Agentic AI, without the hype

Agentic AI is currently the loudest conversation in enterprise technology, which is precisely when a board needs the quiet version. Start by separating what actually changes from what does not. What changes is this: an agent acts. A model that drafts an answer for a human to use is a capability. A model that executes — updates the record, sends the message, moves the work to the next system — is an operational actor. It holds credentials. It has access. It produces side effects. Its failure mode is not a wrong answer in front of a sceptical human; it is a wrong action inside a system, at machine speed, possibly many times before anyone looks. That is a different risk profile, and it deserves the treatment any operational actor gets — not the treatment a chat window gets. Where do agents earn their place today? In work that is bounded, evaluable, and reversible. Triage and routing, where the agent's decision is checked by where the work lands. Drafting for review, where a human gate is the design, not a concession. Reconciliation and data hygiene, where correctness is verifiable against a source. Test generation and code review support, where the output is inspected by the pipeline that consumes it. The pattern is consistent: high volume, well-specified, and either checkable or undoable. Where do they not yet earn their place in a regulated enterprise? Open-ended authority over customer outcomes. Anything that moves money without a human gate. Irreversible actions in systems of record. Not because the models cannot sometimes do these things well, but because the failure cost is asymmetric and the evidence base for unsupervised reliability is not there — and a board asked to accept that risk should see evidence, not enthusiasm. The honest posture is a horizon, not a verdict: the boundary moves as evaluation methods and track records mature — but it moves on evidence. There is an engineering consequence too: agents concentrate the case for platform discipline. Sandboxed execution, scoped credentials issued per task, action logs a human can actually read, and kill switches that work at the speed the agent does — these are platform features, not use-case features. Building them once, underneath every agent, is the difference between an agent program and a collection of experiments. It is also where the data foundation shows: an agent acting on data nobody governs simply automates the consequences of that fact. The governance surface for agents is concrete, and existing frameworks already hold it. Approval boundaries: what an agent may do alone, what it may only propose. Permissions engineering: least privilege applies to an agent exactly as it applies to a service account — scoped access, rotated credentials, revocation that works. Decision records: what the agent did, on what input, under which version. Evaluation before authority and monitoring after it. ISO 42001 and the NIST AI RMF give this a management-system shape and a risk vocabulary; agents make the controls concrete rather than abstract. The strategy test is the same one every AI use case faces — does it matter at scale, can the data be trusted, can the organisation absorb the change — with a fourth test agents add: is the action reversible, or gated until the evidence says it can be trusted alone? A practical place to start: pick one bounded workflow and run an agent with a human approval gate. Measure quality, cost, and how often the human overrides. Expand the agent's authority only as the override rate earns it. Authority granted on evidence is a capability; authority granted on excitement is an incident report with a delay on it.