There's a moment in every agentic AI demo where the room goes quiet. The AI doesn't just answer the question. It opens the ticket, updates the record, sends the email. Something that used to be somebody's Tuesday morning happens in eleven seconds.
Then someone from security asks the only question that matters: "Wait. What credentials is it using?"
That question is the whole subject.
Chatbots answer. Agents act.
The distinction sounds academic until you're on the wrong side of it. A chatbot that gives a wrong answer wastes a person's time. An agent that takes a wrong action closes the wrong ticket, refunds the wrong customer, or terminates the wrong instance. One is an inconvenience. The other is an incident.
Most of the agent pitches we see skip past this. The demos run in sandboxes where nothing is real and nothing has consequences. Production is where your data lives, your customers live, and your audit findings live.
Give it a badge, not your keys
The single most common mistake: running an agent under a human's credentials, or worse, under some ancient service account with permissions nobody has reviewed since 2021.
An agent needs its own identity. Its own narrow set of permissions, scoped to the specific job. Its own trail in the logs, so that six months from now you can tell what the agent did and what a person did. If your answer to "what can this agent access?" is "whatever the integration account can access," you're not running an AI program. You're running an experiment on your own company.
The four controls we won't deploy without
We've settled on a short list. Not because more controls are bad, but because these four catch most of what goes wrong.
- Scoped permissions. The agent can touch exactly the systems its job requires. Read-only wherever read-only will do.
- A spend ceiling. Agents consume paid API calls and compute, and a loop that would embarrass a junior developer can run ten thousand times before lunch. Hard cost limits, enforced outside the agent itself.
- Human gates on irreversible actions. Deleting, paying, sending, terminating: a person approves. The agent drafts, a human clicks. You can loosen this later. You can't retroactively tighten it after the incident.
- Logs you'd show an auditor. Every action, every input that triggered it. When something odd happens (and something odd will happen), you want a replay, not a mystery.
None of this is exotic. It's the same discipline you'd apply to a new contractor with system access. The difference is that the contractor gets tired and the agent doesn't.
Where agents actually earn their keep first
Not customer-facing. That instinct is almost always wrong, and it comes from wanting the impressive thing before the useful thing.
The early wins are boring, internal, and cheap to get wrong: triaging tickets into the right queues. Running the diagnostic runbook at 3 a.m. and paging a human only when the numbers are actually bad. Drafting the weekly report nobody enjoys writing. Flagging the unattached storage volumes and idle instances your cloud bill quietly carries. Work where a mistake costs minutes, not customers.
Get six months of that under your belt and the customer-facing conversation gets much shorter, because you'll have logs, incident history, and a governance story instead of a vendor's slide.
The failure modes worth planning for
A few we now check for by default: agents that get stuck in loops and burn budget doing nothing useful. Agents that follow instructions hidden inside the documents they read, which is a real attack, not a thought experiment. Agents given "temporary" broad access that becomes permanent because nobody owned removing it. And the organizational one: nobody can say who is accountable when the agent errs. If the answer isn't written down, the answer is you.
The honest take
Most organizations don't need an agent platform. They need two or three narrow agents doing unglamorous work with tight permissions, plus the paperwork that makes auditors relax. The companies getting value from agentic AI right now aren't the ones who moved fastest. They're the ones whose agents haven't caused an incident, because the boring controls were in place before the interesting work began.
Autonomy is a privilege your systems grant gradually. Treat it that way and agents become the most reliable hire you've made in years.