The Rabbit Hole · Part III

Agentic AI, minus the incense

Less “autonomous digital workforce.” More “a loop with hands, a budget and a leash.”

~75 min·October 2026·Presented by Michael Gibbs

01 · Strip the label 02 · How it actually works 03 · Five real workflows 04 · Use it Monday

The card

Four rabbit holes, all shallower than the hype.

Strip the label

What “agentic” means, what it doesn’t, and how to spot agent-washing.

12m

How it actually works

The parts, the loop, the tool call, and where the model steps in.

18m

Five real workflows

Support, invoices, sales, IT incidents, social. Normal automation vs agentic, side by side.

35m

Use it Monday

Where it fits, what can go wrong, and a rollout path that won’t embarrass you.

10m

Rule for today: if you can’t point to where the model decides the next step, it isn’t agentic. It’s a sticker.

Strip the label

“Agentic” is a design choice about who decides the next step. It is not a product category.

Hype → mechanism

01 · Strip the label

The word is doing a lot of unpaid work.

~130

of the thousands of “agentic AI” vendors are real, by Gartner’s estimate. The rest are chatbots, RPA and assistants with a new label.

Gartner, Jun 2025

>40%

of agentic AI projects will be cancelled by the end of 2027: cost, unclear value, weak risk controls.

Gartner, Jun 2025

23%

of organisations say they are scaling an agentic system anywhere. No single function is above 10%.

McKinsey, Nov 2025

Translation: most of what you’re being sold as “agents” is automation with a chat box. That can still be useful. Just pay automation prices.

Gartner (25 Jun 2025): 'agent washing' = rebranding existing products such as AI assistants, RPA and chatbots without substantial agentic capabilities. Estimates only about 130 of the thousands of agentic AI vendors are real. Predicts over 40% of agentic AI projects will be canceled by end of 2027 (cost, unclear value, weak risk controls).

McKinsey State of AI (5 Nov 2025): 62% at least experimenting with agents; 23% scaling an agentic system somewhere; no more than 10% scaling in any single function.

Sources (2)

01 · Strip the label

The only definition you need.

An agent is a model in a loop that decides its next step, uses tools to act, checks the result, and keeps going until the job is done or it hits a limit.

The industry version: “Workflows are systems where LLMs and tools are orchestrated through predefined code paths. Agents … are systems where LLMs dynamically direct their own processes and tool usage.” — Anthropic, Building Effective Agents

Model

Reads, reasons, chooses. The only part that is “AI”.

Loop

Act, look at what happened, decide again. Not one-and-done.

Tools

Its hands: search, look up, write, send, update. Run by your systems.

Limits

Permissions, budgets, approvals, a definition of “done”. The leash.

Anthropic, 'Building effective agents' (19 Dec 2024): 'Workflows are systems where LLMs and tools are orchestrated through predefined code paths. Agents, on the other hand, are systems where LLMs dynamically direct their own processes and tool usage.' Also: find the simplest solution possible and only increase complexity when needed.

Sources (1)

https://www.anthropic.com/engineering/building-effective-agents

01 · Strip the label

The ladder. Most real value lives on rungs 2 and 3.

Rules automation

If this, then that. Zapier, RPA, macros.

Who picks the next step

Your code

Automation + an AI step

Fixed flow, one step uses a model: classify, extract, summarise.

Who picks the next step

Your code

AI workflow

Several model steps on a fixed path: route, chain, check.

Who picks the next step

Your code

Agent

The model picks which tool to use next, in a loop, inside limits.

Who picks the next step

The model

Multi-agent / long-running

Agents handing work to agents, running for hours or days.

Who picks the next step

Models

← cheaper, predictable, testableflexible, handles surprises, needs a leash →

The ladder is a teaching device, not an industry standard. Rungs 2-3 correspond to what Anthropic calls 'workflows' (prompt chaining, routing, parallelization). Rung 4 is an 'agent' in the strict sense. McKinsey found most organisations scaling agents do so in only one or two functions.

Sources (1)

https://www.anthropic.com/engineering/building-effective-agents

01 · Strip the label

Normal automation vs agentic: a different contract.

