Engineering Agentic AI

Abstract

Agentic artificial intelligence (AI) represents an important new phase in the evolution of enterprise AI, in which large language models (LLMs) are integrated with planning, memory, tool use, workflow orchestration, and autonomous action. Unlike traditional rule-based robotic process automation (RPA) and reactive conversational systems, agentic AI systems can interpret objectives, decompose tasks, interact with external tools and enterprise data, evaluate outcomes, and adapt their behaviour within defined operational constraints. This development has generated substantial interest because it potentially extends automation beyond predictable, deterministic processes into workflows characterised by ambiguity, exceptions, and unstructured information. At the same time, the transition from generative AI to agentic AI introduces new challenges relating to reliability, security, governance, accountability, and organisational control.

This paper presents a technology-focused critical review of agentic AI, synthesising recent academic research and enterprise-oriented literature. It examines the architecture of LLM-based agents, distinguishes agentic systems from conventional automation and generative AI, and evaluates emerging applications across customer service, software engineering, supply-chain management, data analysis, information technology operations, and human resources. The analysis argues that the principal technological opportunity lies not in autonomous text generation, but in the orchestration of reasoning, tools, enterprise knowledge, and business processes. However, current evidence indicates that agentic systems remain considerably less reliable than their apparent autonomy suggests, particularly on long-horizon tasks and in environments containing adversarial or untrusted information. Security risks such as indirect prompt injection become significantly more consequential when AI systems possess permissions to act on external systems.

The paper argues that agentic AI should be understood as a new enterprise automation architecture rather than merely a more advanced chatbot. Successful deployment depends on high-quality data, structured enterprise context, well-defined interfaces, least-privilege access, human oversight, continuous evaluation, and adaptive governance. Although enterprise adoption is accelerating, most organisations remain in experimentation or pilot stages. A phased implementation strategy based on bounded, high-value use cases is therefore more appropriate than unrestricted autonomy. The paper concludes that agentic AI has substantial potential to reshape enterprise workflows, but its near-term value will depend less on maximising autonomy than on engineering reliable, secure, and governable systems that effectively combine human judgement with machine-scale execution.

Keywords: agentic AI; artificial intelligence agents; large language models; enterprise AI; automation architecture; AI governance; autonomous systems; human–AI collaboration; process automation

1. Introduction

Artificial intelligence has undergone a significant technological transition since the emergence of large language models (LLMs) and generative AI systems. Earlier enterprise AI applications were commonly designed around relatively narrow predictive or classification tasks, while robotic process automation (RPA) focused on executing predefined rules against structured digital workflows. Generative AI expanded the interaction between humans and machines by allowing systems to generate natural-language responses, code, images and other forms of content. The emerging concept of agentic AI represents a further development in which AI systems are given the ability not merely to generate outputs but to pursue goals through sequences of actions.

Recent research characterises LLM-based agents through capabilities including reasoning, planning, memory, tool use and interaction with external environments (Wang et al., 2024; Li et al., 2024). Plaat et al. (2025), for example, organise agentic LLM research around three closely related capabilities: reasoning, acting and interacting. This distinction is significant because the output of an agent is not necessarily a textual response. Instead, an agent may retrieve information, call an application programming interface (API), execute software, query a database, modify a document, initiate a workflow or request human intervention.

The commercial interest in this technology is considerable. Industry reports increasingly describe a movement from generative AI assistants towards systems capable of performing complete business processes. McKinsey's 2025 global survey reported that 62 per cent of respondents were experimenting with AI agents and 23 per cent reported scaling an agentic AI system somewhere within their organisation, although most implementations remained concentrated in only one or two functions (McKinsey & Company, 2025). The 2026 Stanford AI Index (2026) similarly reports that organisational AI adoption has continued to rise, while deployment of AI agents remains relatively early and is still in the single digits across most individual business functions.

This emerging technology is particularly relevant to enterprise automation. The original industry material from Lufthansa Industry Solutions (LHIND) presents agentic AI as an evolution from chatbots and traditional automation towards systems capable of planning, decision-making and action. LHIND identifies applications including customer service, travel booking, supply-chain reordering, sales, software development, data analysis and IT operations (Lufthansa Industry Solutions, 2026).

Nevertheless, the concept requires critical examination. The term agentic AI has no universally accepted technical definition, and commercial descriptions can imply a level of autonomy and reliability that current research does not necessarily support. Furthermore, increasing autonomy changes the risk profile of AI. A hallucinating chatbot may provide an incorrect answer; an agent with access to enterprise systems may transform the same error into an incorrect purchase, deletion, financial transaction or disclosure of confidential information.

This paper therefore examines agentic AI primarily as a technology and enterprise architecture. It addresses five questions:

1. What constitutes agentic AI and how does it differ from conventional automation and generative AI?

2. What technical components enable agentic behaviour?

3. Which enterprise applications are most suitable for agentic AI?

4. What technological, security and governance risks constrain deployment?

5. What implementation approach can organisations use to capture value while controlling risk?

The central argument is that agentic AI should not be understood simply as an autonomous version of generative AI. Rather, it represents an architectural combination of foundation models, tools, memory, planning mechanisms, data access and workflow orchestration. Its enterprise value therefore depends as much on integration and governance as on model intelligence.

2. From Rule-Based Automation to Agentic Artificial Intelligence

Agentic artificial intelligence (AI) is best understood as the latest stage in the evolution of enterprise automation rather than as a sudden technological rupture. Enterprise automation has developed progressively from deterministic workflow management and business process automation, through robotic process automation (RPA), machine-learning-based decision support, and conversational AI, to generative AI systems capable of understanding and producing natural language (Ng et al., 2021; van der Aalst, Bichler and Heinzl, 2018). Agentic AI builds on these earlier developments by integrating large language models (LLMs) with capabilities such as planning, memory, tool use, environmental interaction, and workflow orchestration (Wang et al., 2024; Plaat et al., 2025). Its defining feature is therefore not merely the generation of sophisticated text, but the ability to reason about objectives, select appropriate actions, and execute tasks across digital environments in pursuit of a specified goal (Russell and Norvig, 2021; Huang et al., 2024).

This distinction is significant because modern enterprise systems rarely rely on a single automation technology. Contemporary organisational processes often combine business process management (BPM), RPA, application programming interfaces (APIs), machine-learning models, retrieval-augmented generation (RAG), deterministic business rules, and human oversight within the same workflow (Lewis et al., 2020; Ng et al., 2021). Rather than replacing existing automation technologies, agentic AI functions as an additional intelligence and coordination layer capable of operating across heterogeneous enterprise systems and orchestrating interactions between multiple software components and decision mechanisms (Li et al., 2024; Computerwoche, 2025).

The following sections examine this technological progression and distinguish between deterministic automation, conversational generative AI, and agentic AI systems.

2.1 Rule-Based Automation and Robotic Process Automation

The foundations of enterprise automation predate modern AI by several decades. Business process management systems, workflow engines, and enterprise software platforms were designed to formalise organisational activities into structured sequences of tasks, decisions, and transactions that could be executed consistently and efficiently (van der Aalst, Bichler and Heinzl, 2018). The underlying assumption of these systems is that a business process can be represented with sufficient precision for a computer system to perform some or all of its activities without continuous human intervention.

