AI agents for business: what should you automate—and what should you never delegate?

AI agents have moved quickly from demonstrations into business software. Products now promise to qualify leads, resolve service requests, update records, prepare reports, chase invoices and coordinate multi-step work with limited supervision.

Adoption is not the same as operational value. An impressive agent can still create more checking, unclear ownership and new security exposure. A useful agent has a defined job, authoritative information, constrained access and an accountable route when confidence runs out.

The adoption gap is now the important AI story

McKinsey’s 2025 global survey of 1,993 participants across 105 countries found that AI use had become mainstream, while scaled value remained much less common.

No individual business function had more than 10% of respondents reporting scaled agent use. McKinsey also identified workflow redesign as a distinguishing behaviour among high-performing AI adopters. The implication is important: adding an agent to a poor process rarely creates a good one. See The state of AI in 2025.

That gap between experimentation and useful scale should shape the buying decision. The first objective is not “deploy an agent”. It is to improve a workflow with an appropriate level of machine judgement and action.

Automation, AI assistance and AI agency are different

The terms are often blurred, but they create materially different operating risks.

Conventional automation follows defined rules

A status changes, a record meets a condition or a scheduled time arrives. The workflow performs a known action: create a task, move data, send a standard message or update another system. The same input should produce the same result.

AI assistance interprets information

A model classifies an email, extracts information from a document, retrieves relevant knowledge or drafts a response. A person or deterministic rule still decides what becomes operationally binding.

An AI agent chooses and performs actions

An agent receives an objective, plans steps, selects tools and acts across one or more systems. It may search records, call APIs, update a CRM, send communication and respond to the result of its earlier action.

Agency is a spectrum, not a switch. The correct design may allow a model to decide which queue receives an enquiry while preventing it from changing a price, approving a refund or granting access.

Five jobs AI agents can handle well

The strongest early opportunities combine frequent information work, accessible data, a clear objective and recoverable mistakes.

1. Triage and routing

An agent can interpret incoming enquiries, service requests or documents, identify the likely subject and urgency, collect missing details and route the case to the correct workflow. The valuable result is faster ownership—not an artificial conversation for its own sake.

2. Research and preparation

An agent can gather account history, retrieve approved knowledge, compare relevant records and prepare a concise brief before a person acts. This reduces searching while keeping the decision with the accountable role.

3. Drafting within approved context

Customer responses, internal summaries and follow-up messages can be prepared from known facts and controlled templates. Sensitive or unusual messages can remain subject to review.

4. Monitoring and exception detection

An agent can examine queues, changes and incomplete records, then surface what deserves attention. This is particularly useful where people currently scan reports or inboxes to find a small number of important exceptions.

5. Controlled multi-system actions

With narrow permissions, an agent can update a status, create a task, request information or trigger an established automation. Each action should be logged, validated and limited to the smallest necessary scope.

Five decisions not to delegate freely

Autonomy should reduce as consequence, ambiguity and irreversibility increase. Keep meaningful human authority around:

• Payments, refunds and commercial commitments that materially affect a customer or the business.
• Identity, permissions and physical access where an incorrect action creates a security exposure.
• Employment, credit or eligibility decisions that affect rights, opportunities or legal obligations.
• Safety, medical, engineering or regulatory advice where an invented or incomplete answer could cause harm.
• Destructive or irreversible system changes including deletion, mass updates and unrestricted configuration.

OWASP describes “excessive agency” as the risk created by excessive functionality, permissions or autonomy in an LLM-based application. Unexpected, ambiguous or manipulated outputs can then cause real actions in connected systems. Its guidance is a useful reminder that the agent’s tool access—not only the quality of its prose—defines the practical risk. See OWASP LLM06: Excessive Agency.

Use an autonomy ladder instead of jumping to “fully autonomous”

A business can increase autonomy only where evidence supports it. The same workflow may use different levels for different actions.

1. 01
   Suggest

   The agent identifies a likely answer, category or next action. A person decides what happens.

2. 02
   Prepare

   The agent gathers evidence, completes fields or drafts the action for review.

3. 03
   Approve

   The system validates defined conditions; a person approves higher-consequence cases.

4. 04
   Act

   The agent performs a narrow, reversible action using restricted tools and permissions.

5. 05
   Monitor

   Outcomes, exceptions, cost and error signals remain visible after the action completes.

Moving from Suggest to Act should require measured reliability, not confidence in a demonstration. If a decision cannot be explained, reviewed or reversed, the action belongs lower on the ladder.

Production agents need operational controls—not just better prompts

Prompt design matters, but it does not provide identity management, permissions, monitoring or rollback. NIST’s May 2026 analysis of public responses on AI-agent security found broad agreement that agents introduce novel threats and that established cybersecurity practices need adaptation. See NIST AI 800-5.

The identity issue is already visible in enterprise deployments. A 2026 Cloud Security Alliance survey, commissioned by Aembit, found that 68% of respondents could not clearly distinguish human activity from AI-agent activity; 74% said agents often received more access than necessary. These findings should be treated as survey evidence rather than universal rates, but they reinforce the need for distinct identities and attributable logs. See the Cloud Security Alliance report.

The EU rules now matter operationally

The EU AI Act became broadly applicable on 2 August 2026, with phased exceptions. AI literacy obligations have applied since February 2025, and transparency rules can require people to be informed when they are interacting directly with AI. High-risk categories—including certain employment, education, credit and critical-infrastructure uses—carry stricter requirements on later timelines.

Most ordinary business AI remains minimal or limited risk, but every deployment still sits alongside privacy, security, consumer, employment and sector-specific obligations. The European Commission’s AI Act overview provides the current implementation timeline.

A practical 90-day agent pilot

Days 1–15: choose one bounded workflow

Select a frequent task with accessible information, a measurable delay and manageable consequences. Document the trigger, current handling, owner, systems, normal cases and exceptions. Establish a baseline for time, volume, wait and error.

Days 16–30: define authority before building

List what the agent may read, propose and change. Define approval thresholds, prohibited actions, identity, data retention and the route for uncertainty. Confirm API access and supplier constraints.

Days 31–55: build at Suggest or Prepare

Begin with recommendations, structured preparation or drafts. Compare outputs with real decisions. Record false positives, missed cases, unsupported claims and the work required from reviewers.

Days 56–75: add narrow actions

Allow only the reliable, reversible actions that have earned automation. Keep high-consequence or unusual cases behind approval. Add rate limits, logs, alerts and failure recovery.

Days 76–90: measure the operation

Assess the result: handling time, response time, exception rate, reviewer effort, customer impact and cost per completed workflow. Stop, revise or expand based on operational evidence.

A successful pilot does not prove that every related decision should become autonomous. It proves that one defined workflow now produces a better result with acceptable control.

Choose the mechanism that solves the workflow

Agents are one part of the operational technology toolkit. Use conventional automation when the rules and inputs are exact. Use AI assistance when interpretation or drafting creates value. Use an agent when multi-step judgement and tool use are necessary—and when the business can support the additional controls.

Integration readiness is often the hidden constraint. Postman’s 2025 survey of more than 5,700 developers, architects and executives found that 89% of developers used AI while only 24% designed APIs for agent consumption; 51% cited unauthorised agent access as a leading concern. An agent cannot safely improve a workflow if the underlying systems lack dependable interfaces, documentation and access boundaries. See Postman’s 2025 State of the API report.

The correct first answer may therefore be to improve the process, connect two systems or build a controlled operational layer before introducing agency.

Explore AI business automation, workflow automation and systems integration.