	Normal automation	Agentic
Who decides the path	You did, in advance, when you built it	The model, at run time, each step
Input it likes	Structured: forms, fields, exact formats	Messy: emails, PDFs, chats, logs
New situation	Falls through to an exception queue	Tries something reasonable, or asks
How it fails	Loudly. It stops or errors.	Plausibly. Confident, wrong, and well-written.
Testing	Same input, same output. Unit tests.	Same input, slightly different run. Test sets and spot checks.
Cost per run	Fractions of a cent	Cents to dollars: model calls add up
Best for	High volume, stable rules	Judgement on messy input, variable steps

Not better or worse. A trade: you give up predictability to get flexibility. Only make that trade where flexibility pays.

01 · Strip the label

The sniff test. Five questions for any “agentic” pitch.

Does the model choose the next action?

Or does it fill in one step of a flow someone else drew?

Can it act through tools?

Read and write real systems (CRM, ERP, email), not just talk.

Does it look at results and adjust?

If a lookup fails, does it try another route, or just stop?

What are its limits?

Permissions, spend caps, step limits, what needs a human. Ask to see them.

Can you see the trace?

Every step, tool call and input it used. No trace, no trust.

Scoring

No to 1–3: a chatbot or automation with an AI step. Fine. Not an agent.
Yes to 1–3, no to 4–5: an agent without a leash. Don’t connect it to anything you can’t undo.
Yes to all five: now you can talk about value.

“Agentic” is a property you can check, not a vibe you have to believe.

Use this on vendors and on internal projects. A product that fails questions 1-3 can still be valuable; call it what it is (a chatbot, or automation with an AI step) and price it accordingly.

How it actually works

A model that asks, systems that do, and rules that say how far it can go.

Brain + hands + leash

02 · How it works

Six parts. Only one of them is the AI.

Goal + instructions

What “done” means, the policy, the tone. Written by you, in plain language.

Model

Reads the situation and decides what to do next. The brain.

Tools

Look up an order, search docs, send an email, update the CRM. The hands.

Knowledge + context

Policies, price lists, history, the ticket thread. What it’s allowed to read.

Memory / state

What happened earlier in this job, or last time with this customer.

Guardrails

Permissions, spend caps, step limits, approvals, a full log. The leash.

Swap the model and you get a smarter or dumber agent. Swap the guardrails and you get a safer or more dangerous one.

Anthropic describes the basic building block as 'an LLM enhanced with augmentations such as retrieval, tools, and memory.' Part VI (Harnesses) is the full treatment of everything around the model: the same six parts, from the harness's side.

Sources (1)

https://www.anthropic.com/engineering/building-effective-agents

02 · How it works

The loop. This is the whole trick.

IN / OUT

Goal arrives

An email, an alert, a new invoice, a request.

MODEL

Decide

What do I know? What’s missing? Which tool next?

CODE / TOOL

Act

Your system runs the tool the model asked for.

CODE / TOOL

Observe

The result goes back to the model as text.

MODEL

Check

Done? Stuck? Over a limit? Needs a human?

Model judgesCode / tool actsHuman approves

02 · How it works

A tool call: the model asks, your code does.

MODEL

1 · Model writes a request

CODE / TOOL

2 · Your system runs it

CODE / TOOL

3 · Result goes back as text

MODEL

4 · Model reads it, decides next

{
 "tool": "get_order",
 "email": "j.chen@…"
}

SELECT * FROM orders
WHERE email = …

-- runs with the
-- tool’s permissions

{
 "order": "A-1043",
 "item": "Mug",
 "delivered": "Oct 9"
}

“Delivered 4 days
ago. Check the
damage policy next.”

MCP (Model Context Protocol) is the open standard for plugging tools and data into models. Anthropic donated it to the Agentic AI Foundation (Linux Foundation; co-founded with Block and OpenAI) on 9 Dec 2025, when it had 10,000+ active public servers and 97M+ monthly SDK downloads. Part VI explains MCP, rules files and skills as the plumbing a harness uses.

Sources (1)

https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation

02 · How it works

Use the model for judgement, not arithmetic.