Rule-based automation is particularly effective when a process is stable, well understood, and governed by explicit decision logic. For example, an invoice may be approved automatically when the supplier is recognised, a corresponding purchase order exists, the invoice value falls below a predefined threshold, and the required budget is available. Because each condition is encoded as a deterministic rule, the resulting decision is predictable, consistent, and readily auditable (Santos, Pereira and Vasconcelos, 2020).

Robotic process automation extends this principle by enabling software robots to imitate routine human interactions with digital systems, including entering data, transferring information between applications, generating reports, and processing structured documents (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020). RPA has become widely adopted because it can automate repetitive administrative tasks without requiring extensive modifications to existing enterprise systems, making it particularly attractive for organisations with legacy software environments (El-Gharib and Amyot, 2022).

Despite these advantages, rule-based automation and RPA remain fundamentally deterministic technologies. They execute predefined instructions and cannot autonomously interpret ambiguous situations, revise objectives, or formulate novel strategies when conditions change (Ng et al., 2021). Their effectiveness therefore depends on processes being highly structured and predictable, which limits their applicability in knowledge-intensive and dynamic business environments. These limitations have driven the development of more adaptive forms of intelligent automation that combine data-driven learning, natural-language understanding, and increasingly autonomous decision-making capabilities (Ng et al., 2021; Wang et al., 2024).

Robotic process automation developed as a complementary approach to conventional workflow and enterprise application integration. RPA software robots interact with existing applications through user interfaces and can reproduce repetitive actions such as opening applications, copying data between systems, validating fields and initiating transactions. Van der Aalst, Bichler and Heinzl (2018) characterise RPA as part of a broader question concerning which organisational activities should be automated and which should remain the responsibility of human workers. RPA emerged partly because organisations frequently faced substantial costs and technical difficulties when attempting to integrate legacy applications through conventional back-end interfaces.

A systematic review by Wewerka and Reichert (2020) similarly characterises RPA as the automation of routine, rule-based processes and identifies a substantial body of research examining process identification, implementation and assessment. Their review demonstrates that RPA should not be understood simply as a software product category. Rather, effective RPA encompasses the identification of suitable processes, automation design, implementation, monitoring and governance. This lifecycle perspective is important when comparing RPA with agentic AI because the suitability of an automation technology depends substantially on the characteristics of the process being automated.

RPA is consequently particularly well suited to processes exhibiting a high degree of repetition, structured inputs, stable interfaces and clearly specified decision logic. Santos, Pereira and Vasconcelos (2020) emphasise that process selection is a critical stage in RPA implementation because inappropriate process selection can undermine expected organisational benefits. Their end-to-end perspective highlights that successful RPA requires more than technical implementation; organisations must understand the process itself, identify suitable automation opportunities and evaluate the wider organisational context.

This creates an important distinction between process automation and process adaptability. A deterministic automation system can execute a complex workflow if the possible states and transitions have been sufficiently specified. However, its effectiveness decreases when the process contains frequent exceptions, ambiguous inputs, unstructured information or changing conditions. If an invoice arrives in an unexpected format, if a supplier's response does not conform to a predefined template, or if an employee makes an unusual request, a conventional automation system may be unable to determine what should happen next without additional rules or human intervention.

The limitation is therefore not that RPA is incapable of automating complex processes. Rather, the complexity must generally be translated into explicit rules, decision trees or predefined workflow states. As process variability increases, maintaining these rules can become increasingly difficult. This issue has been identified within the broader literature on intelligent automation, which examines the movement towards combining conventional automation with AI techniques to support more adaptive and context-sensitive decision-making (Ng et al., 2021).

Process mining further illustrates the evolution of the automation landscape. Rather than beginning with assumptions about how a process operates, process-mining techniques analyse event logs to reconstruct and evaluate actual process behaviour. El-Gharib and Amyot (2022) demonstrate that process mining can support RPA by identifying routines and potential automation opportunities, while also identifying challenges associated with event-log preprocessing and the wider RPA lifecycle. Process mining and RPA can consequently be viewed as complementary technologies: process mining helps organisations understand how processes actually operate, while RPA provides mechanisms for automating specified tasks.

Agentic AI extends traditional automation by introducing the ability to determine appropriate actions in situations where the next step is not fully specified in advance. Unlike rule-based systems, which execute predefined instructions, agentic systems can interpret unstructured requests, formulate plans, select appropriate tools, and coordinate actions across multiple software environments (Wang et al., 2024; Huang et al., 2024). However, this additional capability does not imply that deterministic automation becomes obsolete. In enterprise environments, the two approaches are more accurately viewed as complementary technologies that operate at different layers of the automation architecture (Ng et al., 2021; Computerwoche, 2025).

A useful distinction can be drawn between interpretive intelligence and transactional execution. An LLM-based agent may analyse a natural-language request, identify the relevant business process, determine which information is required, retrieve enterprise data, and select an appropriate software tool or API. Deterministic systems then execute the underlying transaction according to validated business rules and organisational controls (Schick et al., 2023; Wang et al., 2024). In this architecture, the agent contributes contextual reasoning and orchestration, while established enterprise systems retain responsibility for operations requiring precision, consistency, and auditability.

Consider an employee requesting that the organisation arrange travel for a client meeting in London. A conventional RPA workflow would typically require structured inputs such as destination, travel dates, employee identity, and approval status before execution could begin. An agentic system could instead interpret the natural-language request, consult the employee’s calendar and the corporate travel policy, identify suitable travel dates, search authorised booking platforms, and prepare a proposed itinerary. The final reservation could still be executed through a deterministic booking service or enterprise API, with mandatory human approval when expenditure exceeds predefined thresholds (van der Aalst, Bichler and Heinzl, 2018; Santos, Pereira and Vasconcelos, 2020). This illustrates a central architectural principle: agentic AI augments deterministic automation by providing an adaptive decision and orchestration layer around it rather than replacing it.

The distinction becomes particularly important in high-consequence business processes such as payroll, financial reporting, taxation, or regulatory compliance. Although an LLM may generate a plausible payroll calculation, enterprise organisations require calculations that are legally compliant, reproducible, and fully auditable. A more appropriate architecture is one in which the agent interprets the employee’s request, retrieves the relevant payroll data, and invokes a validated payroll service whose deterministic business logic performs the calculation (ISO, 2023; European Union, 2024). The agent therefore functions primarily as a coordinator and interface, while authoritative enterprise systems remain responsible for legally and financially binding transactions.

This layered architecture can be conceptualised as a sequence of coordinated activities. A human establishes an objective, the agent interprets the request and formulates a plan, relevant enterprise information is retrieved, appropriate tools or APIs are selected, deterministic systems execute authorised transactions, and the resulting information is returned to the agent for evaluation. Depending on confidence, policy constraints, and operational risk, the agent may continue autonomously or escalate the process to a human decision-maker (Yao et al., 2023; Wang et al., 2024). Such agent workflows are increasingly recognised as a defining characteristic of autonomous LLM-based systems and multi-agent architectures (Li et al., 2024; Plaat et al., 2025).

