The difference from everything else

Most AI in a business system does one thing when asked.

Read this document. Draft this email. Classify this ticket. One input, one output, done.

An agent is given a goal and works out the steps itself.

“Chase the overdue invoices” rather than “send this reminder to this customer”.

To do that it has to: decide what to look at, decide what to do, do it, see what happened, and decide what next.

Multiple steps, with judgement between them. That is the whole distinction.

What makes it possible

Three things, and understanding them explains both the capability and the limits.

Tools. The agent can call things — search a database, read a record, send a message, create an entry. Without tools it can only produce text.

A loop. It acts, observes the result, and decides again. That loop is what lets it recover from a step that did not work.

A stopping condition. It has to know when the goal is met, or when to give up. Getting this wrong produces an agent that loops indefinitely, which is a real failure mode rather than a theoretical one.

What it might do in a business

Four concrete examples.

Collections. Review overdue invoices, check each customer’s history and open disputes, draft appropriately different messages, and escalate the ones needing a person.

Purchasing. Notice low stock, check lead times and supplier reliability, prepare purchase orders, and flag those needing approval.

Support triage. Read incoming tickets, gather relevant context, resolve the routine ones, and route the rest with a summary.

Month-end preparation. Run the standard checks, chase missing documents, assemble the exceptions, and present a list.

Each of these is several steps a person currently does in sequence — and the gathering is usually most of the time.

The honest state of it

Some of this works now. Much of it works in demonstrations and needs supervision in production.

Working reasonably today: multi-step tasks within a narrow, well-defined boundary, with review before anything commits.

Emerging: longer chains where the agent chooses between genuinely different courses of action.

Not there: anything you would leave unsupervised where being wrong is expensive.

The gap is not intelligence. It is reliability on exceptions.

An agent that handles ninety-five percent of cases well and does something odd on the rest is a problem in a system that touches money — because the five percent is where the money usually is.

Why business systems are harder

Four reasons an agent in an ERP differs from one doing research.

Actions are hard to reverse. A posted journal entry needs a reversal. A sent message cannot be recalled. A confirmed order has reached a supplier.

Errors compound quietly. A wrong step produces a wrong record, which the next step treats as fact. By the time anyone notices, several things are wrong.

Explanation is genuinely difficult. When an agent takes fifteen steps and the outcome is wrong, tracing why is hard. In a system an auditor may examine, that matters.

Permissions are inherited wholesale. An agent with the ability to post entries can post wrong ones. There is no partial capability.

The boundary that makes them usable

Let the agent prepare. Stop before anything irreversible.

Draft the emails and present them. Prepare the purchase orders as drafts. Assemble the exception list.

A person confirms.

This captures most of the value. The steps that take the effort are the gathering, checking and preparing — not the final click.

And it removes most of the risk, because nothing external happens without review.

What to ask a vendor

Six questions. Vague answers tell you something.

• What exactly can it do, and what can it not?
• What can it do without a person confirming?
• What permissions does it run with?
• How do we see what it did, and why?
• What happens when it meets something unexpected?
• How do we stop it mid-task?

That last one matters more than it sounds. An agent working through two hundred records needs a stop that works immediately.

What to be sceptical about

“Autonomous” as a selling point. In a business system, autonomy is a risk to manage, not a feature to maximise.

Demonstrations on clean data. Everything works on clean data. Ask what happens with a duplicate customer, a missing cost, a half-completed record.

Claims without a stop mechanism.

Anything posting to your ledger unsupervised, whatever the accuracy figures.

A realistic position

Watch it properly. It is progressing quickly and the direction is real.

Use narrow, supervised versions now. Preparation and gathering, not commitment.

Do not restructure your processes around it yet. Build on what works today.

Keep your data clean. Everything that comes will work better on clean data and worse on bad data — and that work is worth doing regardless.

The short version

An agent is given a goal rather than a task, and works out its own steps.

That is a genuine advance, and in a business system the difficulty is not capability — it is reliability on the exceptions, and the fact that actions cost money and are hard to reverse.

Narrow the scope. Stop before the commit. Limit the permissions. Log everything.

Used that way, agents are useful now. Used as the marketing describes them, they are a risk you will not notice until the exception arrives.