When this guide is useful
Operations leaders planning an AI agent that reads business records or performs tasks.
- Staff repeatedly copy information between a small set of systems.
- The task has identifiable inputs, an owner and an observable completion state.
- Exceptions can be routed to a person before they affect customers.
- An existing automation cannot interpret the varied documents or requests involved.
Choose one job with a measurable finish
Describe the task in operational terms: review a new enquiry, find the matching customer record and draft a follow-up task. Specify what counts as complete and what information must never be guessed. A request such as 'manage our sales' is too broad to test because it contains many decisions with different consequences.
Map the current workflow before choosing a model. Note where staff check identity, resolve conflicting records and exercise judgement. If a deterministic rule or ordinary form can do the job reliably, use that for the relevant step. Reserve the model for interpretation that genuinely varies.
Separate reading, proposing and acting
Give the agent an account with the smallest useful access. Reading an order is different from editing its delivery address; preparing a credit note is different from issuing one. Validate each proposed tool action in application code against the current user, record ownership and permitted operation.
OpenAI's agent safety guidance identifies untrusted input and private-data leakage as relevant risks. Treat instructions inside emails, documents and search results as content to inspect, never as authority to expand permissions. For a payment, external message or sensitive change, display the actual proposed action and its destination to the authorised approver.
- Use separate tools for read and write operations.
- Restrict tool arguments to validated fields and allowed records.
- Set limits on steps, execution time and spend.
Test the difficult cases before widening access
Create a small evaluation set containing normal requests, incomplete records, conflicting customer names, unavailable systems and malicious instructions embedded in source material. Record the expected action or escalation for each case. Include an example where the correct result is to stop and request clarification.
Run the agent in a test environment, then in a supervised mode that only produces drafts. Inspect its actions as well as its final answer. A plausible summary can hide a failed lookup or an incorrect record selection. Expand access only when the evidence supports the specific workflow.
Design the operating model alongside the feature
Assign someone to review failures, maintain source data and approve changes to prompts or tools. Record a trace containing the relevant record references, action outcome and approval decision without collecting unnecessary sensitive content. Make the stop control available to the service owner.
Agree what happens when the model or an upstream application is unavailable. Queue work for review or return it to the established manual process. NIST's AI framework is voluntary risk-management guidance; adopting its ideas does not certify the agent or replace the organisation's own acceptance decision.
From diagnosis to delivery
How Britixo can help
Britixo can help turn a proposed agent into a defined software workflow. An agreed engagement can cover process discovery, API connections, permission checks, tool design, evaluation and a supervised pilot. We can also scope a review queue and monitoring so your team can see what the agent attempted and take over when needed. The deliverables should identify the supported task, excluded actions, expected operating costs and release criteria. Bring a representative request and the systems involved to a consultation so we can assess whether an agent, conventional automation or a combination fits the work.
Talk through your requirementsCommon questions
Does an agent need access to all our business systems?
No. Start with the few records and operations needed for one workflow. Add access only when a tested use case justifies it, and apply permissions outside the language model.
Can we start without automated write access?
Yes. A draft-only pilot can prepare updates and show supporting evidence for staff to approve. This is useful for measuring accuracy before enabling any live actions.
What should trigger human review?
Unclear identity, conflicting records, missing evidence, unsupported requests and actions outside the approved scope should trigger review. Set additional approval rules around the actual business consequences.
Sources and further reading
Use the original documentation to check current product terms, eligibility and technical details.
Published by Britixo on 29 October 2026. How these guides are prepared. Product availability and delivery scope are confirmed for your requirements.