This perspective also challenges simplistic narratives suggesting that enterprise automation will be replaced entirely by autonomous AI systems. Organisations have invested heavily in systems of record, workflow engines, RPA bots, and business-rule frameworks that embed decades of operational knowledge, transaction controls, and regulatory requirements (Wewerka and Reichert, 2020; El-Gharib and Amyot, 2022). Replacing these systems wholesale with probabilistic language models would often reduce reliability, traceability, and governance rather than improve them. The more plausible trajectory is the emergence of an AI-enabled automation stack, in which LLM-based agents operate at the interpretive and orchestration level while deterministic technologies continue to perform transactions that require accuracy, consistency, and auditability (Ng et al., 2021; McKinsey & Company, 2025).

Agentic AI is therefore more appropriately conceptualised as an intelligent orchestration layer operating above and across existing enterprise technologies. This interpretation provides a more useful framework for evaluating organisational adoption. Rather than asking whether agentic AI can replace RPA, organisations should determine which activities require deterministic execution, which require contextual interpretation, and which decisions can safely be delegated to AI systems within an appropriate governance and risk-management framework (ISO, 2023; European Union, 2024; Plaat et al., 2025).

2.2 From chatbots to conversational generative AI

A second important point of comparison is conversational AI. Chatbots and conversational agents have existed for decades, but advances in natural language processing and machine learning have substantially increased their ability to interpret user input and generate contextually appropriate responses.

Earlier business chatbots were commonly designed around predefined intents, decision trees and scripted responses. Their effectiveness was consequently constrained by the range of scenarios anticipated during system design. Nevertheless, systematic research into conversational agents has demonstrated their potential across areas including commerce, customer service and other business domains, particularly as machine-learning techniques improved natural-language understanding and response generation (Adamopoulou and Moussiades, 2020).

The emergence of LLMs has substantially expanded the flexibility of conversational interfaces. Rather than mapping each user utterance to a predefined response, an LLM can interpret a much wider range of natural-language requests and generate novel responses based on patterns learned from large-scale training data.

The basic architecture of a conventional conversational generative-AI system can therefore be represented as:

User input → model processing → generated response

The principal output is information: an answer, explanation, summary, recommendation, translation, piece of code or another form of generated content.

Retrieval-augmented generation extends this architecture by allowing a model to retrieve information from an external knowledge source before generating its response. Lewis et al. (2020) demonstrated that combining parametric model knowledge with non-parametric external memory can improve performance on knowledge-intensive tasks and provide a mechanism for accessing information that is not necessarily encoded within model parameters. RAG is particularly relevant to enterprise AI because organisations generally require models to work with information that is proprietary, current or domain-specific. An enterprise chatbot can therefore retrieve information from internal policies, product catalogues, technical documentation or customer records before generating an answer.

However, RAG does not by itself make a system agentic. A system may retrieve relevant information and produce a response while remaining fundamentally reactive. The user asks a question; the system retrieves information; the system generates an answer. The system does not necessarily determine that it should pursue a goal through a sequence of actions.

Agentic AI introduces an additional dimension: agency.

A simplified agentic loop can be expressed as:

Goal → context acquisition → reasoning and planning → tool selection → action → observation → evaluation → next action

The difference is therefore architectural rather than merely linguistic.

An LLM chatbot might respond to a customer whose flight has been cancelled by explaining the available options. An agentic system could potentially interpret the same request, retrieve the traveller's booking, identify alternative flights, check applicable travel policies, compare options, request approval where necessary and execute an authorised rebooking. The distinction lies in whether the system merely describes an action or has the authorised capability to select and perform the action.

Wang et al. (2024) provide a useful theoretical foundation for this distinction. Their survey of LLM-based autonomous agents identifies components including profiling, memory, planning and action, presenting agents as systems that extend LLM capabilities through interaction with external environments. The significance of this architecture is that the LLM is no longer operating solely as a generator of text. It becomes one component within a wider computational system capable of perceiving information, maintaining context, planning actions and interacting with external resources.

Planning is particularly important because it enables the decomposition of a high-level objective into intermediate tasks. Huang et al. (2024) identify task decomposition, plan selection, external modules, reflection and memory as important dimensions of planning in LLM-based agents. Planning should therefore not be understood as a single technical capability but as a collection of mechanisms through which an agent can transform an objective into a sequence of potentially executable actions.

2.3 From generation to reasoning, acting and tool use

One of the most important developments underlying agentic AI is the integration of reasoning with action. The integration of reasoning, tool use and external action transforms AI from a purely analytical capability into an operational capability capable of participating directly in enterprise workflows (Yao et al., 2023; Schick et al., 2023).

Yao et al. (2023) introduced the ReAct framework, which interleaves reasoning and acting so that a language model can use actions to gather additional information and update its approach as it progresses through a task. Rather than requiring a complete plan before acting, the system can alternate between reasoning about the problem and interacting with an external environment. This approach demonstrated the value of combining reasoning with environmental interaction across question-answering and interactive decision-making tasks.

The importance of this architecture lies in the feedback loop it creates. A purely generative model produces an answer based primarily on its internal representation and the information supplied in its context. An agent can instead take an action, observe the result and use that result to inform subsequent decisions.

Consider a customer-service scenario in which a user requests cancellation of an order. An agent might first reason that it needs to determine whether the order remains cancellable. It can then query the order-management system, observe that the order has already shipped, retrieve the applicable returns policy and determine that a return rather than cancellation is appropriate. It can subsequently initiate a return request. The system is therefore not simply generating a response; it is interacting with an external environment and adapting its subsequent actions according to the information it receives.

Tool use is consequently a central component of agentic architecture. Schick et al. (2023), through Toolformer, demonstrated that language models can learn to determine which external APIs to call, when to call them, what arguments to provide and how to incorporate the resulting information into subsequent generation. Their research is significant because external tools can compensate for limitations of language models in areas such as arithmetic, factual retrieval and specialised computation.

The enterprise implications of agentic AI are substantial because organisational intelligence increasingly depends not only on the capabilities of a language model, but also on the ecosystem of tools and information sources to which it is connected. Rather than requiring an LLM to contain all the knowledge necessary to complete a business process, agentic systems can access specialised enterprise resources through APIs and software integrations. Customer relationship management (CRM) systems can provide customer records, enterprise resource planning (ERP) systems can supply inventory and procurement data, retrieval systems can locate internal policies and documentation, calendar services can schedule meetings, and authorised financial services can execute transactions. The agent’s primary function is therefore to determine how these heterogeneous capabilities should be combined and sequenced in order to achieve a specified organisational objective (Schick et al., 2023; Lewis et al., 2020; Wang et al., 2024).

This architecture highlights an important distinction between model capability and system capability. A language model may possess incomplete or outdated knowledge, yet an agentic system built around that model can become substantially more capable through access to enterprise data, external tools, and execution services. Conversely, even a highly capable foundation model may remain operationally limited if it lacks access to organisational information, authorised software interfaces, or workflow orchestration mechanisms (Schick et al., 2023; Wang et al., 2024). From an enterprise perspective, competitive advantage is therefore increasingly determined by the integration of AI models with organisational systems rather than by model performance alone (McKinsey & Company, 2025; Microsoft, 2025).

This represents a significant shift in the character of enterprise AI. Generative AI primarily produces information, text, code, or other forms of content, whereas agentic AI employs model-based reasoning to select, sequence, and execute actions within an operational environment (Yao et al., 2023; Wang et al., 2024). The addition of planning, tool selection, memory, and environmental feedback transforms the model from a content generator into a component of a broader decision and execution system (Huang et al., 2024; Plaat et al., 2025).

