An honest account of where AI agents work in operations, and where they do not

The current enthusiasm for autonomous agents in business operations has produced two equally unhelpful positions: that they will shortly run the company, and that they are a rebranded macro. Having put a number of them into production inside ERPs, the useful picture sits in between and is reasonably easy to describe.

Where they work well

Agents are strong where the task has three properties: the input is messy, the correct output is checkable, and being wrong occasionally is cheap to catch.

Supplier invoice extraction is the clearest example. Invoices arrive as PDFs, scans and email bodies in half a dozen layouts. Extracting line items from that is exactly the sort of fuzzy pattern work that was miserable to automate with rules. And crucially, the output is verifiable: totals must reconcile, the purchase order exists or it does not, quantities either match the receipt or get flagged. The agent proposes, the arithmetic checks, a human sees only the exceptions.

Demand forecasting with messy history, matching deliveries to orders when references are inconsistent, drafting supplier chase emails, classifying incoming requests. All the same shape.

Where they do not

Agents are weak where being wrong is expensive and the error is not immediately visible.

We do not let an agent make final pricing decisions, approve payments, or write to the general ledger without review. Not because the model cannot produce a plausible answer, but because a plausible wrong answer in those places surfaces weeks later, in a reconciliation, after it has propagated.

The test we apply before putting an agent anywhere is this: if it is wrong and nobody notices for a month, what does that cost? If the answer is uncomfortable, the agent proposes and a person approves.

The part people underestimate

The quality of an operational agent is determined mostly by what it can see, not by which model sits behind it. An agent with clean access to your actual stock, lead times and supplier history will outperform a better model guessing from a prompt. This is unglamorous and it is why the integration work matters more than the model choice.

It is also why agents tend to work badly as a first project. If the underlying data is contradictory, the agent inherits the contradiction and now produces confident nonsense at speed.

On running models privately

For clients whose data cannot leave the building, open-weight models on local hardware are now genuinely viable for extraction and classification work. They are still behind the frontier for complex reasoning, so we match the task to the model rather than insisting on one everywhere. A sovereignty requirement is an architecture constraint, not a reason to skip the automation.