AI agents that do real work, inside limits you set.
An AI agent does more than answer. It reads a situation, plans steps and uses your systems to carry them out. We build agents for operations, finance and service teams with narrow permissions, human approval where it counts and a record of every action. Our own engineers run coding agents all day, so we know where agents slip.
Many projects sold as AI agents should be workflows with one AI step.
If the steps are known in advance, such as receive a request, check a record, update two systems and notify someone, a conventional workflow with an LLM handling the one fuzzy decision is cheaper, faster and far easier to test. It also fails in predictable ways.
Agents earn their place when the path genuinely varies: investigating why a shipment is late across several systems, reconciling records that disagree, or triaging requests that need different tools each time. There, letting a model choose the next step saves real effort.
We hold this view because we live with agents. FusionOne engineers run multiple AI coding agents in parallel every day, and we open-sourced perchd to manage exactly that. We have watched agents loop, misread instructions and confidently do the wrong thing, and we design business agents with those habits in mind.
How much should your AI agent be allowed to do?
Autonomy is a dial, not a switch. We set it per action rather than per agent, and turn it up only when evidence supports it.
| Investigate and suggest | Act with approval | Act and report | |
|---|---|---|---|
| What the agent does | Gathers facts, proposes a plan | Prepares changes a person confirms | Executes and logs, reviewed later |
| Suitable actions | Anything, including sensitive areas | Payments, customer messages, record edits | Reversible, low-value, high-volume tasks |
| System access | Read-only | Read plus staged writes | Scoped writes with hard limits |
| Main control | Visible reasoning and evidence | Clear approval screens | Limits, monitoring and rollback |
| When to use it | Every new agent starts here | After consistently good suggestions | Only for proven, narrow actions |
What every production AI agent needs
Instructions in a prompt are not guardrails on their own. These controls live in code and infrastructure, where a model cannot talk its way past them.
Narrow, purpose-built tools
Give the agent "create a draft credit note up to a set amount", not full API access. Most real safety comes from tool design.
Least-privilege credentials
Each agent has its own service account with only the permissions its tools need, never a shared admin key.
Defences against injected instructions
Emails, documents and web pages an agent reads may contain text written to manipulate it. Content is treated as data, and sensitive actions depend on checks that content cannot influence.
Step and spend budgets
Caps on tool calls, tokens and run time stop a confused agent looping for hours and running up a bill.
Idempotent actions and dry runs
Retrying a step must never pay an invoice twice. New agents run in dry-run mode first, recording what they would have done.
A complete audit trail
Inputs, tool calls, results and a summary of the reasoning are traced, so any action can be explained to a manager, customer or auditor.
AI agent use cases worth exploring
These patterns suit agents because the route to the answer changes from one case to the next.
Exception investigation
Late orders, failed payments or stock mismatches: the agent checks each system, assembles the evidence and proposes a fix.
Finance reconciliation
Matching bank lines, invoices and purchase orders that do not line up neatly, with a person approving every adjustment.
Service case handling
Reading a request, gathering account context, drafting a resolution and staging any refund or change for approval.
Back-office onboarding
Setting up customers or suppliers across several tools, chasing missing information and updating records as it arrives.
Building an AI agent in stages
Map the task and its risks
Week 1We sit with the team who handles these cases today, list every action involved and rate each one for reversibility and cost of error.
Build tools and a sandbox
Weeks 2 to 4Purpose-built tools, a safe copy of the relevant systems and a library of realistic scenarios, including awkward and adversarial ones.
Run in shadow mode
Weeks 4 to 6The agent works on live cases without acting, and we compare its proposed actions with what your team actually did.
Grant autonomy gradually
OngoingActions move from suggestion to approval to automatic only when scenario tests and shadow results justify it.
Questions we often hear
What is the difference between an AI agent and a chatbot?
A chatbot converses and answers questions. An AI agent pursues a goal by choosing and using tools, such as querying a database, updating a CRM or sending an email, often over several steps. Many products blend the two, but agents need much stronger controls because they change things.
Are AI agents safe to connect to business systems?
They can be, when safety is enforced outside the model: scoped tools, least-privilege accounts, approval gates, spending limits and audit logs. The unsafe version is an agent with broad API keys and a prompt telling it to be careful. We would not build that, and we suggest you do not buy it.
What happens when an AI agent makes a mistake?
Mistakes are expected, so the design has to contain them. Irreversible actions need approval, reversible ones can be rolled back, and every step is traced so the cause is clear. Each incident becomes a new test scenario before the agent is trusted with that action again.
How much does it cost to run an AI agent?
Agents typically use more tokens than a single model call because they reason over several steps and re-read context. Costs depend on task complexity, model choice and volume, and per-run budgets cap them. We estimate running costs during scoping and compare them with the time the work takes today.
Can AI agents work with our existing software?
Usually, if the software has an API. Standards such as the Model Context Protocol make it easier to expose tools to agents, but we still wrap each capability in a narrow, validated tool rather than exposing everything a system can do.
Related reading and tools
Tell us about the work you want an agent to take on.
Describe the task, the systems it touches and what goes wrong when people do it today. Within 24 hours we will tell you honestly whether it needs an agent, a simpler workflow or neither.
Working with companies globally · Response within 24 hours