"Agent" is 2026's most worn word. Meanwhile, the message from analyst firms is sober: Gartner predicts that over 40 percent of agentic AI projects will be cancelled before the end of 2027 — due to escalating costs, unclear business value and inadequate risk controls.
We see the same pattern on the ground with clients. Not because agent technology is poor — it is often impressive — but because the demo is easy and production is hard. Here is the frame we use to build agentic workflows that last.
Start with the question: what happens when the agent is wrong?
Every automation should be designed for its failures. For a classic batch process, failure is predictable: the job crashes and rolls back. For an agent making decisions in open formats, failure is quieter: it answers wrongly, with confidence. The question "what happens when it's wrong, and how will we notice?" deserves a written answer before the first line of code.
The fourfold boundary
Every agent we put into production gets four types of boundaries:
- Permissions. Least privilege. An agent reading invoices should not be able to see HR data — no matter how convenient that would be.
- Tools. A defined, whitelisted toolbox. Open network access is not an architecture; it is a vulnerability.
- Cost and scope. Caps on calls, tokens and steps. The agent that loops forever should trigger an alarm, not an invoice.
- Decision points. Defined moments where a human approves before the agent may act — especially where errors are expensive: payments, sends, deletions.
That may sound cautious. It is. It is also the difference between automation that gets to run and automation that gets switched off after the first incident.
RPA and agents are not adversaries
A common misconception is that agentic AI replaces RPA. In practice they complement each other: RPA is strong on regular, well-defined flows with stable interfaces. Language-model agents are strong on variation — documents that look different, exceptions, natural language. In many processes the right architecture is hybrid: RPA holds the spine, the agent handles variation, the human decides.
Process mining is often the right starting point: it shows where volume, variation and error sources actually live — before anyone builds anything.
The property that matters: traceability
An agentic workflow without complete logging is impossible to operate, audit or insure. Every decision — which tools were used, which data was read, who approved what — must be reconstructable. That is simultaneously a prerequisite for the AI Act's requirements on human oversight and documentation, and for DORA-governed businesses that must account for their supply chains.
A checklist before production
- A written answer to "what happens when it's wrong?"
- Least privilege and whitelisted tools
- Cost and step limits with alerts
- Human decision points where errors are expensive
- Complete logging and reconstructability
- An evaluation harness with your real cases — run regularly
Build to the list, and you belong to the minority whose agentic projects reach production. The rest is demos.
Sources
- Gartner — press release 25 June 2025: over 40% of agentic AI projects cancelled by 2027
- OWASP — Top 10 for LLM Applications (2025), genai.owasp.org
- McKinsey — State of AI, November 2025 (agent usage at scale, via secondary source)