An AI agent receives a goal and decides which steps to take to reach it: it queries data, calls other tools and acts. That autonomy makes it useful and demands more care than a chatbot, because a chatbot gets one answer wrong and an agent can get an action wrong.
Start with a small process
The best first cases repeat often, follow reasonably clear rules and tolerate error: a mistake gets caught and fixed without major damage. Sorting incoming requests, drafting replies or reconciling information between two systems fit well. Avoid the company's most critical process and also the most ambiguous one, because a modest, well-measured case gives you real lessons and a big project nobody dares to launch gives you none. To choose, it helps to review when to automate a business process.
Data first
An agent is only as good as the information it can reach, so before connecting it, review which personal or confidential data will pass through the model, where it is processed and what your contracts and Colombia's personal data protection law (Law 1581 of 2012) require. If needed, anonymize or limit what it can see. In our experience, the longest part of a project like this is often getting the data into a state an agent can use. This is not legal advice, so check the details with your own counsel.
Minimum permissions
Treat the agent like any service account. Read-only access comes first. Write access opens once the behavior is proven. Irreversible actions need a person's approval: sending a payment, deleting a record. It gets its own scoped credentials, so they can be revoked without touching the rest of your systems.
Move up in rungs: read-only, write with a person's approval and, once the data supports it, write scoped to reversible actions. An agent that sorts support emails, for example, starts by proposing the category. Then it assigns the category with a person's approval. Over time it can tag and route on its own, because fixing a tag is easy, while replying to a customer still goes through review.
Agents carry a risk of their own: the text they read (an email, a PDF, a web page) can carry hidden instructions (prompt injection, the first risk in the OWASP list for LLM applications). What an agent reads should never widen what it is allowed to do, and it is worth setting usage caps and a kill switch.
A person who reviews and approves
Human oversight is part of the design from day one and is reduced only where the data supports it. Define when the agent must ask for confirmation, for instance on large amounts, sensitive customers or low confidence in its own answer, and make review easy by showing what it decided, with which data and why.
Logs
If you cannot reconstruct what an agent did, you cannot trust it. Every step, every tool call and every result gets logged, and those records help with debugging, auditing and improving the instructions with real examples. A useful entry keeps what you need to reconstruct the decision:
{
"run": "2026-11-03T14:07:12Z-0042",
"step": "classify_email",
"tool": "lookup_customer",
"input": "ticket-8123",
"output": "category=billing, confidence=low",
"needs_approval": true,
"approved_by": null
}
Measure against a baseline
Before turning it on, write down how the process works today: how long it takes, how many errors it has, how much manual work it consumes. Afterwards compare against the same indicators and add the cost of running it, which includes model usage, maintenance and review hours. If speed improves at the expense of quality, you adjust or switch it off.
A plan in four steps
- Pick one process and record its baseline.
- Prototype with read-only permissions and a person reviewing every result.
- Pilot with a small group and measure quality, time and cost.
- Expand slowly and remove reviews only where the data justifies it.
We usually begin with the baseline and leave the agent for later. If you have a candidate process, book a conversation and bring a list of what repeats and what goes wrong. Automated workflows are the base an agent rests on, and our process automation service covers that part.