AI agents for business: where they fit, and the controls they need

The four terms are used loosely, vendors included. These are the working definitions this guide uses, each tied to a published source listed at the end of the page.

Agents earn their cost on work that needs judgement across inputs no rule set captures, and where a wrong step can be caught before it lands. OpenAI’s guide names three signs: decisions that need judgement and are full of exceptions, rule sets that have grown too costly to maintain, and heavy reliance on unstructured material such as documents and conversations. Where a use case does not clearly meet those tests, the same guide says a deterministic solution may be enough.

The table below is our reading of how that plays out across common business functions. It describes where to look, not results anyone has measured in your business.

One question comes before all of them: does the model need to choose the steps at all? Anthropic’s published advice is to find the simplest solution possible and add complexity only when it is needed, and it notes that agentic systems often trade speed and cost for better task performance. Many useful systems are a fixed workflow with one model step inside it, which is cheaper to run and easier to test than an agent.

Four situations argue against an agent. When the steps are known and stable, a workflow or a scheduled job does the same work more cheaply and more predictably. When nobody can say what a correct result looks like, nothing can check the agent either. When every output is read by a person before anything happens, a drafting assistant is enough, because the reader is the check. And when an error would land before anyone could see it, the agent should not be allowed to act until the controls in the next section exist.

Multi-agent systems add a further cost. Anthropic reports that, in its data, agents use about four times the tokens of a chat interaction and multi-agent systems about fifteen times, and that work where every agent needs the same context, or where the agents depend heavily on one another, is not a good fit for multi-agent systems today. OpenAI’s guide likewise recommends getting as far as possible with a single agent before adding more.

Accuracy is the wrong measure for an agent. What matters is what happens on the occasions it is wrong, and whether anything notices before the consequence lands. The controls below are the ones to have in place before an agent may write to anything that matters. The agent proposes and deterministic checks decide what proceeds; anything that fails a check goes to a person with the reason attached. The mechanism is set out in full in our published pattern for gating an agent’s actions.

Vendors now ship parts of this in their agent products. The OpenAI Agents SDK includes guardrails that validate an agent’s inputs and outputs, and built-in tracing of each run. Anthropic’s Claude Agent SDK lets a developer set which tools run automatically and which need approval, and run custom code at set points in the agent’s lifecycle. Microsoft’s Agent Framework supports tools that pause a workflow for human review before they run. These are building blocks. Which actions need a check, and who approves them, is still the business’s decision. OpenAI’s own guide names two triggers for handing control to a person: an agent exceeding its failure limits, and actions that are sensitive, irreversible or high-stakes.

Two published engagement files describe parts of this. At a large international marketing agency, we build managed-agent workflows for finance-critical tasks, so deterministic checks decide what proceeds (engagement file D-01). In engagement file D-06, a connector answers questions from finance data while carrying each person’s existing permissions, so nobody sees more than they already could.

Where an agent handles personal data, data protection law applies to it as to any other processing. The ICO’s January 2026 report on agentic AI says organisations remain responsible for the data protection compliance of the agentic AI they develop, deploy or integrate, and the OWASP GenAI Security Project published a Top 10 for Agentic Applications in December 2025 setting out the main security risks. This is not legal advice. Which rules apply to a particular agent is a question for your legal adviser or data protection officer. For where these controls sit in a wider policy, our governance guide shows an AI policy mapped to its controls, clause by clause.

No two agent projects cost the same, and a single published price would hide the drivers below. Each one can be estimated before a build starts.

The runtime is increasingly a vendor product rather than something to build. The vendor runtimes we call an AI harness already include an agent loop, tools and permission settings: Anthropic’s Claude Agent SDK, for example, packages the loop, tools and permissions that run Claude Code. What a business still owns is the work around the runtime: the definitions, the checks, the access model and the person who answers when it fails.

Use this before you commission a build, from us or from anyone else. Each item should have a written answer before any code is written.

If the checklist shows the workflow is not ready, that is a useful answer, and cheaper to learn now than after a build. If you want help with it, a fixed-scope AI strategy sprint of typically two to four weeks scores candidate use cases on value, feasibility and risk.