The distinction should not, however, be interpreted as absolute. Many commercial systems marketed as AI agents are better characterised as LLM-enhanced workflows that combine language-model interactions with deterministic orchestration. For example, a customer-service application may use an LLM to classify a request before triggering a predefined workflow implemented through RPA or BPM software. Such systems exhibit certain agentic properties, including contextual interpretation and limited action selection, but they do not necessarily perform autonomous planning or adaptive decision-making across extended tasks (Computerwoche, 2025; Ng et al., 2021). Consequently, the term agentic is more appropriately understood as describing a spectrum of system capabilities rather than a binary technological category.

2.4 Agentic AI as a Spectrum Rather Than a Binary Category

Although the concept of agentic AI has become increasingly prominent in both academic research and enterprise strategy, it does not refer to a single standardised architecture. Systems described as agents vary considerably in their degree of autonomy, planning capability, memory, tool access, environmental interaction, and human supervision (Wang et al., 2024; Plaat et al., 2025). Treating agentic AI as a spectrum rather than a binary classification provides a more accurate framework for analysing enterprise implementations and comparing different automation architectures.

At one end of the spectrum are deterministic workflows that incorporate limited AI functionality. An organisation may employ an LLM to classify incoming emails, extract structured information from documents, or route customer requests, after which a predefined RPA or BPM workflow executes a fixed sequence of actions. Although AI contributes to the process, the overall system remains largely deterministic because subsequent decisions are governed by explicit business rules (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020).

A second category consists of LLM-powered assistants that can retrieve information and invoke a restricted set of enterprise tools. These systems demonstrate stronger agentic characteristics because they can select actions based on context and interact with external resources, but their behaviour is typically constrained within well-defined operational boundaries (Lewis et al., 2020; Schick et al., 2023).

A third category comprises systems capable of dynamically selecting multiple tools, decomposing complex tasks into subtasks, and adapting their behaviour in response to environmental feedback. Such systems exhibit a greater degree of operational autonomy because they determine not only what information is required but also which sequence of actions should be executed in order to accomplish a goal (Yao et al., 2023; Huang et al., 2024).

At the most autonomous end of the spectrum are systems capable of pursuing relatively open-ended objectives over extended periods with limited human intervention, potentially coordinating multiple specialised agents and interacting with changing environments. Multi-agent architectures, collaborative agent systems, and long-horizon autonomous software agents represent current research directions in this area (Li et al., 2024; Wooldridge, 2009; Wadhwa et al., 2024). However, recent evaluations suggest that performance on complex long-duration tasks remains constrained and that reliable autonomous operation across enterprise-scale processes continues to present significant technical challenges (Deng et al., 2025; Yehudai et al., 2025).

Viewing agentic AI as a continuum has important practical implications. Most enterprise deployments today occupy intermediate positions on this spectrum, combining deterministic automation, enterprise software, retrieval mechanisms, and LLM-based reasoning within carefully governed workflows rather than deploying fully autonomous agents (McKinsey & Company, 2025; Microsoft, 2025). This perspective provides a more realistic basis for evaluating organisational adoption by focusing on the appropriate degree of autonomy for each business process rather than assuming a binary distinction between traditional automation and autonomous AI systems.

The boundaries between these categories are necessarily fluid. Li et al. (2024), in their survey of LLM-based multi-agent systems, emphasise the importance of workflow, infrastructure and communication, demonstrating that agentic behaviour emerges from the interaction between models and the wider technical architecture rather than from the language model alone.

This observation has an important implication for enterprise technology strategy. Organisations should avoid asking whether a particular application is simply “AI” or “agentic AI”. A more useful question is: how much autonomy should this system have, and which decisions should remain deterministic or human-controlled?

For example, an organisation may allow an agent to retrieve customer information and prepare a recommended response automatically, while requiring human approval before the agent issues a refund above a defined monetary threshold. Similarly, an IT operations agent might autonomously restart a failed non-critical service but require explicit human authorisation before changing production infrastructure.

Agentic architecture is therefore better understood through three related dimensions: autonomy, authority and adaptability. Autonomy concerns how independently a system can determine and execute actions. Authority concerns which systems, data and transactions the agent is permitted to access. Adaptability concerns how effectively it can respond when circumstances differ from the predefined workflow.

These dimensions should not necessarily increase together. An organisation may design an agent with relatively high adaptability but tightly restricted authority. Conversely, an agent may possess extensive system permissions while operating within a highly constrained workflow. This distinction becomes particularly important when considering security and governance. The ability to act does not imply that an agent should be permitted to act without restriction.

2.5 The convergence of automation and agentic AI

The preceding discussion indicates that the relationship between RPA, generative AI and agentic AI is more appropriately understood as one of convergence rather than replacement. Intelligent automation research has increasingly emphasised the integration of complementary technologies rather than the substitution of one automation paradigm for another (Ng et al., 2021; Wewerka and Reichert, 2020). RPA remains effective for executing structured and repetitive tasks, while BPM provides process structure, governance and control. APIs enable controlled access to enterprise applications, retrieval-augmented generation (RAG) provides access to organisational knowledge, and large language models (LLMs) support natural-language interpretation and generation (Lewis et al., 2020). Agentic systems extend these capabilities by coordinating tools, information sources and actions in pursuit of an objective (Wang et al., 2024; Plaat et al., 2025).

The resulting architecture can therefore be conceptualised as a layered automation system. A human establishes an objective; an agent interprets that objective and develops an appropriate plan; enterprise knowledge and memory provide contextual information; tools and APIs provide access to operational capabilities; and deterministic enterprise systems execute authorised transactions. The resulting information can then be returned to the agent for evaluation, allowing the system either to continue with subsequent actions or to escalate the process to a human decision-maker. Research on LLM-based agents highlights precisely these capabilities of planning, tool use, environmental interaction and iterative action (Huang et al., 2024; Yao et al., 2023; Schick et al., 2023).

This model is more technologically plausible than the proposition that agentic AI will simply replace RPA or conventional enterprise software. Existing enterprise systems contain substantial amounts of embedded business logic, transaction controls, organisational knowledge and compliance requirements. RPA itself is often deployed precisely because existing systems can be automated without requiring their underlying applications to be replaced (van der Aalst, Bichler and Heinzl, 2018; Santos, Pereira and Vasconcelos, 2020). Similarly, intelligent automation can be understood as the combination of automation technologies with AI capabilities to extend the range of processes that can be automated (Ng et al., 2021).

The more plausible development is therefore an AI-enabled automation stack, in which LLM-based agents operate primarily at the interpretive, planning and orchestration levels, while deterministic systems remain responsible for transactions where precision, consistency and auditability are essential. This division of responsibilities is particularly important because language models remain probabilistic systems and may produce incorrect or inappropriate outputs. Agentic architectures consequently benefit from restricting critical actions to validated tools and enterprise services rather than requiring the language model itself to perform every operation.

This convergence also helps explain the growing enterprise interest in agentic AI. Its potential value lies not simply in enabling an LLM to answer questions more naturally, but in allowing an AI system to connect previously separate stages of a business process. An agent can potentially interpret a human request, retrieve relevant organisational knowledge, determine which actions are required, select appropriate tools, interact with enterprise applications and evaluate the resulting outcomes. Tool-use research demonstrates how language models can be extended beyond text generation by enabling them to interact with external functions and information sources (Schick et al., 2023), while RAG provides a mechanism through which models can access information that is not contained within their original training data (Lewis et al., 2020).

