The TACO Framework: KPMG's Playbook for Enterprise Agent Deployment
Why Categorization Matters Now
KPMG's latest research shows 90% of organizations are moving AI agents from proof-of-concept to pilot or production. That's no longer an "if" question—it's a "how" question. And for those of us deploying agentic AI in defense, government contracting, and regulated enterprise contexts, "how" requires frameworks that map capability to governance.
This week, KPMG published their TACO framework—a categorization system for agentic AI that's actually useful. Not another consulting deck with theoretical maturity models. A practical taxonomy: Taskers, Automators, Collaborators, Orchestrators.
The framework matters because different agent types require different governance models, risk profiles, and implementation approaches. Deploy an Orchestrator with Tasker-level oversight and you're asking for trouble. Treat a Tasker like an Orchestrator and you'll never get out of committee review.
The TACO Categories: What They Actually Mean
Taskers: Routine Automation at Scale
What they are: Single-purpose agents that execute well-defined, repetitive tasks. Think data extraction, form population, status checks, basic classification.
Autonomy level: Low. Clear rules, narrow scope, deterministic outcomes.
Governance needs: Standard software testing and validation. Version control. Performance monitoring.
Defense/GovCon examples:
- Automated invoice matching against delivery receipts
- Contract clause extraction for compliance review
- Daily ERP data quality checks
- Security log summarization for analyst review
Why they matter: Taskers deliver immediate ROI with minimal risk. They're the foundation layer. Get these right and you build organizational confidence for more complex deployments.
Automators: Workflow Execution Without Human Checkpoints
What they are: Multi-step process executors that can navigate decision trees, handle exceptions, and complete end-to-end workflows autonomously.
Autonomy level: Medium-high. Can make decisions within defined parameters. May escalate exceptions but completes standard paths independently.
Governance needs: Process mapping and validation. Exception handling protocols. Audit trails. Rollback mechanisms. Regular accuracy assessments.
Defense/GovCon examples:
- Purchase order processing from requisition through approval routing
- Compliance document assembly and submission
- Vendor onboarding workflow management
- Time and attendance reconciliation with payroll
Why they matter: Automators compress cycle time on workflows that traditionally required days of human handoffs. In government contracting where procurement cycles are measured in months, workflow compression is competitive advantage.
The risk: Automators fail silently if not properly monitored. You need observability infrastructure—logging every decision point, tracking every exception, maintaining audit trails that satisfy compliance requirements.
Collaborators: Human-in-the-Loop Amplification
What they are: AI systems that work alongside humans, providing recommendations, drafting outputs, or handling preparatory analysis while humans retain decision authority.
Autonomy level: Medium. The agent proposes; the human disposes.
Governance needs: Human oversight protocols. Decision authority matrices. Quality assurance processes. Feedback loops for continuous improvement.
Defense/GovCon examples:
- Proposal response drafting with human review and approval
- Financial variance analysis with analyst-validated insights
- Contract risk assessment supporting human negotiation
- Requirements decomposition for technical planning
Why they matter: Collaborators extend expert capacity without replacing expert judgment. In defense contexts where expertise is scarce and stakes are high, this is the sweet spot—augmenting human decision-making rather than replacing it.
The governance model: Clear lines of authority. The agent assists; it doesn't decide. This requires UI/UX design that makes the handoff explicit and trackable. "AI-suggested" versus "human-approved" must be auditable.
Orchestrators: Multi-Agent Systems Coordinating Complex Operations
What they are: Meta-agents that coordinate multiple specialized agents, managing dependencies, sequencing, resource allocation, and exception handling across complex multi-step processes.
Autonomy level: High. Makes strategic decisions about task delegation, priority, and resource utilization.
Governance needs: Enterprise architecture integration. Cross-functional oversight committees. Comprehensive testing including edge cases and failure modes. Incident response protocols. Regular governance reviews.
Defense/GovCon examples:
- Integrated logistics planning coordinating procurement, inventory, and transportation agents
- Program management systems orchestrating schedule, cost, and technical performance agents
- Supply chain resilience systems coordinating demand forecasting, supplier risk, and contingency planning agents
- Mission planning tools coordinating intelligence, operations, and logistics agents
Why they matter: Orchestrators tackle problems too complex for any single system—human or AI—to optimize. They're also the highest-risk category. When an Orchestrator fails, it can cascade across organizational systems.
