AI agents in business: where they help and how to keep them under control

In 2026 almost every software vendor sells AI agents. Yet the word covers very different things. An assistant answers a question. An agent, instead, gets a goal, picks its tools and takes action. It reads a mailbox, queries a business system, drafts a reply, opens a ticket. That is why AI agents can save real time. And for the same reason they can do real damage.

Here I explain how I use agents in my data work, and how to reason about introducing one in a company. I will not talk about brands or models. I will talk about boundaries, permissions and checks. Those decide whether a project survives after the demo.

What makes AI agents different from a chatbot

A chatbot produces text. An agent produces effects. The difference lies in the tools you connect to it: APIs, databases, files, email, a browser. As a result, every tool you give to AI agents is a door into a company system.

So the right question is not how clever the model is. The right question is what it can touch, and who notices when it gets something wrong. A better model makes fewer mistakes. However, it never makes none.

Also, an agent reads data it did not write. An email or a document can hide instructions placed there on purpose. This is called prompt injection. OWASP ranks it first in its 2025 list of risks for applications built on language models.

Where AI agents really help

In particular, AI agents pay off when the work has three traits:

• it happens often and follows mostly known rules;
• the input is text or documents that a person reads by hand today;
• a mistake shows up quickly and can be fixed without serious harm.

Here is a hypothetical example. A distributor gets quote requests by email every day, often with attachments. Today a clerk reads them, looks up product codes and checks stock. Finally, the clerk drafts an offer.

An agent can take the first steps. It reads the request, pulls out items and quantities, queries the stock system and proposes a draft. The clerk checks it and sends it. In other words, time moves from searching to reviewing.

On the other hand, I advise against starting with actions that are hard to undo. Think of payments, purchase orders or messages to customers with no review. Here an agent can prepare the work. But it should not decide.

Three limits to set before writing code

OWASP describes a risk typical of agents: excessive agency. It names three causes: too many functions, too many permissions, too much autonomy. In fact I use them as a checklist for all the AI agents I use.

Functions: only the ones it needs

If the agent must read orders, I give it a tool that reads orders. I do not give it general access to the database. After all, every extra function is one more way to fail.

Permissions: minimal, with an account of its own

The agent works with its own account, never with an admin one. As a result, the logs show who did what. Also, you can revoke the agent's access without locking out people.

Autonomy: a person approves the actions that matter

High-impact actions go through a person. OWASP says so explicitly. Still, the check belongs in the system that runs the action, not only in the model's instructions. An instruction can be bypassed. A denied permission cannot.

How I measure whether AI agents work

Before entrusting data to an AI agent, I agree on the test criteria with the company. They are usually few and concrete:

1. a set of real cases, anonymised, with the expected result;
2. the share of cases the agent solves with no corrections;
3. the kind of errors, because a visible error differs from a silent one;
4. how long the person needs to check each result;
5. the cost per case, across model calls and upkeep.

Then I run the same set of cases after every change. New model, new instructions, new tools: the test runs again. Indeed it is the only way to know whether a change makes things better. Impressions, by contrast, follow the last example you saw.

A log entry for every action

An agent that fails without a trace is the worst case. So every step gets logged: what it read, which tool it called, with which inputs, and what the system answered. The model version and the prompt version go in the log too.

Then, when a result looks wrong, you can rebuild the path in minutes. Moreover, the log helps the reviewer, who sees which data the proposal was based on. Finally, it shows the real cost of each case instead of an average.

Mind personal data, though. A full log can hold names, addresses and email content. Therefore it needs the same protection as other company data: limited access and a retention period decided up front.

People, rules and transparency

An agent changes somebody's job. For this reason the people who will use it should be involved from day one. In Italy, for example, Article 11 of Law 132/2025 requires employers to inform workers when AI is used, in the cases set by employment law.

Then there is the EU AI Act. Some uses count as high risk, such as systems that filter job applications or assess workers. They are listed in Annex III. On 7 May 2026 the Council and the European Parliament agreed to move those rules to 2 December 2027. However, a delay is not an exemption. A project that starts today should already know which category it falls into.

Where to start with AI agents

For your first AI agents my advice is simple: one use case, a clear boundary, one person who checks. At first the agent runs read-only: it proposes and does not act. When the numbers show the proposals are reliable, the boundary grows. One step at a time.

It is the same method I describe on the page about AI-assisted data processing. There too, the starting point is the real work, not the technology.

If your company has a repetitive task that looks like a fit for an agent, write to me and tell me how it runs today. I will tell you plainly whether that data can be processed with an AI agent, with simple rules, or is best left to a person. If instead you need an opinion on which agent or AI service to use on company data, I cover it on the page about technical consulting on data and tools.