This represents a potential change in the unit of automation. Traditional RPA primarily automates individual tasks or sequences of repetitive interactions with software applications (van der Aalst, Bichler and Heinzl, 2018). BPM coordinates processes, while generative AI automates aspects of knowledge production, communication and interaction (Noy and Zhang, 2023; Brynjolfsson, Li and Raymond, 2023). Agentic AI potentially extends automation to an objective-oriented workflow, in which the system can determine and execute some of the intermediate actions required to move from an initial objective towards an outcome (Wang et al., 2024; Plaat et al., 2025).

However, this greater flexibility should not be equated with unrestricted autonomy. The appropriate degree of autonomy depends on factors including the nature of the process, the reliability of available information and tools, the potential consequences of error and the degree of human oversight required. Research into the evaluation and security of LLM-based agents highlights that autonomous systems introduce additional challenges because agents can interact with external environments, use tools and operate through multiple steps (Yehudai et al., 2025; Debenedetti et al., 2024). Consequently, enterprise adoption requires autonomy to be bounded by appropriate technical and organisational controls.

2.6 Implications for enterprise automation

The transition towards agentic AI therefore represents a shift in how organisations conceptualise automation. A traditional RPA specification might state that when an invoice arrives, the system should extract the invoice number and amount, enter the information into the ERP system and submit the invoice for approval. The workflow is defined in advance, and the automation executes a predetermined sequence of actions. This reflects the fundamental characteristics of RPA, which is particularly suitable for structured, repetitive and rules-based processes (Wewerka and Reichert, 2020; El-Gharib and Amyot, 2022).

An agentic specification could instead state that incoming supplier invoices should be processed in accordance with organisational policy. The system would then need to interpret the document, identify the supplier, retrieve the relevant purchase order, obtain applicable policy information, assess discrepancies and determine whether the invoice can proceed automatically or requires human intervention. The agent therefore contributes not only to execution but also to the interpretation and sequencing of the activities required to achieve the desired outcome.

The second formulation provides substantially greater flexibility, but it also delegates more intermediate decision-making to the AI system. This represents both the principal opportunity and a central risk of agentic AI. The organisation can provide fewer explicit instructions because the system is capable of interpreting context, decomposing objectives and selecting actions. At the same time, the system assumes greater responsibility for determining how the objective should be achieved (Huang et al., 2024; Wang et al., 2024). The challenge consequently shifts from automating a clearly specified procedure towards governing a system that has some discretion over the procedure it follows.

The central distinction can therefore be expressed as follows:

Traditional automation primarily delegates execution. Agentic AI can additionally delegate elements of planning, action selection and intermediate decision-making.

This distinction has significant implications for enterprise architecture and governance. As greater decision-making authority is delegated to AI systems, organisations must move beyond assessing whether an automated process produces the desired outcome under normal operating conditions. They must also consider how the system behaves when information is incomplete, instructions are ambiguous, tools fail, circumstances change or malicious inputs attempt to influence its behaviour. Research on prompt injection and agent security demonstrates that tool-using agents introduce attack surfaces that are less prominent in conventional, purely informational LLM applications (Debenedetti et al., 2024). Emerging guidance on agentic application security similarly emphasises the need to address risks associated with autonomous actions, excessive agency and interactions with external systems (OWASP GenAI Security Project, 2025).

The governance implications are also consistent with broader developments in AI management and regulation. Organisations deploying AI systems need mechanisms for risk management, accountability, monitoring and human oversight rather than relying solely on model performance. ISO/IEC 42001 provides a management-system framework for organisations seeking to establish structured governance for AI, while the European Union's Artificial Intelligence Act establishes a risk-based regulatory framework for AI systems and associated organisational obligations (ISO, 2023; European Union, 2024). These developments reinforce the principle that increased AI capability should be accompanied by corresponding governance and control mechanisms.

Agentic AI should therefore be evaluated not simply according to whether it can complete a task, but according to whether it can complete that task reliably, securely, transparently and within clearly defined boundaries. Evaluation becomes particularly important as systems move from short, predictable tasks towards longer-horizon activities involving multiple tools and intermediate decisions. Recent research on agent evaluation and long-horizon task performance illustrates that successful completion of individual actions does not necessarily demonstrate reliable performance across an extended workflow (Yehudai et al., 2025; Deng et al., 2025).

This provides the conceptual foundation for the remainder of this paper. The relevant question is therefore not simply whether agentic AI is more capable than previous automation technologies, but under which conditions its greater adaptability and autonomy generate genuine enterprise value. The subsequent analysis can consequently examine the architecture of agentic systems, their practical enterprise applications, the benefits and limitations associated with deployment, and the governance and cybersecurity mechanisms required when increasing levels of decision-making authority are delegated to AI systems.

3. Defining Agentic AI

3.1 A working definition

Despite the rapid growth of academic and commercial interest, agentic artificial intelligence (AI) does not yet possess a universally accepted definition. The term is used across several overlapping research traditions, including autonomous agents, intelligent systems, planning, reinforcement learning, human-computer interaction, multi-agent systems, and, more recently, large language model (LLM)-based systems (Wang et al., 2024; Plaat et al., 2025). The absence of a stable definition is therefore not merely a question of terminology. It reflects the fact that contemporary agentic AI combines long-established concepts of computational agency with the flexible language, reasoning, and interaction capabilities of modern foundation models.

The concept of an artificial agent predates generative AI by several decades. Russell and Norvig (2021) define an agent as a system that perceives its environment through sensors and acts upon that environment through actuators. From this perspective, agency concerns the relationship between a system, its environment, and the actions available to it. Wooldridge (2009) similarly characterises intelligent agents as autonomous systems capable of flexible and adaptive behaviour within an environment. These foundational definitions demonstrate that agency is not synonymous with artificial general intelligence, machine learning, or language generation. Rather, agency concerns the capacity of a computational system to perceive conditions, make decisions, and perform actions in pursuit of specified objectives.

Contemporary agentic AI extends this classical conception by using foundation models, particularly LLMs, as a reasoning and interaction mechanism. Such systems can interpret natural-language goals, formulate intermediate plans, retrieve external information, invoke tools, maintain state across multiple steps, and adapt subsequent actions based on environmental feedback (Wang et al., 2024; Huang et al., 2024). Wang et al. (2024) describe LLM-based autonomous agents as systems incorporating components such as profiling, memory, planning, and action, while Plaat et al. (2025) conceptualise agentic LLMs around the complementary capabilities of reasoning, acting, and interacting. These perspectives suggest that the language model is only one component of an agentic system rather than the agent itself.

For the purposes of this paper, agentic AI is defined as an AI system that uses a foundation model or other reasoning-capable model to pursue a specified objective through dynamically selected and potentially iterative actions, using external tools, information, memory, and environmental feedback while operating within defined technical, organisational, and governance constraints.

This definition deliberately emphasises the system rather than the underlying model. A language model can generate text without being an agent, just as a deterministic enterprise workflow can execute actions without exhibiting intelligent behaviour. Agentic AI emerges from the combination of model-based reasoning with mechanisms that allow the system to determine and execute actions within an environment.

Five characteristics are central to this definition: goal orientation, planning, tool use, state and memory, and feedback-driven adaptation.

