Agents are the most over-promised category in AI right now, which is unfortunate, because in a specific set of situations they work extremely well. The trick is recognising which situations those are before you build.
Agent, not chatbot
A chatbot answers questions. An agent reads a request, decides what needs doing, calls the systems required to do it, checks the result, and reports back. That difference is where the operational value sits — and where the risk does.
The three conditions
Agents are worth building when all three of these hold. Miss one and the economics usually stop working.
- 1High volume. The work happens often enough that automating it recovers meaningful time.
- 2Cross-system. It involves moving between several tools, which is exactly what a fixed integration struggles with and a person finds tedious.
- 3Recoverable if wrong. A mistake costs time to correct, not money or a customer relationship.
Where this holds in practice
- Request triage — classifying and routing incoming work so the queue arrives pre-sorted, with unclear cases escalated rather than forced into a category.
- Data reconciliation — cross-checking records between systems that were never designed to agree, and flagging real mismatches.
- Context assembly — gathering everything relevant to a case before a human opens it, so the person starts from an answer rather than a search.
- Document-driven data entry — reading incoming documents and populating the system of record, with a confidence threshold below which a person checks.
Where it does not
Anything irreversible without approval. Payments, deletions, contractual commitments, and external communication should sit behind a human gate — not because the agent will necessarily get them wrong, but because the cost of the exception is asymmetric.
Also: anything low-volume. If a task happens twice a week, the engineering, guardrails, monitoring, and evaluation will cost more than the time saved. That is not a failure of the technology, it is arithmetic.
The guardrails that are not optional
- Scoped credentials — the agent gets exactly the access the task requires and nothing adjacent.
- An explicit allowed-action list, rather than open-ended capability.
- Human approval on anything irreversible.
- Complete logging of every decision and tool call, so any run can be reconstructed.
- An evaluation suite, so a prompt or model change does not silently degrade behaviour.
Start narrower than feels worthwhile
The most common mistake is scoping the first agent too broadly. Pick one workflow, automate it properly including the escalation path, measure it honestly, and expand from there. An agent that reliably handles seventy percent of one task is worth considerably more than one that unreliably attempts five.