Somewhere in your enterprise, an AI agent is about to call a sub-agent, which will call another sub-agent, which will call a tool, which will reach into a system of record. Now ask a simple question: on whose authority did that chain run, and can you prove it?
For most CIOs today, the honest answer is no. That gap, more than model quality or GPU budgets, is what keeps agentic AI stuck in proof-of-concept purgatory. Gartner has predicted that more than 40 percent of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls.
MongoDB’s SVP Ashish Kumar thinks he knows how to close that gap, and he has a rare vantage point from which to say so. Before joining MongoDB roughly three years ago, when it acquired the startup he ran, Kumar spent years at Google, most recently running its databases, including Bigtable and Spanner.
Today he describes himself as a technical fellow at MongoDB, looking at architecture, strategy and technical direction across the company. Speaking to Express Computer, he laid out why the database is being pulled from the edge of the application to the centre of every decision an agent makes.
From developer love to enterprise obligation
Kumar’s argument begins with history. MongoDB popularised the document model about 15 years ago on a simple premise: store data the way developers think about it. It worked so well that it became a rival’s envy.
“When I was building databases at Google, we used to look at MongoDB with envy because, you know, people could download the software and get going,” Kumar said. When he launched Firestore, a document database, he told his team to match that experience. “It’s very, very difficult.”
That developer affection has since hardened into enterprise dependence. MongoDB says it serves more than 70,000 customers, including roughly 75 percent of the Fortune 100. “At that point, it’s not just about developer love,” Kumar said. “It is around enterprise capabilities, so security, durability, availability, performance.”
Then came a pattern nobody had planned. MongoDB had added full-text search, then vector search, and in early 2025 acquired Voyage AI, whose embedding and re-ranking models rank among the best available. When Kumar began talking to customers about their agentic AI work in mid-2025, he found them already combining the pieces on their own. “Almost everyone, most of our customers, found that these three components, the document database, which has low retrieval latency, very high throughput, shardability, and all of that, along with our vector search and our Voyage AI embedding models, [were] the perfect combination to store agentic memory,” he said.
The next question was the uncomfortable one: why were those customers still stuck in pilots?
Three gaps between the demo and production
Kumar says the answer fell into three buckets, and each one is a line item on a CIO’s risk register.
Security and governance. Agents act on behalf of people, but chains of agents blur whose permissions apply. “Agents might make a call to sub-agents that call another sub-agent which might make a call to a tool,” Kumar explained. “That tool, when it accesses Salesforce, let’s say, as a backend system, should be on behalf of the permission of the original request, right? Not anything else.” And afterwards, someone must be able to reconstruct what happened. “CIOs and CISOs want to be able to look at that trace as well.”
Cost and context. The first instinct with large language models was to stuff in as much context as possible. That instinct is fading fast. “Now they’re trying to curtail it back because eventually it’s dollars, right?” Kumar said. Precision matters, which is where Voyage AI’s retrieval models come in: better retrieval means fewer tokens spent and more accurate answers.
Openness. “The state of the art is changing every week in terms of models or frameworks,” he said, and so “every enterprise wanted to hedge.” Nobody wants to be locked into one model, one cloud or one framework.
Atlas Agent Engine, which MongoDB launched in public preview on September 29 alongside Atlas Infinite and MongoDB 9.0, is the company’s answer to all three. Customers can adopt its memory and governance layers on their own or with its runtime, using the models and frameworks they already run. Pricing is consumption-based.
Governance by design: Intercept everything
The most distinctive idea Kumar described is architectural. In most agent setups, a call from an agent to a sub-agent, or to a tool, happens inside the same process. It is invisible to the enterprise. “When that agent makes a call to a sub-agent, there’s usually no tracking on it,” he said. “Or the agent makes a call to a tool, there’s no tracking on it because it’s running in the same process space.”
MongoDB’s approach is to catch those calls on the way out. “We actually intercept that, we bring it back to a central point where you govern it, you log it, you trace it, and then you make the tool call, even if it’s coming back to the same process,” Kumar said.
The payoff for a CIO is twofold. Central policy can dictate what is and is not allowed across the enterprise. And every step is recorded, so the question “why did that tool get called with this parameter?” has an answer. “We provide the entire traceability of the entire chain, just out of the box,” he said.
