AI Agents: What a Business Leader Needs to Know
An agent is software allowed to decide its own next step. That single property is the whole opportunity and the entire risk.
Erin Moore
Fractional Chief AI Officer
An AI agent is a system that chooses its own sequence of actions to reach a goal, rather than following a path you defined in advance. Everything interesting about agents, and everything dangerous, follows from that one property.
Vendor claims in this category move faster than almost any other. Verify current capability against the vendor's own documentation at the time you evaluate, and treat capability assertions — including in this article — as perishable.
Agent versus automation
Traditional automation executes a path you specified: when this happens, do that, then that. You can read it, test it, and predict it. If it does something wrong, you can find the branch responsible.
An agent is given an objective and a set of tools, and works out the sequence itself. Faced with something you did not anticipate, automation stops and an agent improvises. That is genuinely valuable — most real processes have a long tail of exceptions that nobody wants to encode — and it is exactly why an agent can do something you never considered and would not have approved.
The governance question is therefore not "is it accurate" but "what is it allowed to touch". A wrong answer is a mistake. A wrong action is an incident.
The four questions before deployment
What can it actually do? Enumerate the tools, systems and permissions it holds. If the answer includes anything that sends external communications, moves money, or writes to a system of record, you are in a different risk category than a research assistant and should treat it that way.
What is the blast radius of a wrong action? Not the likely case — the worst one. Agents fail in bursts, because a bad early decision gets compounded by every subsequent step taken on top of it.
Where is the human checkpoint? Agents work best with a checkpoint before consequential, irreversible actions. Drafting the email autonomously and pausing for approval before sending captures most of the value and almost none of the risk.
What is the audit record? Every action, its inputs, and the reasoning offered — retained. When an agent does something unexpected you need to reconstruct the sequence, and that is impossible to retrofit afterwards. This is the same requirement the AI incident response plan depends on.
Where agents genuinely earn their keep today
Bounded, high-exception, low-irreversibility work. Triaging and enriching inbound requests. Multi-step research where the value is coverage rather than judgement. Reconciliation, where the agent finds discrepancies and a person adjudicates. Routine operational checks that would otherwise be a checklist nobody completes.
The pattern is consistent: the agent does the search, the sequencing and the tedium; a person makes the call that has consequences.
Where they do not
Anything irreversible without approval. Anything where being confidently wrong is expensive and hard to detect. And anything your team cannot describe as a process — an agent given a goal in a domain where nobody agrees what good looks like will produce plausible work that fails review, repeatedly.
If the underlying process is not understood, an agent will not clarify it. This is the same trap behind most stalled pilots.
How to start
Pick one bounded process. Give the agent read access widely and write access narrowly. Put a human checkpoint before every irreversible action, and remove checkpoints only where you have evidence from logs rather than a sense that it is probably fine. Log everything from day one.
Then measure the thing that matters, which is not accuracy — it is the rate at which a human reviewer changes the agent's proposed action. That number tells you whether to widen autonomy, and it is the only honest basis for doing so. NIST's AI Risk Management Framework treats exactly this as the measure function, and Stanford HAI's AI Index is the sober reference for what the category can actually do this year rather than what it is promised to do next.
Frequently asked questions
What is an AI agent? Software given a goal and a set of tools that decides its own sequence of actions, rather than following a predefined path. That autonomy is both the value and the risk.
How is an agent different from automation? Automation follows a path you specified and stops when something unexpected happens. An agent improvises. That handles the long tail of exceptions, and it also means it can take actions you never considered.
What should we control first? Permissions, not accuracy. Enumerate exactly what systems the agent can write to, and put a human checkpoint before any irreversible action such as sending external messages or moving money.
Where do agents work best today? Bounded, high-exception, low-irreversibility work — triage, enrichment, multi-step research, reconciliation where a person adjudicates. The agent does the sequencing; a person makes the consequential call.
Further reading
Tagged with:
Ready to Automate Your Business?
Let's discuss how AI automation can deliver measurable ROI for your organization in 90 days or sooner.