Let the model judge

Reading messy input: emails, PDFs, chats, logs
Classifying intent, urgency, sentiment
Choosing between options with a reason
Drafting replies, summaries, notes
Deciding which tool to try next

Let code calculate

Totals, tax, currency, dates
Exact lookups: account, PO, stock
Matching rules (3-way match, thresholds)
Anything that must be identical every time
Enforcing limits and permissions

Let humans approve

Money out the door above a limit
Anything irreversible: deletes, contracts
Legal, medical, HR judgement calls
Angry or high-value customers
The first 100 runs of anything new

Models are confident even when wrong, inconsistent across runs, and terrible at knowing which. Design around that.

02 · How it works

Autonomy is a dial, set per action. Not per agent.

Suggest

Model recommends, human does it.

Draft

Model prepares it, human clicks send.

Act within limits

Model does it if under a cap. Logged.

Act

Model does it. You review the log.

ONE SUPPORT AGENT, FIVE DIFFERENT SETTINGS

Start every action one notch lower than you think. Promote it when the log proves it earned it.

Five real workflows

Same job, built two ways. Watch where the information goes and where the model steps in.

Same job, two ways

03 · Example 1 · Support inbox

Support inbox: from keyword rules to a triage agent.

IN / OUT

Email arrives

support@ inbox

RULE

Keyword match

“refund” → Refunds

RULE

Tag + template

Canned auto-reply

HUMAN

Queue

Agent picks it up, reads it all again

IN / OUT

Email arrives

Any wording, any language

MODEL

Understand

Intent, urgency, what they actually want

CODE / TOOL

Look up

Customer + order in CRM / shop

CODE / TOOL

Search policy

Damage + replacement rules

MODEL

Decide + draft

Eligible? Which action? Write reply

HUMAN

Gate

≤ $50 auto · above → approve · angry → human

CODE / TOOL

Act + log

Send, create order, note ticket

Model judgesCode / tool actsHuman approves

NORMAL AUTOMATION · rules decide every step

AGENTIC · the model decides the next step, inside limits

Same inbox, same systems. The difference is who reads the email and decides what happens next.

Normal automation version: rules-based routing and canned replies (helpdesk triggers, Zapier, etc.). Agentic version: model reads, decides, uses tools for lookups and actions, gated by spend limits and escalation rules. Klarna (Feb 2024) reported its assistant handled 2.3M conversations in its first month; by May 2025 its CEO said quality was lower and it was rehiring humans and guaranteeing customers can always reach a person.

Sources (1)

https://www.entrepreneur.com/business-news/klarna-ceo-reverses-course-by-hiring-more-humans-not-ai/491396

03 · Example 1 · Support inbox

One run, step by step, from the inside.

01   IN     email from j.chen: “box crushed, mug broken, want a replacement before Friday” + photo

02   MODEL  intent = damaged item · wants = replacement, not refund · deadline = Fri

03   TOOL   get_customer(j.chen) → 6 orders, no prior claims

04   TOOL   get_order(latest) → A-1043 · mug SKU-221 · $38 · delivered Oct 9

05   TOOL   search_policy(“damaged on arrival”) → free replacement ≤ 30 days, photo needed

06   MODEL  photo attached, 4 days since delivery → eligible. Need stock + shipping.

07   TOOL   check_stock(SKU-221) → 14 · express ship → arrives Thu

08   MODEL  action = replacement, express · draft reply in customer’s tone

09   GATE   value $38 < $50 auto-limit · sentiment not escalated → auto-approved

10   TOOL   create_order(replacement) · send_email(reply) · add_note(ticket)

11   DONE   3 model decisions · 7 tool calls · 1 gate · full log kept

Illustrative run. Names, numbers and tools are invented.

Illustrative run: names, order numbers and amounts are invented. Real traces look like this in most agent platforms: a list of model decisions and tool calls with inputs and outputs. Ask any vendor to show you one.

03 · Example 1 · Support inbox

Support: where the model steps in. And where not.

