What actually changed
For two years the dominant enterprise AI pattern was retrieval plus a chat window: ground the model on your documents, let a person ask questions, keep the human firmly in the loop. That pattern works, and it is still the right starting point for most organizations.
Agentic systems change the shape of the problem. Instead of answering, the system acts — it opens the ticket, reconciles the invoice, drains the node, and reports what it did. The value is higher and so is the blast radius, which is why the engineering discipline matters more than the model choice.
Where agents earn their place
The strongest early candidates share a profile: high volume, well-bounded, already partially automated, and with a cheap reversal path if the agent gets it wrong.
- Service desk triage — classification, enrichment and routing before a human sees the ticket
- Infrastructure remediation for known failure modes with an existing runbook
- Invoice and document reconciliation where the exception rate is the real cost
- Data pipeline recovery — detecting a failed load and re-running it with the right parameters
The scaffolding that makes it safe
An agent in production needs four things a prototype does not: a tightly-scoped tool surface, an evaluation suite that runs on every prompt change, a full audit trail of actions taken, and a defined stop condition. Miss any one and the system is a liability rather than an asset.
Scope the tools first. An agent that can only call three well-tested functions is dramatically easier to reason about than one handed broad API credentials. Most incidents we see in review trace back to tool surfaces that were widened for convenience during development and never narrowed again.
How to start
Pick one process, instrument it before changing anything, and run the agent in shadow mode against real traffic until its decisions match your operators' often enough to trust. Only then give it write access — and give it the narrowest write access that completes the job.