Start with the workflow, not the model
An AI agent is useful when a task needs interpretation as well as a controlled sequence of actions. Start with a repeatable business process such as classifying an incoming request and drafting a response. Record the current inputs, decision owner, exception paths and cost of an incorrect action. If ordinary rules already describe the process clearly, a deterministic workflow may be simpler and easier to audit.
Define a small permission boundary
Write down exactly what the system may read, suggest and change. A support triage pilot might read approved help articles and propose a category, but not issue refunds or change account permissions. Keep credentials on the server, separate tools by role and require explicit approval before a consequential external action. Retrieved documents and user messages are untrusted inputs, not instructions that can grant authority.
Build an evaluation set before launch
Create representative examples from consented, appropriately redacted material. Include ambiguous requests, missing data, conflicting sources, malicious instructions and unavailable tools. Score task correctness separately from tone and speed. Record why a case failed, then rerun the same cases after changing prompts, retrieval or model configuration. A compelling demonstration is not evidence of safe unattended operation.
Make recovery part of the design
Store a durable action reference before performing an external side effect. Use idempotency, bounded retries and a visible exception queue so a timeout cannot quietly duplicate a booking or email. Give an accountable person the information needed to take over. Monitor unresolved cases and operating costs without retaining unnecessary personal data in traces.
A practical pilot decision
Define a limited audience, permitted data and a rollback switch. Agree how much review is required and which failure types stop the pilot. Compare observed results with the existing process rather than a vendor promise. Expand only when owners can explain the remaining risks, support the workflow and approve the next permission boundary.
A practical planning checklist
Before commissioning an agent pilot, ask the process owner to supply three normal requests and three situations that must stop automation. Identify the exact tool permissions needed for each case. Decide who can approve a proposed action, who receives an exception and how the pilot is disabled. Put those decisions in the scope alongside an evaluation plan, rather than leaving them as informal assumptions for the implementation team.