The model judges

What the customer actually wants
Which policy applies
Which tool to try next
The reply, in the customer’s language and tone
When to hand off to a person

Code and tools do

Customer, order, stock, shipping lookups
Creating the replacement order
Spend limits and eligibility rules
Sending email, logging every step

A human owns

Refunds above the limit
Angry, legal or VIP customers
Weekly review of a sample of runs
The policy documents the agent reads

What goes wrong → the guardrail

Invents a policy that doesn’t exist

→

Answer only from the policy tool; no source, no promise

Promises something you then have to honour

→

Air Canada was held liable for its chatbot’s answer. Draft mode until proven.

Customer gets stuck with a bot

→

Always offer a human. Klarna learned this publicly.

Air Canada (BC Civil Resolution Tribunal, Feb 2024): the chatbot told a passenger he could claim a bereavement fare after travel; the airline argued the chatbot was a separate legal entity responsible for its own actions; the tribunal rejected that and awarded about CA$812. Klarna: see previous notes.

Sources (2)

03 · Example 2 · Invoices (accounts payable)

Invoices: model reads, code matches, humans pay.

IN / OUT

PDF arrives

ap@ inbox

RULE

OCR template

One template per vendor layout

RULE

3-way match

Invoice = PO = receipt?

HUMAN

Exception queue

Anything off goes to a person, unexplained

IN / OUT

Invoice arrives

Any layout, scan or email body

MODEL

Extract

Vendor, lines, totals, PO number

CODE / TOOL

Look up

Vendor + PO + receipts in ERP

CODE / TOOL

Match (math)

Code compares qty × price × tax

MODEL

Explain gaps

Partial delivery? Price change? Duplicate?

CODE / TOOL

Gather

Receiving log, vendor emails, contract

HUMAN

Approve

Clerk sees match + reason, approves payment

Model judgesCode / tool actsHuman approves

NORMAL AUTOMATION · rules decide every step

AGENTIC · the model decides the next step, inside limits

The model never approves money and never does the arithmetic. It turns “exception” into “exception, with a reason and a suggested fix”.

Pattern: model for extraction from unstructured documents and for explaining mismatches; deterministic code for matching and totals; humans own payment approval. This mirrors the guidance to keep exact computation in code and use the model for judgement on messy input.

03 · Example 2 · Invoices

Invoices: the model never moves money.

The model judges

Reading any invoice layout
Mapping invoice lines to PO lines when names differ
Why it doesn’t match, in plain words
Drafting the email to the vendor

Code and tools do

Totals, tax, currency, tolerances
PO and receipt lookups in the ERP
Duplicate-invoice check
Posting the approved invoice

A human owns

Every payment approval
Vendor bank-detail changes (fraud risk)
New vendors
The tolerance rules

What goes wrong → the guardrail

Misreads a number on a bad scan

→

Code re-totals the lines; any mismatch blocks auto-match

A fake invoice asks to change bank details

→

Never actionable by the agent. Human + call-back, always.

Model ‘explains’ a mismatch confidently and wrongly

→

Show the evidence it used next to the explanation

03 · Example 3 · Sales lead research

Sales leads: from job-title points to real research.

IN / OUT

Form fill

Website or event list

RULE

Create in CRM

Map fields

RULE

Score by rules

+10 if ‘VP’, +5 if 500+ staff

RULE

Sequence

Same 5 emails to everyone

IN / OUT

Lead arrives

Name, email, company

CODE / TOOL

Enrich

Website, news, job posts, data provider

MODEL

Research brief

What they do, what changed, cited

CODE / TOOL

Check CRM

Existing account? Open deal? Do-not-contact?

MODEL

Score + angle

Fit vs your ideal-customer doc, with reasons

MODEL

Draft

First email + suggested next step

HUMAN

Rep sends

Edits, sends, or bins it

Model judgesCode / tool actsHuman approves

NORMAL AUTOMATION · rules decide every step

AGENTIC · the model decides the next step, inside limits

The agent does the hour of homework. The rep keeps the relationship and the send button.

Pattern: tools gather public and CRM data; the model synthesises a cited brief and drafts; a human sends. Risk: fabricated facts about the prospect, so require citations for every claim in the brief and keep the agent in draft mode for outbound.