Goal orientation

The first characteristic is goal orientation. Conventional generative-AI systems are typically prompted to produce a discrete output such as a summary, explanation, translation, or piece of code. An agent, by contrast, is provided with an objective that may require multiple intermediate steps before an appropriate outcome can be achieved.

For example, the instruction “summarise this report” primarily involves content generation. The instruction “analyse the report, identify the three most significant operational risks, compare them with the previous quarter, and prepare a management briefing” is more naturally interpreted as an agentic task because it may require information retrieval, comparison, analysis, synthesis, and document generation. Goal orientation therefore changes the unit of interaction from prompt-response to objective-outcome.

In enterprise environments, goals may be supplied by human users, business processes, or events detected by other systems. However, organisational objectives should normally be bounded by policies, permissions, and governance rules. An enterprise agent should not be free to determine unrestricted objectives simply because it possesses the technical capability to do so; rather, the organisation defines both the purpose and the operational boundaries within which the agent functions (ISO, 2023; European Union, 2024).

Planning

The second characteristic is planning. Agentic systems must be capable, to some degree, of transforming an objective into a sequence of intermediate actions.

Planning has long been a central topic in artificial intelligence research, but LLMs provide a flexible natural-language mechanism for representing goals, subtasks, and potential action sequences. Huang et al. (2024) identify task decomposition, plan generation, plan selection, reflection, memory, and the use of external modules as important components of LLM-based planning architectures.

Consider a customer-service agent receiving a request to cancel an order. Rather than treating the request as a single operation, the system may need to identify the customer, retrieve the relevant order, determine its fulfilment status, consult the applicable cancellation policy, and decide whether cancellation, modification, or a return process is appropriate. Planning therefore introduces an important distinction between knowing what to do and determining how to do it.

However, planning should not be equated with perfect reasoning. LLM-based agents may generate plausible but inappropriate plans, omit necessary steps, or select unsuitable tools. Planning is therefore both a capability and a potential source of risk, reinforcing the need for validation, monitoring, and bounded autonomy in enterprise deployments (Huang et al., 2024; Wang et al., 2024).

Tool use

The third characteristic is tool use. An agent becomes operationally useful when it can interact with capabilities outside the language model itself.

These capabilities may include APIs, databases, enterprise applications, search systems, calculators, software repositories, CRM platforms, ERP systems, workflow engines, and other computational services. Schick et al. (2023), through the Toolformer research, demonstrated that language models can learn to determine when to invoke external tools, which tool to use, what arguments to provide, and how to integrate the resulting information into subsequent reasoning.

Tool use therefore represents a critical bridge between language generation and environmental action. Foundation models are inherently limited by the information contained within their parameters and context window. Connecting the model to external tools allows the overall system to access current information, specialised computational functions, and enterprise capabilities (Lewis et al., 2020; Schick et al., 2023).

For example, an enterprise agent may use an LLM to interpret a customer's request, retrieve customer information from a CRM system, obtain inventory data from an ERP system, calculate prices using a deterministic pricing engine, and initiate an approved workflow through an enterprise API. The agent does not replace these systems; it coordinates them in pursuit of a goal. This reinforces the argument developed in Chapter 2 that agentic AI is best understood as an orchestration architecture rather than a replacement for enterprise software.

State and memory

The fourth characteristic is state and memory. An agent operating across multiple steps must retain information about the current task and, in many cases, previous interactions.

Memory can take several forms. Working memory retains information during a particular task; long-term memory preserves information about previous interactions, users, or decisions; and procedural or experiential memory stores information about approaches that have previously produced successful or unsuccessful outcomes (Wang et al., 2024).

Memory improves coherence and efficiency. A customer-service agent may need to remember earlier messages within a support case, while an enterprise research agent may need to retain intermediate findings during a complex investigation. However, memory also introduces significant governance and privacy considerations. Organisations must determine what information should be retained, where it should be stored, how long it should remain available, who may access it, and whether users can correct or delete it. Memory is therefore not merely a technical capability but also a data-governance mechanism (ISO, 2023; European Union, 2024).

This distinction is particularly important because an agent's memory can influence future actions. Incorrect information retained from a previous interaction may become embedded within subsequent decision-making, increasing both the usefulness and the potential risk of persistent memory.

Feedback-driven adaptation

The fifth characteristic is feedback-driven adaptation. An agent differs from a static workflow because it can use the outcome of one action to determine what it should do next.

An agent may query an inventory system, discover that a requested product is unavailable, and then search for an alternative. It may execute a software test, observe a failure, and modify its proposed code. It may attempt to retrieve a document, discover that access is restricted, and escalate the task to a human. This creates an iterative relationship between action and observation. Yao et al. (2023), through the ReAct framework, demonstrated the value of interleaving reasoning and action so that observations from the environment can inform subsequent decisions.

Adaptation should, however, be distinguished from autonomous learning. An agent that changes its plan in response to new information is not necessarily retraining its underlying model. Most contemporary agentic behaviour is produced through runtime orchestration, contextual information, memory, and feedback rather than through modification of model parameters (Yao et al., 2023; Wang et al., 2024).

This distinction is important because commercial descriptions of agentic AI sometimes imply that systems automatically learn from every interaction. In practice, organisations must distinguish between runtime adaptation, memory-based adaptation, workflow optimisation, and genuine model retraining, as these mechanisms have different technical and governance implications.

Taken together, these five characteristics provide a rigorous basis for defining agentic AI. Goal orientation establishes what the system is attempting to achieve; planning determines possible routes towards that objective; tool use provides access to external capabilities; memory maintains relevant state across interactions; and feedback enables the system to modify subsequent actions.

Plaat et al. (2025) capture a closely related conceptual structure through the dimensions of reasoning, acting, and interacting. Reasoning concerns the interpretation of information and formulation of plans; acting concerns the ability to influence an environment through tools; and interacting concerns communication with users and other systems. Agency emerges from the integration of these capabilities rather than from any individual capability in isolation.

3.2 The agent loop

The characteristics outlined above can be integrated into a simplified agent loop that captures the behaviour of many enterprise agentic systems. Although implementations differ considerably, a typical enterprise agent can be conceptualised as progressing through a sequence of goal specification, context acquisition, planning, tool selection, execution, observation, evaluation, and either iteration or escalation (Yao et al., 2023; Wang et al., 2024).

The process begins with goal specification, in which a human user, business process, or external system establishes an objective such as resolving a customer complaint, investigating an IT incident, analysing a dataset, or preparing a management report.

The agent then performs context acquisition by retrieving information from enterprise databases, documents, APIs, previous interactions, or other authorised sources. This stage is critical because the quality of subsequent decisions depends heavily on the relevance and reliability of the available information (Lewis et al., 2020).

The third stage is planning, during which the agent determines which intermediate steps may be required. Planning may occur explicitly through a generated action sequence or implicitly through repeated next-step decision-making (Huang et al., 2024).

The fourth stage is tool selection, where the agent determines whether an external capability is required and selects an appropriate tool such as a database query, enterprise API, search service, or workflow engine (Schick et al., 2023).

The fifth stage is execution, in which the selected tool performs an authorised operation. Importantly, execution need not be controlled entirely by the language model; enterprise systems may impose deterministic validation, permission checks, and approval requirements before actions are permitted.

The sixth stage is observation, during which the agent receives the result of its action. The result may confirm success, provide new information, or indicate that the chosen approach was unsuccessful.

