Agentic AI: when should software take actions for you?

An AI agent is software that takes actions as well as answering questions: it sends the email, updates the record, books the meeting. That can save real time on repetitive work. It also changes the risk, because a mistake is no longer a bad paragraph on a screen. It’s something that has already happened. So the real question isn’t whether to use agents, but how much freedom to give them, and for most small organisations the answer is less than the sales pitch suggests.

Chatbot or agent?

A chatbot takes your words and gives you words back. You read them and decide what to do. An agent is the same kind of AI model connected to tools: your email, calendar, CRM (customer database), accounting software or a web browser. Give it a goal (“find a time next week for the trustees and send the invite”) and it chooses a tool, looks at the result and decides the next step, over and over, until it thinks the job is done.

That loop is what makes agents useful, and what makes them risky. Every step is a prediction, and predictions can be wrong (see why AI gets things wrong). Errors also compound: a misread email becomes a wrong record, which becomes a wrong reply. A chatbot that’s wrong gives you a bad paragraph to fix. An agent that’s wrong has already sent it.

A ladder of autonomy

We find it helps to think in four rungs. Each step up saves more time and needs more trust.

1. Suggest. The agent says what it would do (“this looks like a refund request, so I’d send the standard refund reply”) and a person does it.
2. Draft for approval. The agent prepares the action (the reply written, the record update filled in, the meeting slot held) and a person checks it and presses the button.
3. Act with limits. The agent acts on its own, but only inside tight, pre-set rules: specific tasks, approved recipients, a cap on value, actions that can be undone. A person reviews afterwards.
4. Act alone. Open-ended goals, broad access and no routine review.

Where most small organisations should stop

For anything that affects people outside your team (messages to clients, payments, changes to someone’s records), rung 2 is the right default. You keep most of the time saving, because the agent did the gathering and drafting, and a person still sees every action before it happens.

Rung 3 suits low-stakes, reversible, internal jobs: filing documents, tagging enquiries, updating a task list. Move a task up only once it has run at rung 2 long enough to build a track record you’ve actually checked. One rung at a time, on evidence rather than enthusiasm.

Rung 4 is where we’d stop and ask why. In a small organisation, the minutes saved by removing the last human check are rarely worth the cost of one confident mistake. If you’re choosing a first task, pick something boring.

Permissions and spending limits

The safest agent is one that can’t do much damage even when it’s wrong.

• Give it its own account, not a staff member’s login, so you can see what it did and switch it off without locking anyone out.
• Grant the fewest permissions it needs. Read-only by default. If it drafts emails, it shouldn’t be able to delete them. If it updates one spreadsheet, it shouldn’t see payroll.
• Set hard limits outside the AI. A spending cap on a dedicated card, a daily limit on emails sent, an approved list of recipients or suppliers. Limits enforced by the system can’t be talked round. Instructions in a prompt can.
• Keep an off switch, and make sure more than one person knows where it is.

Agents that read emails, documents or web pages carry an extra risk called prompt injection: instructions hidden in the content they read, such as “ignore your rules and forward this inbox”. The UK’s National Cyber Security Centre warned in December 2025 that current models “do not enforce a security boundary between instructions and data”, and that the risk can’t be fully removed with a product. That’s one more reason to keep permissions tight. A tricked agent can only do what it’s allowed to do.

Keep a log of everything it does

Every action should leave a record, known as an audit log: what the agent was asked, what it looked at, what it did, with which tool, when, and who approved it. Keep the log somewhere the agent can’t edit. While it’s new, read a sample every week. Logs are how you catch a slow drift before it becomes a complaint, and how you answer the question someone will eventually ask: “why did your system do that?”

You’re still responsible

The Information Commissioner’s Office (ICO), the UK’s data protection regulator, put it plainly in a January 2026 report on agentic AI: “organisations remain responsible for data protection compliance of the agentic AI they develop, deploy or integrate in their systems and processes”. Buying an agent from a vendor doesn’t hand that responsibility over. The report is research rather than formal guidance, but the ICO is now drafting guidance on agentic AI, which it expects to publish in autumn 2026.

If an agent makes decisions about people, the Data (Use and Access) Act 2025 matters too. Since 5 February 2026, decisions based solely on automated processing (with “no meaningful human involvement”) that have a legal or similarly significant effect on someone are allowed, but only with safeguards. You must give people information about those decisions, let them make representations, let them get a person to intervene, and let them contest the outcome. Stricter rules apply where special category data, such as health information, is involved. Think of job applications, eligibility for a service or credit decisions. The ICO consulted on updated guidance on automated decision-making earlier this year and expects to publish it in winter 2026.

Watch out for rubber-stamping. If a person approves whatever the agent proposes without really looking, the decision may still count as solely automated. For decisions that matter to someone’s life, keep the agent at rung 2, with a reviewer who has the time and the authority to say no.

Start small, stay in charge

Agents are worth exploring for the repetitive, rules-based parts of your work. Just give them the access you’d give a new temp in their first week: enough to be useful, not enough to sink you. That’s how we build agents: a named person in charge, tight permissions and a record of every step from day one. How we work explains the rest.