An agent, stripped of marketing, is a model given tools and a goal, allowed to decide which tools to call. That is a meaningful step beyond answering questions, and it changes the risk profile completely: a wrong answer is embarrassing, a wrong action is a refund, a deleted record or an email to a customer.
Where it works today
- Bounded, reversible tasks. Drafting a reply, tagging a ticket, preparing a report, proposing a change for approval.
- Read-heavy work. Gathering information across systems that do not talk to each other is genuinely useful and low risk.
- Internal tools with a human approving the final step. Most of the value, almost none of the exposure.
Where it does not, yet
Anything irreversible without review. Issuing refunds, changing prices, sending customer email, modifying inventory. Not because it always gets these wrong, but because the failure rate is not zero and the cost per failure is high.
The subtler problem is compounding. A long chain of steps, each 95% reliable, is not 95% reliable. Ten steps is closer to 60%, and the failure arrives at step seven with a plausible-looking result.
What to insist on
- 01A permission boundary in code, not in the prompt. "Do not delete anything" is a request. A tool that has no delete capability is a guarantee.
- 02Full audit logging: what was decided, on what basis, which tools were called, what changed.
- 03A hard stop on anything irreversible or above a value threshold. Humans approve those.
- 04Rate limits. An agent in a loop is a very fast way to generate a large bill.
- 05A rollback plan that has been tested rather than described.
A realistic first project
Pick one repetitive task, currently done by a person, that is read-heavy and produces a draft rather than a final action. Measure how often the draft is accepted unchanged.
That number is your reliability figure, on your data, and it is worth more than any benchmark. If it is high after a month, widen the scope. If it is not, you have learned that cheaply and without an incident.
The honest position
Agents are real and improving quickly, and the demos are ahead of what should be trusted in production. The gap is closing, and until it does the sensible boundary is: let them prepare work, let people commit it.
Working on something like this?
We build websites, stores and custom applications, and we will tell you honestly if the thing you are describing does not need one.