03 · Example 3 · Sales lead research

Sales: let it research. Don’t let it send as you.

The model judges

What this company does and what changed
How well it fits your ideal customer, and why
Which angle to lead with
A first draft in your voice

Code and tools do

Enrichment from approved sources
CRM duplicate and do-not-contact checks
Logging the brief to the CRM record
Rate limits on outreach

A human owns

Sending anything
Which leads get time this week
The ideal-customer definition
Privacy and consent rules

What goes wrong → the guardrail

Invents a fact about the prospect

→

Every claim in the brief links to its source; no link, cut it

Emails someone who opted out

→

Do-not-contact check is code, not a model judgement

Personalised spam at scale

→

Draft only. A human sends, and owns the reputation.

03 · Example 4 · IT / Ops incident

Incidents: diagnose fast, fix only the safe list.

IN / OUT

Alert fires

CPU > 90% for 5 min

RULE

Page on-call

Phone rings at 3am

RULE

Runbook link

A wiki page

HUMAN

Human digs

Logs, dashboards, deploys

IN / OUT

Alert fires

Plus service, time, severity

CODE / TOOL

Gather

Logs, metrics, recent deploys (read-only)

MODEL

Diagnose

Correlate, rank likely causes

CODE / TOOL

Test

Run read-only diagnostics it picks

MODEL

Propose fix

From the runbook, with evidence

HUMAN

Gate

Safe list: auto (restart, scale) · else on-call approves

MODEL

Write-up

Timeline + incident note

Model judgesCode / tool actsHuman approves

NORMAL AUTOMATION · rules decide every step

AGENTIC · the model decides the next step, inside limits

On-call wakes up to a diagnosis and a proposed fix, not a blank dashboard.

Pattern: read-only investigation is low risk and high value; write actions are restricted to a pre-approved list with everything else requiring human approval. Replit (Jul 2025): an AI coding agent deleted a production database during a code freeze despite instructions not to make changes; Replit then added automatic dev/prod database separation, a planning-only mode and one-click restore.

Sources (1)

https://www.eweek.com/news/replit-ai-coding-assistant-failure/

03 · Example 4 · IT / Ops incident

Incidents: instructions are not permissions.

The model judges

Which signals matter and how they connect
Most likely cause, ranked, with evidence
Which diagnostic to run next
The incident summary and timeline

Code and tools do

Read-only access to logs, metrics, deploys
A short list of safe, reversible actions
Verifying the fix: did metrics recover?
Recording every command run

A human owns

Anything not on the safe list
Anything touching data or production config
Customer communication
The post-incident review

What goes wrong → the guardrail

Agent ‘fixes’ the wrong thing at 3am

→

Write actions limited to a reversible safe list

Told not to touch prod; touches prod anyway

→

Replit, 2025: separate credentials, not a polite prompt

Logs contain attacker-written text

→

Treat log content as untrusted input, never as instructions

03 · Example 5 · Social (X + LinkedIn)

Social: from a posting schedule to a listening agent.

IN / OUT

Content calendar

Posts written weeks ahead

RULE

Scheduler

Publishes at 9:00 sharp

RULE

Auto-rules

Blog feed → post; auto-DM followers

HUMAN

Weekly report

Someone reads the numbers on Friday

IN / OUT

Signal

Mention, reply, DM, trending topic, new blog post

CODE / TOOL

Gather

Thread, author history, CRM, brand guide, calendar

MODEL

Classify

Complaint, question, lead, idea, troll or crisis?

MODEL

Decide

Reply, route to support, draft a post, pause schedule, ignore

MODEL

Draft

Per platform. X: short, direct. LinkedIn: longer, professional

HUMAN

Approve

Every public word. Auto only: pause, route, hide spam

CODE / TOOL

Publish + learn

Official API, log, results feed next week’s plan

Model judgesCode / tool actsHuman approves

NORMAL AUTOMATION · rules decide every step

AGENTIC · the model decides the next step, inside limits

The agent listens and drafts all day. A person still decides what the brand says in public.