The seventh stage is evaluation, where the agent assesses the result relative to the original objective. If the objective has been achieved, the process terminates; otherwise, the agent may generate a revised plan or select an alternative tool.

The final stage is iteration or escalation. The agent may continue through another cycle, modify its strategy, or request human intervention. Escalation is particularly important in enterprise environments because successful behaviour does not necessarily mean autonomous completion. If uncertainty, risk, or policy constraints exceed predefined thresholds, transferring responsibility to a human decision-maker may itself represent the correct outcome.

The resulting loop can be represented as:

Goal → Context → Plan → Tool → Action → Observation → Evaluation → Next action or escalation

This loop differentiates agentic AI from conventional request-response systems. A chatbot typically terminates after generating a response, whereas an agent can remain active across multiple cycles of perception, reasoning, and action while interacting with an external environment consisting of enterprise data, applications, APIs, users, physical systems, or other computational agents (Russell and Norvig, 2021; Wang et al., 2024).

3.3 Long-horizon tasks and error propagation

The iterative nature of agentic systems creates a significant technical challenge concerning long-horizon reliability. Whereas a conventional generative-AI interaction often involves a single request followed by a single response, an agentic task may require a sequence of interdependent decisions and actions before an objective is achieved. Each additional stage introduces opportunities for error, and mistakes occurring early in the process may influence subsequent reasoning and execution.

This challenge arises because agentic systems operate through chains of reasoning, tool use, and environmental interaction rather than isolated outputs. An agent may initially misunderstand a user's objective, generate an inappropriate plan, select an unsuitable tool, or retrieve incomplete information. If the resulting error is not detected, it can become part of the context used for later decisions, allowing the error to propagate throughout the workflow.

Long-horizon reliability therefore differs from conventional measures of model accuracy. A language model may perform well on individual reasoning tasks while still struggling to maintain coherent decision-making across extended sequences of actions. In agentic environments, the system must preserve an accurate representation of the task, select appropriate tools, interpret intermediate results, and determine whether the overall objective remains achievable (Yehudai et al., 2025).

This distinction has become increasingly important in research on LLM-based agents. Yehudai et al. (2025) argue that agent evaluation must extend beyond conventional accuracy metrics to include planning, tool use, memory, self-reflection, robustness, safety, and cost. Similarly, research on long-horizon software-engineering agents demonstrates that performance frequently deteriorates as tasks require more intermediate decisions and environmental interactions (Deng et al., 2025).

The problem is therefore better understood as error propagation across a chain of decisions and actions. An incorrect interpretation may lead to an inappropriate plan; the plan may trigger the selection of an unsuitable tool; the tool may return information that is incomplete or incorrectly interpreted; and the resulting decision may then initiate an inappropriate business action. The consequences become particularly significant when agents are connected to operational systems such as financial platforms, customer databases, or production environments.

Tool use introduces additional uncertainty. An agent may choose the correct tool but provide incorrect parameters, misinterpret the output, or fail to recognise that an operation was unsuccessful. Conversely, a robust agent may detect failure, revise its strategy, and recover from the error. Consequently, recoverability is as important as accuracy in enterprise contexts.

Long-horizon tasks also create challenges for monitoring and auditing. Unlike deterministic workflows, dynamically generated agent behaviour may require organisations to reconstruct what information the agent accessed, which tools it selected, what actions it performed, and why a particular sequence of decisions was followed. Enterprise evaluation should therefore assess not only whether an agent can complete representative tasks, but also how it behaves when information is incomplete, tools fail, APIs return unexpected responses, permissions are insufficient, or malicious inputs attempt to influence its behaviour (Debenedetti et al., 2024; OWASP GenAI Security Project, 2025).

Long-horizon reliability therefore shifts evaluation from a narrow focus on capability towards a broader assessment of reliability, robustness, recoverability, and controllability. This distinction is particularly important because failures in reasoning can become failures in business execution when agents are authorised to act within enterprise systems.

3.4 Autonomy, authority and control

The concept of autonomy requires careful distinction from the broader concept of agency. An agent can exhibit agentic characteristics without possessing unrestricted autonomy.

Autonomy can be understood as the degree to which a system can determine and execute actions without direct human intervention. In practice, autonomy exists on a continuum: a system may require approval for every external action, require approval only for high-risk actions, or operate independently within a narrowly defined environment (Russell and Norvig, 2021; Wang et al., 2024).

This leads to an important distinction between autonomy and authority. Autonomy concerns whether an agent can make a decision independently; authority concerns whether it is permitted to execute that decision.

An agent may be technically capable of issuing a refund but not authorised to do so above a specified monetary threshold. Similarly, an agent may be capable of modifying a production database but possess only read-only access. Separating capability from authority is an important security principle because it limits the consequences of model error, prompt injection, or malicious manipulation (Debenedetti et al., 2024; OWASP GenAI Security Project, 2025).

The same principle applies to the scope of organisational objectives. A customer-service agent may be authorised to resolve routine order issues but should not possess unrestricted authority to modify customer records, access unrelated personal information, or alter organisational policies. Enterprise agentic systems should therefore be designed around bounded autonomy, in which the organisation establishes objectives, permissions, policies, and escalation conditions, while the agent exercises contextual decision-making within those boundaries (ISO, 2023; European Union, 2024).

From this perspective, human-in-the-loop architectures should not be interpreted as evidence of failure. In high-risk environments, escalation may be an intentional design feature. An agent that recognises uncertainty and transfers responsibility to an appropriately authorised human may be more reliable than an agent that attempts to complete every task autonomously.

3.5 Single-agent and multi-agent architectures

Agentic AI systems can also be distinguished according to whether a task is performed by one general-purpose agent or distributed across multiple specialised agents.

A single-agent architecture typically uses one LLM-based agent to interpret objectives, access tools, maintain memory, and coordinate an entire workflow. Its principal advantage is architectural simplicity, as fewer communication interfaces and coordination mechanisms are required.

A multi-agent architecture distributes responsibility across several specialised agents. A business process may involve a customer-service agent that interprets a request, a compliance agent that checks regulatory requirements, a pricing agent that calculates commercial terms, and a transaction agent that executes an approved action. Li et al. (2024) identify workflow, communication, and infrastructure as key dimensions of LLM-based multi-agent systems.

The principal benefit of multi-agent architectures is specialisation. Individual agents can be designed around narrower responsibilities, tools, and knowledge sources. However, this introduces additional coordination overhead and new failure modes. Communication between agents may become a source of error, and responsibility becomes more difficult to attribute when outcomes emerge from interactions among multiple autonomous components (Li et al., 2024; Wooldridge, 2009).

Multi-agent systems should therefore not automatically be regarded as superior to single-agent architectures. The appropriate design depends on task complexity, the need for specialisation, coordination costs, and the organisational risks associated with autonomous decision-making (Wadhwa et al., 2024).

3.6 Distinguishing agentic AI from related concepts

Clear conceptual boundaries are important because the term agentic AI is increasingly used as a broad commercial label.

First, agentic AI is not synonymous with generative AI. Generative AI concerns the production of content using learned models, whereas agentic AI concerns the pursuit of objectives through reasoning, interaction, and action. An agent may incorporate generative AI, but a generative-AI application is not necessarily an agent.

