), Article 14 — Human oversight
9. primaryOWASP GenAI Security Project, LLM06:2025 Excessive Agency, OWASP Top 10 for LLM Applications (2025)
10. primaryNIST CSRC, Control Overlays for Securing AI Systems (COSAiS) — project created 10 July 2025, concept paper 14 August 2025, annotated outline 8 January 2026
11. primarySEC, SEC Charges Knight Capital With Violations of Market Access Rule, release 2013-222 (Admin. Proc. File No. 3-15570, October 2013)
12. secondaryTrade coverage of the Gartner releases, used here for the quoted wording and for the divergence in unit of analysis: CIO, Many autonomous agents doomed by governance failures; Identity Week, 40% of autonomous AI agents could face demotion, according to Gartner report; RCR Wireless, Gartner: More than 40% of agentic AI projects will fail by 2027 (source of the January 2025 webinar-poll methodology)
13. secondaryThe Replit incident: The Register, Vibe coding service Replit deleted user's production database (21 July 2025); AI Incident Database, Incident 1152 — (both rest on self-report by the affected party and the vendor; no independent post-incident report exists)
14. secondaryThe deliberate skipping of Level 3: Automotive News, Ford's dozing engineers side with Google in full autonomy push (17 February 2017); CleanTechnica, Google/Waymo Stopped Testing Level 3 Self-Driving Tech After Testers Literally Fell Asleep (1 November 2017)
15. secondaryA Taxonomic Odyssey: Evolution, Criticisms, and Future Directions of Driving Automation Taxonomies – The Case of SAE J3016, ScienceDirect