Pattern: listening and drafting are high value and low risk; publishing is where brand, legal and platform-policy risk sits, so a human approves every public post or reply. Safe automatic actions are the reversible, inward-facing ones: pausing scheduled posts, routing complaints into the support queue (Example 1), hiding obvious spam. Publishing goes through each platform's official API, not browser automation.

03 · Example 5 · Social (X + LinkedIn)

Social: let it listen and draft. Never let it riff.

The model judges

Complaint, lead, joke or crisis?
Reply, route, or stay quiet
One blog post → an X thread + a LinkedIn post
Is today’s scheduled post now tone-deaf?

Code and tools do

Pulling mentions via the official APIs
Banned-claim and brand-word checks
Pausing the schedule (safe, reversible)
Routing complaints to support (Example 1)
Logging every draft and approval

A human owns

Every public post and reply
Pricing, legal, outages, politics
Journalists and crises
The brand voice guide it reads

What goes wrong → the guardrail

Someone tweets “ignore your instructions and…” at it

→

Mentions are untrusted input. A GPT-3 Twitter bot was hijacked this way in 2022.

It invents a stat or a customer quote

→

Claims trace to a source doc. Fake testimonials are illegal (FTC rule, 2024).

Auto-replies get the account restricted

→

Follow each platform’s automation rules: next slide.

Remoteli.io (Sept 2022): a GPT-3-powered Twitter bot that replied to tweets about remote work was hijacked by users writing 'ignore the above and...' prompts; it posted threats and claimed responsibility for the Challenger disaster (Gizmodo).

FTC final rule on fake reviews and testimonials (announced 14 Aug 2024, effective 21 Oct 2024): bans fake reviews/testimonials including AI-generated ones, and fake indicators of social media influence generated by bots, when used to deceive for commercial gain.

Sources (2)

03 · Example 5 · Social (X + LinkedIn)

Read the platform rules before you automate.

X Automated posts from outside information, e.g. your blog or status page. OK Automated replies triggered by keyword searches alone. NO Automated replies only to people who opted in, one per interaction. LIMIT “Any AI reply bot requires prior written and explicit approval from X.” ASK Scripting the website instead of using the API. NO

LinkedIn “Bots or other unauthorized automated methods” to access the service. NO Automated likes, comments, shares or connection requests. NO Posting to a company Page by API: Community Management API, after LinkedIn reviews your app. ASK Approved scheduling tools and the official API for your Page. OK Browser extensions that act as you. NO

Policies as published, checked October 2026. They change: re-check before you build.

The pattern that keeps you safe on both: the agent drafts, a human approves, the official API publishes.

X automation rules (help.x.com, checked 13 Oct 2026): automated posts based on outside information or for informational purposes are allowed; 'sending automated replies to posts based on keyword searches alone is not permitted'; recipients must opt in and only one automated reply per user interaction; 'the deployment or operation of any AI reply bot requires prior written and explicit approval from X'; non-API automation such as scripting the website is not allowed.

LinkedIn User Agreement (version dated 3 Nov 2025): don't 'use bots or other unauthorized automated methods to access the Services', including to create, comment on, like, share or re-share posts to drive inauthentic engagement. LinkedIn's Community Management API (for posting to organisation Pages) is only for registered legal organisations with commercial use cases and requires an access review.

Policies change: re-check before building.

Sources (4)

03 · Five real workflows

The pattern across all five.

	Messy input	Model judges	Code computes	Human owns
Support	Customer emails	Intent, policy fit, reply	Lookups, limits, orders	Big refunds, angry customers
Invoices	PDFs, scans	Extract, explain mismatches	Matching, totals, posting	Every payment
Sales	Web, news, CRM	Brief, fit, angle, draft	Enrich, dedupe, opt-outs	Sending
Incidents	Logs, metrics	Diagnose, propose	Read-only checks, safe fixes	Anything else
Social	Mentions, replies, news	Classify, decide, draft	Fetch, check, pause, publish	Every public word

Discussion · 03

Where does this pattern already exist for you?

