By Laas NuryEvery software vendor now sells "AI agents". Most of it is not. In June 2025 Gartner estimated that of the thousands of vendors claiming agentic products, only around 130 offer real agent capabilities; the rest is existing automation with a new label. In the same analysis it predicted that more than 40% of agentic AI projects will be cancelled by the end of 2027, because of rising costs, unclear business value or weak risk controls.
That is not a reason to wait. It is a reason to be precise. This article explains in plain terms what an agent is, which work it can safely take over in a company today, and which guardrails decide whether it ever makes it out of the pilot.
What an AI agent actually is
An AI agent is a system that is given a goal, a set of tools and a set of limits, and then works out the steps itself. It reads the situation, decides what to do next, does it (in your mailbox, your ERP, your CRM), checks the result and continues until the job is done or it hits something it is not allowed to decide.
The difference with what you already know:
| What it does | Who decides the next step | Example | |
|---|---|---|---|
| Chatbot or assistant | Answers a question | You | "Summarise this supplier's e-mail" |
| Workflow automation or RPA | Runs fixed steps in a fixed order | The designer, in advance | "When an invoice arrives, copy field A to field B" |
| AI agent | Works towards a goal within limits | The agent, within its limits | "Make sure every open purchase order has a confirmed delivery date" |
The last column is the point. An agent handles the variation that breaks fixed automation: the supplier who replies in the body of the e-mail instead of the attachment, the date written as "end of next week", the confirmation that covers two orders at once.
What agents can safely do today
The work that suits agents best has three things in common: it repeats, it follows rules with exceptions, and you can check whether it was done right. In a typical company that includes:
- Sorting and routing incoming work. Reading the shared inbox, recognising orders, complaints, invoices and delivery questions, and putting each one in the right queue with the right data attached.
- Preparing, not committing. Drafting the order, the booking or the reply in your system, ready for a person to approve with one click.
- Matching and reconciling. Invoices against purchase orders and receipts, bank lines against open items, delivery notes against orders, with the mismatches set aside.
- Chasing. Asking suppliers for missing confirmations, customers for missing details, colleagues for missing approvals, and following up when nobody answers.
- Watching for exceptions. Delivery dates that slip, stock that will run out before the next delivery, prices that differ from the contract, and flagging them before they become a problem.
- Answering internal questions with sources. "What did we agree with this customer about returns?" answered from the contract, with the clause attached.
None of this is spectacular. That is why it works: the value is in the volume, and the risk of one mistake is small and visible.
What agents should not do on their own (yet)
- Anything that cannot be undone. Payments, deletions, cancellations, commitments to customers. The agent can prepare them; a person approves.
- Decisions about people. Ranking job applicants, assessing staff, deciding on credit. Apart from the ethics, these are high-risk uses under the EU AI Act, with obligations of their own.
- Open-ended goals. "Improve our margins" is not a task for an agent. "Flag every order line sold below the agreed floor price" is.
- Work nobody can check. If you cannot tell whether the agent did it right, you cannot test it, and you should not trust it.
The autonomy ladder
Agents do not have to go from zero to autonomous. Most successful ones climb four steps, and many stay on step two or three permanently, which is fine.
| Step | What the agent does | What the person does | Suits |
|---|---|---|---|
| 1. Suggest | Reads and proposes | Decides and does the work | The first weeks of any new agent |
| 2. Prepare | Prepares the action in the system | Approves or corrects with one click | Orders, bookings, replies to customers |
| 3. Act within limits | Acts on its own below set limits, escalates above them | Reviews samples and the exceptions | Delivery-date updates, reconciliations, routing |
| 4. Act and report | Acts on its own, reports what it did | Monitors the figures | Low-risk, high-volume, fully reversible work |
Moving up a step is a decision you take on evidence: how often was the agent right on the previous step, and what did its mistakes cost?
The guardrails that decide whether it reaches production
The model is rarely what stops an agent. The missing guardrails are. Before an agent acts in your systems, these should be in place:
- Its own account, with only the rights it needs. Not a colleague's login, not an admin account.
- Hard limits. Maximum amounts, maximum quantities, which customers or suppliers it may touch.
- Approval points for everything above the limits and everything that cannot be undone.
- A complete log. What it read, what it decided, what it changed, and who approved it. You will need this the first time someone asks "why did this happen?".
- A test set before go-live. A few hundred real past cases where you know the right answer, so you can measure the agent before it touches live work.
- A way to stop it and roll back. One switch, and the ability to undo what it did.
- Ongoing measurement. Accuracy per week, exceptions per week, time saved. If the numbers drift, you see it.
- A cost ceiling. Agents call models repeatedly. Set a budget per day so a loop cannot run up a bill.
Weak risk controls is one of the three reasons Gartner gives for the cancellations it expects. In practice, agents rarely fail because they cannot do the work; they fail because nobody can trust them with it.
An example: delivery dates that keep themselves up to date
Take an illustrative case: a distributor with a few thousand open purchase-order lines. Suppliers confirm delivery dates by e-mail, in attachments, in portals and sometimes not at all. A buyer spends a large part of the week keeping the dates in the ERP correct, because sales and planning depend on them.
An agent on step 3 of the ladder:
- reads every supplier confirmation as it arrives and matches it to the order lines;
- updates the expected date in the ERP when the change is within an agreed tolerance, and logs it;
- sends anything outside the tolerance, and every confirmation it cannot match, to the buyer;
- e-mails suppliers who have not confirmed within the agreed time, and follows up once;
- reports every Monday which lines are still unconfirmed and which dates moved.
The buyer still owns the suppliers and the exceptions. What disappears is the copying and the chasing.
How to start
- Pick one process that is frequent, mostly rule-based, measurable and reversible.
- Write down the rules and the exceptions. If your team cannot explain them, an agent cannot follow them. This step alone often improves the process.
- Define what "right" means, and collect a few hundred past cases to test against.
- Run the agent in the background first (step 1 of the ladder) for two to four weeks, next to your team, and compare.
- Move up the ladder only when the numbers justify it.
Our own agent platform, Whitestorm, is built around exactly these guardrails: limits, approvals, a full log and a way back. But the approach above holds whichever technology you use. And if you are still deciding whether an off-the-shelf assistant is enough, read Copilot, ChatGPT or a custom AI build first.
