The appeal of an AI agent is that it can choose a path through a task rather than follow a completely fixed sequence. That flexibility can be useful when the work is variable: investigating an exception, locating evidence across several systems or assembling a proposed resolution. It also changes the control problem.
An enterprise agent should have a defined responsibility, a limited set of tools and a clear stopping point. The question is not how much autonomy a model can demonstrate. It is how much authority a particular workflow can safely delegate, and what evidence will show that the delegation is working.
Use an agent where the path genuinely varies
A predictable process usually benefits from predictable orchestration. If every request follows the same validations, approvals and updates, a workflow engine may provide better visibility with less complexity. An agent becomes more interesting when the system must choose what information to seek or which permitted step is useful next.
Consider investigating an order discrepancy. Some cases need a shipment lookup, others a pricing comparison and others a clarification from staff. An agent can assemble the relevant evidence. It does not follow that the same agent should issue a refund or change the order. Investigation and execution can remain separate responsibilities.
Express authority through the tool layer
A prompt describing company policy is helpful context, but it should not be the only control. Enforce tenant scope, user permissions, allowed operations and input validation in the services behind the tools. A model's request to access a record should succeed only if the authenticated workflow is entitled to that record.
Expose narrow operations instead of unrestricted database or shell access. A tool such as “retrieve an authorized order summary” is easier to secure than “run a query.” For consequential writes, require a structured proposal, validate it independently and apply approval rules outside the model. Keep credentials out of the agent's visible context.
Separate task information from instructions
An agent may encounter emails, documents or web content containing text that tries to redirect its behavior. Treat this material as untrusted task data. The fact that a sentence appears in a retrieved document does not make it an authorized instruction to send information elsewhere or invoke another tool.
Use permission checks and constrained data flows even when the model appears to ignore malicious content during a demonstration. Limit where outputs can be sent and what information each tool returns. Evaluate hostile examples as part of the workflow tests, including instructions embedded in attachments and requests to reveal internal context.
Bound time, cost and operational impact
Define limits for tool calls, execution time and repeated attempts. An agent that cannot make progress should stop with an explainable status rather than continue consuming resources. Distinguish a completed task from a partial investigation and from a task awaiting a human decision. These states matter to the next person in the process.
Use operation identifiers for write proposals and execution so that retries do not create duplicate effects. If the agent times out after submitting an action, the system should be able to inspect the authoritative result. The absence of a response is not proof that the action never happened.
Require evidence that helps a reviewer
A useful proposal identifies the source records, the material uncertainty and the action being requested. It should separate facts found in authorized systems from conclusions drawn by the model. A confident paragraph without source context gives the reviewer more work, because the reviewer must reconstruct the investigation independently.
Log tool inputs and outcomes with appropriate redaction and access controls. Operational traces should help explain which resources were accessed and which action was authorized. Avoid recording unnecessary personal data merely because it is present in a model response. Traceability should support investigation without becoming an uncontrolled copy of sensitive information.
Expand authority through evaluation
Begin with read-only investigation or proposed actions. Evaluate realistic tasks, deliberate misuse and service failures. Measure task completion, reviewer corrections, unsupported conclusions and escalation quality. A benchmark score alone does not demonstrate that an agent respects the boundaries of a specific enterprise workflow.
Once results are dependable, consider automating a low-impact action with a clear recovery path. Retain stronger approval for financial, identity or externally visible changes. Autonomy should grow through demonstrated performance and operational understanding, rather than arrive as a single switch applied to the entire system.