Asked whether such a design could have prevented the rogue-agent incidents that have made headlines, Kumar did not hedge: “Absolutely, and I think we’ve designed for it.”
He was equally direct on the emerging worry over the Model Context Protocol. The risk, he argued, lies in implementation rather than the standard. The old microservice habit of running with a service account that has full database access must not be repeated. “The MCP server should not have, like, a service account access to the backend database,” Kumar said. “It should, for that particular request, make that request with the identity of the user that originally made that request.” Data coming back must also be sanitised. “There needs to be some interception point somewhere in the middle.”
What an “agentic application” actually looks like
Kumar is careful to separate enterprise agents from chatbots. Take a bank processing a payment. Today, static models score it for fraud. In an agentic design, a language model can pull the customer’s last five transactions from memory, compare them with their usual merchants and login locations, and weigh all those signals together.
“Each of these becomes an agentic app. These are backend enterprise AI applications,” he said. “This is not like a ChatGPT, which is like a more productivity application. These are enterprise agents.”
The early adopter evidence is in the same spirit. Paysafe, one of the first companies building on Atlas Agent Engine, is looking to use an agent to help analysts investigate unusual activity across its payment network, cutting the time between a problem emerging and a team acting on it.
This, Kumar says, changes what a database is. “In the past, databases were these passive entities. You basically defined a model, and then you read and wrote to that database, and that’s it. It sat on the side. Databases or data layers are now becoming central to the application itself.” Procedural, episodic and taxonomic memory now sit “right into the decision chain.” His blunt conclusion: “Databases that just hold data for reads and writes, I think, are legacy.”
And where does it all end? “In the future, all applications are going to be agentic,” Kumar said, while declining to put a date on it. “It’s going to take some time, so I’m not putting a timeline on it.”
Importantly, he does not expect a great consolidation of applications. Silos can stay, connected through open standards. “Agentic AI actually allows you to keep siloed applications, but yet interconnected via the open standards of A2A and MCP.”
Memory is the moat
If there is one sentence Kumar wants CIOs to carry out of the room, it is this one: “My belief is that memory is going to be the [moat] for enterprises in the future.”
The logic is practical. Every agent call, tool invocation and failure is data. “Where does it get stuck? Where do failures happen? If you collect that data over the next year or two, you can actually make your enterprise more efficient,” he said. “You can understand where customers are having problems and what changes you need to make to your processes and procedures.”
There is a flip side that explains his dislike of tool sprawl. “Every time I’ve talked to an enterprise, they have 25 different tools to do the same thing,” Kumar said. “Fragmented memory is sort of, it’s like the reverse of the moat. You’re basically not learning from it.”
Ownership is the other half of the pitch. MongoDB says agents built on its platform can run on a laptop, on-premises or on any public cloud. The first public preview runs on AWS, with other platforms to follow shortly, and a community edition is planned as an open-core on-ramp for developers. On the memory itself, Kumar was categorical: “That is yours, that belongs to you, it gets stored in your database, not some third-party managed database, it’s yours, and you can take that away if you want.”
The legacy question, India’s version
For Indian enterprises carrying decades of accumulated systems, the agentic future runs straight through the legacy estate. Kumar pointed to MongoDB’s Application Modernization Platform, or AMP, and a new partnership with Cognition, the company behind the Devin AI software engineer, to speed it up.
The hard part is rarely the data. “It’s the application that’s harder, right? You’ve got support procedures and triggers and stuff that you’ve written over time and frontends that you’ve written. How do you migrate those? And that’s usually where things get delayed and stuck,” he said. MongoDB says AMP has accelerated modernisation projects two to three times on average, and Kumar said the company is working with several foundation-model labs on the effort as well.
The bottom line
The model race will keep reshuffling itself every few weeks, and no CIO should bet a roadmap on who leads it next quarter. What will not change is the question a regulator, an auditor or an angry customer asks after something goes wrong: what did the agent do, and who allowed it?
The enterprises that can answer in seconds will scale agents. The ones that cannot will cancel them, right alongside Gartner’s 40 percent. Models are rented. Memory, governed and owned, is the only part of the agentic stack that compounds.
Build the moat before you buy the next model.