AI agents: what they can
and cannot do

What tasks are AI agents suited to, and where does it go wrong?

AI agents are suited to preparatory work that a person decides on afterwards, to steps that can be undone without damage, and to tasks with a hard, checkable final test. It goes wrong in processes where a mistake propagates unnoticed, in actions with external consequences, in long chains without an intermediate check, and in situations without a complete log. How much autonomy an agent gets is a choice the organisation makes, depending on what a mistake costs and who notices it.

What autonomy level does the advice say AI agents should start at?

The advice is almost always to let AI agents start at level one or two, that is, preparing or proposing, even if the model can handle more. That phase makes clear which mistakes actually occur, and that knowledge is needed to determine where autonomy can safely increase.

Is a confirmation step needed when AI agents send messages to customers or initiate payments?

Yes, as standard: actions by AI agents with external consequences, such as a message to a customer, an order or a payment, need a confirmation step. The cost of a mistake then lands outside the organisation and cannot be taken back.

Is a complete log needed when deploying AI agents?

Yes, logging is not optional: without a complete trail of the steps AI agents took, a mistake cannot be reconstructed. Without a log of the steps taken, the sources consulted and the reason for a chosen route, an incident cannot be investigated; for regulated processes that is not an option, and for everything else it is unwise.

Source: article by Dave Willemstein. Updated: October 2026.

What makes an agent different

A standard AI application receives an instruction and gives an answer. An agent receives a goal and decides for itself which steps are needed: retrieving information, consulting a system, assessing an intermediate result, choosing a next step. That makes it more powerful, and it changes the risk question fundamentally.

With a standard answer, you assess one outcome. With an agent, you assess a chain in which a mistake in step two carries through to step five, possibly without the final output looking wrong. That is exactly where things go wrong in practice.

Where agents work well

Preparatory work with a clear final check

Gathering and organising information that a person then makes a decision on. Putting together a file from five sources, building a market overview, preparing a tender response. The agent does the search work, the person does the assessment.

This works because the mistake is visible at the moment it matters: the reviewer sees that something is missing or wrong, before anything irreversible happens.

Steps you can undo without damage

Drafting a concept, assigning a category that can be changed later, creating an internal note. If it goes wrong, you correct it and lose, at most, some time.

Routes with a hard, checkable outcome

If an objective test exists (a calculation that is right or wrong, a query that returns results or doesn't, a file that validates or doesn't), an agent can iterate independently until that test passes. The test is the safety valve.

Where agents break down

Processes where a mistake propagates silently

This is the most important category to avoid. If a wrong intermediate step leads to a final result that looks plausible, nobody discovers the mistake: not in the review, and not in the reporting. Financial processing, risk assessment, and anything where a number flows through to another system falls into this category.

Actions with external consequences

Sending a message to a customer, placing an order, changing an appointment, initiating a payment. Not because an agent can't technically do this, but because the cost of a mistake lands outside your organisation and you cannot take it back. A confirmation step belongs here as standard.

Long chains without an intermediate check

The more steps without a checkpoint, the greater the chance that the agent makes a wrong assumption somewhere halfway through and keeps building on it consistently. Practical limit: if there are more than a handful of steps without any check, build in an intermediate review, automated or human.

Situations without a complete log

If you cannot reconstruct which steps the agent took, which sources it consulted and why it chose a particular route, you cannot investigate an incident. For regulated processes that is not an option, and for everything else it's unwise.

The autonomy level as a deliberate choice

Autonomy is not a property of the technology but a setting you choose. Four levels, in ascending order:

• Preparing: the agent gathers and organises, a person does everything after that. Lowest risk, often already the biggest time saving.
• Proposing: the agent makes a concrete proposal including reasoning, a person approves or amends it.
• Executing with confirmation: the agent takes the steps but asks for confirmation at the irreversible moments.
• Acting independently: the full chain without intervention, with monitoring afterwards. Only for reversible steps with a hard final check.

My advice is almost always to start at level one or two, even if the model can handle more. Not out of caution, but because that's the phase in which you learn which mistakes actually occur. You need that knowledge to decide where you can safely increase autonomy, and you won't get that information anywhere else.

The question you need to answer first

For every step you hand over to an agent, one question: if this step goes wrong, who notices, when, and what does it cost to fix?

Three possible answers and what they mean:

• Immediately visible, cheap to fix: give autonomy.
• Visible later, fixable: autonomy with monitoring and a periodic sample check.
• Not visible, or not fixable: no autonomy, full stop.

What this means in practice

The applications I see working in production are rarely the spectacular ones. They are agents that prepare files, bring together information from different systems, or draft a first version that a person finishes. The time saving is real (often tens of per cent on the preparatory step), and the risk is manageable because someone always looks at it before it matters.

The applications that fail are the chains that were given too much independence too soon. Not because the technology couldn't handle it, but because nobody had established what would happen if it got something wrong. That question takes half an hour, and determines whether your application is still running a year from now.