AI agents for business operations: where autonomy belongs

A chatbot produces an answer. An agent decides which steps to take, calls tools and changes external state. It may search a CRM, draft a response, update a ticket, create a refund request or schedule a follow-up. The value comes from completing a workflow; the risk comes from acting through real permissions.

That distinction should shape the architecture. The language model can interpret ambiguity and choose among allowed options. Authentication, authorisation, spending limits, record validation and approval requirements should remain deterministic controls outside the model.

Begin at the lowest level that produces value. Level one retrieves and summarises. Level two drafts for review. Level three recommends an action with evidence. Level four performs reversible, bounded actions. Level five touches money, rights, commitments, health, employment or deletion and therefore requires explicit approval or remains human-only.

Good early candidates include classifying inbound requests, drafting replies from approved knowledge, preparing account briefs, reconciling documents and routing exceptions. Poor first candidates include autonomous pricing, unsupervised medical advice, final hiring decisions, unrestricted bank access or deletion across production systems.

For a Punjab exporter, an agent might assemble an order-status answer from logistics and ERP data but require a person to approve a revised delivery commitment. For an Indian professional-services firm, it might extract clauses and prepare a comparison while leaving legal judgement and client advice with the responsible professional.

Create a representative evaluation set from real, redacted cases: normal requests, ambiguous inputs, policy conflicts, missing data, prompt injection, tool failure and requests outside scope. Score factual grounding, correct tool choice, permission compliance, escalation quality, completion time and business outcome.

Production monitoring should capture the plan, tool calls, source records, approvals, final action and recovery path. Averages are insufficient: track the expensive tail—cases where the agent confidently did the wrong thing or failed to stop.

“Talk to a human” is not a handoff if the person receives no context. The agent should transfer the user’s goal, gathered evidence, actions already attempted, unresolved question and urgency. The person should be able to continue without forcing the customer or employee to repeat the story.

Autonomy should expand only when evaluation and production evidence support it. That produces a safer path from assistant to operator—and prevents an organisation from confusing frontier model capability with permission to act.