The implementation reality: You don't start here. Orchestrators are what you build after Taskers, Automators, and Collaborators are battle-tested. They require organizational maturity in AI governance that most enterprises—and most defense contractors—don't yet have.
How to Apply TACO in Your Organization
Start With Classification
Before you deploy any agent, answer these questions:
- Task scope: Single task or multi-step workflow?
- Decision authority: Autonomous execution or human approval?
- Failure impact: What breaks if this agent gets it wrong?
- Integration complexity: Standalone or multi-system coordination?
Your answers map to TACO categories and determine your governance approach.
Match Governance to Category
Taskers: Treat like any automated script. Test thoroughly, monitor performance, version control. Approval can live at the team level.
Automators: Require process validation and audit trail infrastructure. Approval should involve process owners and compliance. Plan for rollback.
Collaborators: Define clear decision authority. Implement quality assurance sampling. Train users on appropriate reliance levels. Approval involves functional leadership and compliance.
Orchestrators: Demand enterprise architecture review, cross-functional governance, comprehensive testing, and executive sponsorship. Treat deployment like any mission-critical system integration.
Defense/GovCon-Specific Considerations
The TACO framework is vendor-neutral and industry-agnostic. Here's how it maps to our world:
Audit and compliance: Government contracts require auditability. Every agent category needs logging, but Automators and Orchestrators need comprehensive audit trails that satisfy DCAA or DoD IG review.
Security classification: Agents handling CUI or classified information require accreditation. The TACO category informs the scope of your security assessment—Taskers may fit under existing ATOs; Orchestrators need their own.
Procurement constraints: FAR and DFARS apply. Your agent isn't buying a commercial service—it's executing contract actions. Make sure your Automators and Orchestrators have appropriate procurement authority and oversight.
Reliability requirements: Mission-critical systems demand availability and redundancy. Classify your agents by mission impact, not just technical capability. An Orchestrator supporting mission planning has different SLAs than a Tasker summarizing status reports.
Implementation Roadmap
Based on KPMG's framework and my experience deploying agents in defense contexts, here's the practical path:
Phase 1: Tasker Deployment (Months 1-6)
Identify 10-15 high-volume, low-risk tasks. Deploy Taskers. Build organizational muscle in agent monitoring, performance measurement, and user acceptance.
Phase 2: Automator Pilots (Months 6-12)
Select 3-5 workflows with clear start/end points, measurable cycle time, and manageable exception rates. Deploy with comprehensive logging. Learn what breaks.
Phase 3: Collaborator Integration (Months 12-18)
Introduce agents into expert workflows. Focus on areas with capacity constraints or knowledge transfer needs. Measure quality impact, not just speed.
Phase 4: Orchestrator Strategy (Months 18-24)
Only after Taskers, Automators, and Collaborators are stable. Requires cross-functional sponsorship and enterprise architecture investment.
Don't skip phases. Each category builds organizational capability required for the next.
Risk Management by Category
KPMG's framework implies different risk profiles:
Taskers: Low operational risk, high volume risk. A bug in a Tasker hits thousands of transactions before you notice.
Automators: Medium operational risk, high compliance risk. Automated workflows that skip human checkpoints need audit trails and exception handling.
Collaborators: Low operational risk (human approval gates), medium reputational risk. Over-reliance on AI recommendations can erode expert judgment.
Orchestrators: High systemic risk. Failures cascade across interconnected processes. Require scenario planning and incident response protocols.
The Bottom Line
The TACO framework isn't revolutionary—it's categorical clarity. But in enterprise AI deployment, clarity is valuable. It provides:
- Common language for cross-functional teams discussing agent capabilities
- Governance mapping from technical capability to oversight requirements
- Risk calibration matched to autonomy levels
- Implementation sequencing from simple to complex
For those of us working in defense and government contracting, where compliance isn't optional and failure isn't theoretical, frameworks like TACO translate AI capability into deployable systems.
The 90% of organizations moving agents to production aren't deploying undifferentiated "AI." They're deploying Taskers, Automators, Collaborators, and Orchestrators—each with specific governance needs, risk profiles, and implementation requirements.
KPMG's contribution is naming the categories clearly enough that we can govern them appropriately. That's not flashy. But in regulated environments, appropriate governance is what separates production systems from pilot purgatory.
Know your agent category. Match your governance to it. Deploy accordingly.