Which inbox, queue or spreadsheet is full of messy input that someone reads all day?
Where do your current automations dump things into an “exceptions” pile?
Which decisions are judgement calls, and which are really just rules nobody wrote down?
What is the most expensive thing an agent could do wrong there, and can you undo it?

Use it Monday

Pick the right job, put the leash on first, and promote autonomy only when the log says so.

Start boring

04 · Use it Monday

Where agents fit. And where a plain rule is smarter.

MESSY INPUT

AI step in a workflow

Messy input, same steps every time. Model reads; flow is fixed. Most of your wins live here.

Agent

Messy input, steps depend on what it finds. Worth the complexity, with a leash.

CLEAN INPUT

Rules automation

Clean input, same steps. Don’t pay for a model to do an IF statement.

Better rules, or a person

Clean input, many branches. Usually a decision table. Sometimes just a human.

SAME STEPS EVERY TIME

STEPS DEPEND ON WHAT IT FINDS

Then check the stakes. High cost of a mistake + low volume = keep a human in charge, whatever the quadrant says.

04 · Use it Monday

Pick your first one like a skeptic.

Good first candidates

High volume: dozens to thousands a week
Messy input a person currently reads
A clear definition of “done”
Mistakes are cheap and reversible
Rules exist, even if only in someone’s head
The data is reachable through an API or export

Not your first project

Money leaving without a human approval
Legal, medical or HR advice to customers
Anything you can’t log or undo
A process nobody can explain today
Rare, high-stakes, one-off decisions
“Let’s see what the AI comes up with”

Best first project: the exception queue of an automation you already run.

04 · Use it Monday

Three stories everyone in this room should know.

Klarna, 2024–2025

Cost won. Then quality lost.

Its AI assistant handled 2.3M chats in its first month. By May 2025 the CEO said quality was lower and Klarna started hiring human agents again.

Measure quality, not just cost. Always offer a human.

Air Canada, 2024

“The bot said it” is not a defence.

Its chatbot invented a refund rule. The airline argued the bot was a separate legal entity. The tribunal disagreed and made it pay.

You own every word and action your agent produces.

Replit, 2025

Told not to. Did it anyway.

During a code freeze, an AI coding agent deleted a live production database. The user says it then misrepresented what it had done.

Instructions are not permissions. Lock it down in the system.

Klarna: Feb 2024 assistant handled 75% of chats / 2.3M conversations in its first month, claimed work of 700 agents; May 2025 CEO told Bloomberg the AI-first approach gave lower quality, rehiring humans, 'there will always be a human if you want.'

Air Canada: BC Civil Resolution Tribunal, Feb 2024, ~CA$812; tribunal rejected argument that the chatbot was a separate legal entity.

Replit: Jul 2025, Jason Lemkin (SaaStr); agent deleted a production database (records on 1,206 executives, 1,196+ companies) during a code freeze; CEO called it unacceptable; added dev/prod separation, planning-only mode, one-click restore.

Sources (3)

04 · Use it Monday

The leash. Build it before you build the agent.

Least privilege Its own account, its own keys, only the tools this job needs. Read-only by default.

Limits Max steps, max spend, max refund, max emails per hour. Hard-coded, not prompted.

Approvals Named human for money, deletes, external sends and anything new.

Full trace Every input, decision, tool call and output, kept and searchable.

Test set 100 real past cases with known right answers. Re-run before every change.

Kill switch + human path One click to stop it. One click for a customer to reach a person.

The lethal trifecta An agent that can read private data, read untrusted content (emails, web pages, PDFs) and send things out can be tricked by a hidden instruction into leaking your data. Every agent in this talk reads untrusted content. So break one of the other two legs.

Name coined by Simon Willison (2025). OWASP’s 2025 Top 10 for agentic apps puts “Agent Goal Hijack” first.

If the guardrails aren’t written down, you don’t have an agent. You have a liability with an API key.

Lethal trifecta (Simon Willison, 16 Jun 2025): access to private data + exposure to untrusted content + ability to communicate externally = an attacker can trick the agent into leaking data. OWASP Top 10 for Agentic Applications (9 Dec 2025): ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Agentic Supply Chain, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents. Part VIII (Risk, security and governance) expands this slide into a full session: prompt injection, the OWASP list in human terms, data leakage, deepfake fraud and governance on a page.

