Most companies asking "should we deploy an AI agent?" are asking the wrong question. The interesting question is narrower and much harder: what work are you willing to let software do without a person checking it first?
That is a business decision, not a technical one. And it is the decision that separates AI projects that quietly compound value from the ones that get switched off after an embarrassing week.
Chatbots answer. Agents act.
A chatbot produces text. If it is wrong, someone reads something wrong. Annoying, rarely expensive.
An agent takes actions in systems that hold your money and your customer relationships. It creates the purchase order. It updates the opportunity stage. It emails the client. It adjusts inventory. If it is wrong, you now have a wrong record propagating through every downstream report and integration you own.
That difference is why "we're piloting AI" and "we've given AI write access to our ERP" are not the same sentence, even when the underlying model is identical. The risk lives in the permissions, not the intelligence.
Three tests before an agent touches a system
Before handing any task to an agent, run it through three filters. If a task fails one, it is not ready for autonomy — it might still be ready for assistance.
- Verifiable. Can you tell whether the output was right, cheaply and quickly? Matching an invoice to a purchase order has a checkable answer. "Write a strategy for entering a new market" does not.
- Reversible. If the agent gets it wrong, what does the undo cost? Drafting a reply is reversible. Sending a payment, issuing a credit, or emailing three hundred customers is not.
- Bounded. Does the task have a clear beginning, end, and set of systems it touches? Open-ended work with unclear edges is where agents wander, and where they burn tokens doing it.
The tasks that pass all three tend to look unglamorous: reconciling records between two systems, extracting structured data from documents, classifying and routing inbound requests, flagging exceptions in a data set humans skim by eye. Unglamorous is the point. Those are the tasks your team already does inconsistently because they are tedious.
Earn write access on a ladder
We treat agent permissions the way a good operator treats a new hire's authority — as something granted in stages.
Rung one: read and report. The agent looks at data and tells a human what it found. No changes. You learn how often it is right before it can be wrong at scale.
Rung two: draft and queue. The agent prepares the action — the order, the email, the journal entry — and a person approves it. You get most of the time savings with a human circuit breaker in place.
Rung three: act within limits. The agent executes on its own, but inside hard boundaries: below a dollar threshold, only for a specific record type, only during business hours, only when confidence is high. Everything else escalates.
Rung four: act and be audited. Full autonomy on a defined task, with logging that lets you reconstruct every decision after the fact.
Most work should stay on rung two or three permanently. That is not a failure to reach full automation. A queue a human clears in ten minutes instead of two hours is an excellent outcome.
Design the escalation path before the happy path
The agent will hit situations nobody scoped: a vendor name that matches three records, a currency it has not seen, a field that is suddenly blank. What it does next determines whether you have a tool or a liability.
Decide in advance where the uncertain cases go, who owns that queue, and how quickly they get cleared. An agent that stops and asks is safe. An agent that guesses confidently and moves on is the one that generates a month of cleanup. This is the same discipline good integration work demands — silent failures are worse than loud ones.
Your data foundation sets the ceiling
An agent inherits your data quality. If your customer records live in three systems with three different naming conventions, no model will reason its way out of that. This is why AI work and systems work are the same project: the companies getting real value from agents usually cleaned up their master data and integrations first, often as part of an ERP rollout or a move to a unified platform.
If you cannot answer "where does the authoritative version of this record live?", start there. It is cheaper than debugging an agent that was confidently working from the wrong copy.
Measure it like a hire, not a feature
Give every agent a job description and a scorecard: the task, the volume it handles, the exception rate, the time it returns to the team, and what it costs to run. Review it monthly. Promote it up the permission ladder when the numbers earn it. Retire it when they do not.
That is the whole discipline. Humans that use AI win — but they win by scoping the work carefully, not by handing over the keys.
If you are trying to figure out which tasks in your operation are genuinely ready for an agent, and which need cleaner systems first, that is a conversation worth having. Reach out to Infraxio and we will walk your workflows with you.