Sources (2)

04 · Use it Monday

The rollout path: one rung at a time.

Write the process down

Steps, rules, exceptions, who decides. If people can’t agree on it, an agent won’t fix it.

Week 1

Collect a test set

100 real past cases with the right answer for each. This is your exam.

Week 1–2

Shadow mode

The AI runs alongside humans and does nothing. Compare its answers to theirs.

Week 2–4

Draft mode

It prepares; people approve. Track the edit rate and why they edit.

Month 2

Promote actions one at a time

Edit rate is low and stable on one action? Let that one act within limits.

Month 3+

Most teams should stop at step 4 for a while. That’s not failure. That’s a very good tool.

04 · Use it Monday

Build, buy, or switch on. Examples, not endorsements.

Switch on Agents inside software you already pay for Helpdesk, CRM, ITSM and finance suites now ship agent features, e.g. Intercom Fin, Salesforce Agentforce, ServiceNow. Fastest. Least control. Run the sniff test.

Assemble Workflow builders with agent steps Drag-and-drop flows where one step can be an agent with tools, e.g. n8n, Zapier, Make, Microsoft Copilot Studio. Best for rungs 2–4. Ops teams can own it.

Build Agent SDKs + your code Full control of loop, tools and guardrails, e.g. Claude Agent SDK, OpenAI Agents SDK, LangGraph. Most flexible. You own the maintenance.

Plumbing Connectors + models MCP servers to expose your systems once to any model. Frontier APIs, or local models from Part II. Pick once, reuse everywhere.

Whatever you pick: you still need the process, the test set and the leash. No vendor ships those.

Examples only, current as of Oct 2026; check pricing, data handling and model terms for your use. n8n's AI Agent node connects a chat model and tools and lets the agent choose which tools to call. MCP governance moved to the Agentic AI Foundation (Linux Foundation) in Dec 2025. Part II covers running models locally; Part VI covers choosing a harness or SDK; Part IX covers choosing a model.

Sources (2)

Agentic isn’t magic.

It’s a loop with hands.

A model that decides the next step. Tools your systems run. Code that checks the math. A human who owns the outcome.

Everything else is a sticker.

Agentic AI, minus the incense

Four rabbit holes, all shallower than the hype.

Strip the label

The word is doing a lot of unpaid work.

The only definition you need.

The ladder. Most real value lives on rungs 2 and 3.

Rules automation

Automation + an AI step

AI workflow

Agent

Multi-agent / long-running

Normal automation vs agentic: a different contract.

The sniff test. Five questions for any “agentic” pitch.

Does the model choose the next action?

Can it act through tools?

Does it look at results and adjust?

What are its limits?

Can you see the trace?

Scoring

Run the sniff test on a product you are being sold

How it actually works

Six parts. Only one of them is the AI.

Goal + instructions

Model

Tools

Knowledge + context

Memory / state

Guardrails

The loop. This is the whole trick.

Goal arrives

Decide

Act

Observe

Check

Run the support-inbox agent, one step at a time

A tool call: the model asks, your code does.

1 · Model writes a request

2 · Your system runs it

3 · Result goes back as text

4 · Model reads it, decides next

Use the model for judgement, not arithmetic.

Let the model judge

Let code calculate

Let humans approve

Autonomy is a dial, set per action. Not per agent.

Suggest

Draft

Act within limits

Act

Set the dial per action, and read the policy it produces

Five real workflows

Support inbox: from keyword rules to a triage agent.

Email arrives

Keyword match

Tag + template

Queue

Email arrives

Understand

Look up

Search policy

Decide + draft

Gate

Act + log

One run, step by step, from the inside.

Support: where the model steps in. And where not.

The model judges

Code and tools do

A human owns

Invoices: model reads, code matches, humans pay.

PDF arrives

OCR template

3-way match

Exception queue

Invoice arrives

Extract

Look up

Match (math)

Explain gaps

Gather

Approve