Second, agentic AI is not synonymous with robotic process automation. RPA is fundamentally concerned with executing predefined processes and software interactions. An agent may use RPA as one of its tools, but the agent provides a higher-level interpretation and orchestration capability (van der Aalst, Bichler and Heinzl, 2018; Ng et al., 2021).

Third, agentic AI is not synonymous with autonomous AI. An agent may operate with substantial human oversight, and autonomy is better understood as a design parameter rather than a binary property.

Fourth, agentic AI is not synonymous with artificial general intelligence (AGI). Contemporary agents can perform sophisticated tasks within bounded environments while remaining highly dependent on tools, prompts, models, and organisational constraints. Their ability to pursue specific objectives should not be interpreted as evidence of general intelligence.

Finally, agentic AI is not synonymous with multi-agent AI. Multi-agent systems represent one possible architectural implementation, whereas a single agent equipped with appropriate tools and memory can also exhibit substantial agentic behaviour.

These distinctions are essential because imprecise terminology can obscure important technological and governance differences. For enterprise decision-makers, the relevant question is not whether a system has been labelled an agent, but what it can perceive, decide, access, and execute within organisational boundaries.

3.7 A systems perspective on agentic AI

The discussion above suggests that agentic AI is best understood as a socio-technical system rather than an isolated AI model.

The underlying foundation model provides reasoning and language capabilities, but the behaviour of an enterprise agent emerges from the interaction between the model, prompts, memory, tools, data, workflows, permissions, users, and external environments (Wang et al., 2024; Plaat et al., 2025).

This perspective has important implications for evaluation. Model benchmarks remain valuable, but they cannot provide a complete assessment of an enterprise agent. A highly capable model may perform poorly when confronted with an organisation's data structures, API limitations, security policies, or governance constraints. Conversely, a less capable model may perform effectively within a tightly controlled architecture supported by retrieval systems, deterministic tools, validation mechanisms, and human oversight.

Agentic AI should therefore be evaluated as an integrated enterprise system rather than as a language model in isolation.

A useful conceptual representation is:

Foundation model + context + memory + planning + tools + environment + governance + human oversight = agentic system

This formulation explains why organisational conditions are likely to influence the success of agentic AI as strongly as the underlying model. Data quality, API availability, process maturity, security architecture, governance mechanisms, and human oversight determine the environment within which an agent operates.

Agentic AI therefore represents more than a technical evolution in language models. It represents a change in the relationship between AI and enterprise systems. Instead of merely providing information to human decision-makers, AI systems can increasingly participate directly in the execution of organisational processes.

This creates substantial opportunities for automation and scalability, but it also changes the nature of organisational risk. When an AI system only generates information, humans generally remain responsible for deciding whether and how to act on that information. When an agent is authorised to act directly, the boundary between recommendation and execution becomes increasingly important.

Consequently, the defining question for agentic AI is not simply whether a system can reason or generate content, but whether it can translate an objective into authorised actions, interact with an external environment, adapt through feedback, and continue towards the desired outcome while remaining within defined organisational constraints.

This definition provides the conceptual foundation for the subsequent analysis of agentic architecture, enterprise applications, governance, cybersecurity, and organisational adoption. It also establishes the central tension that runs throughout this paper: the same capabilities that enable greater automation and scalability also create new requirements for reliability, security, transparency, and governance.

4. Technical architecture

4.1 Foundation models as a component of the agentic architecture

At the centre of many contemporary agentic AI systems is a large language model (LLM) or, increasingly, a multimodal foundation model capable of processing text, images, audio, and structured data. Foundation models provide the capabilities required for natural-language understanding, contextual reasoning, content generation, and interaction across multiple modalities, making them the computational foundation upon which many modern agentic systems are constructed (Plaat et al., 2025; Stanford, 2026). Their emergence has enabled AI systems to perform a much wider range of cognitive tasks than earlier rule-based or narrowly trained machine-learning systems.

However, the foundation model should not be confused with the agent itself. An LLM is fundamentally a probabilistic model that processes inputs and generates outputs. It does not inherently possess persistent memory, enterprise permissions, external tools, workflow controls, or governance mechanisms required for autonomous operation within an organisational environment (Wang et al., 2024). Agentic behaviour therefore emerges from the interaction between the foundation model and a broader technical architecture that provides context, memory, tools, and execution capabilities.

This distinction is important because it shifts the analysis of agentic AI away from the capabilities of the underlying model alone. An enterprise agent is more accurately understood as a socio-technical system comprising a reasoning model together with the infrastructure required to provide contextual information, maintain state, perform actions, enforce permissions, and monitor behaviour (Plaat et al., 2025; Wang et al., 2024). Consequently, the practical capabilities of an enterprise agent are determined not only by model quality but also by the architecture that surrounds it.

A typical enterprise agent may therefore combine a foundation model with system and task instructions, contextual retrieval mechanisms, short- and long-term memory, tool and API interfaces, workflow orchestration, authentication and authorisation controls, monitoring and logging facilities, evaluation mechanisms, and human approval processes. Although specific implementations differ across organisations and vendors, the underlying architectural principle remains consistent: the model contributes reasoning and language capabilities, while the surrounding infrastructure determines what the system can access, what it is authorised to do, and how its actions are constrained (Ng et al., 2021; Microsoft, 2025).

This distinction is particularly significant from a risk-management perspective. Many of the risks associated with agentic AI do not originate exclusively from the foundation model itself. An agent may perform an inappropriate action because it has been provided with inaccurate information, connected to an unreliable API, granted excessive permissions, given ambiguous instructions, or embedded within a workflow lacking appropriate validation controls (Debenedetti et al., 2024; OWASP GenAI Security Project, 2025). Conversely, a highly capable model may operate safely and effectively when surrounded by strong access controls, deterministic business rules, monitoring mechanisms, and appropriate human oversight.

The performance of an enterprise agent should therefore be regarded as a function of the entire architecture, rather than simply the performance of the underlying LLM. This architectural perspective is consistent with broader research on intelligent automation, which emphasises that organisational outcomes depend on the integration of AI capabilities with enterprise systems, processes, and governance mechanisms (Ng et al., 2021).

The distinction between reasoning capability and operational authority is consequently central to enterprise implementation. A model may determine that a particular action appears appropriate, but the surrounding architecture should determine whether that action is technically possible, authorised, and compliant with organisational policy. This separation is one of the most important design principles in enterprise agentic systems because it allows probabilistic reasoning to be constrained by deterministic organisational controls.

4.2 Planning and reasoning

Planning provides the mechanism through which an agent can transform a high-level objective into a sequence of intermediate tasks and actions. Rather than responding to a request with a single generated output, the agent can determine what information is required, which operations need to be performed, and in what order those operations should occur (Huang et al., 2024; Wang et al., 2024).

Consider an enterprise travel-management scenario in which an employee asks an agent to arrange a three-day business trip to London in accordance with corporate travel policy. A conventional conversational system might provide general information about flights and accommodation. An agentic system could instead interpret the request as a multi-stage workflow involving authentication, retrieval of travel policies, identification of authorised booking systems, comparison of alternatives, determination of approval requirements, execution of reservations through enterprise APIs, and updating of organisational travel-management records.

The defining characteristic is therefore not simply that the system can perform individual operations, but that it can determine which operations are required and how they should be sequenced in order to achieve the objective.

Planning introduces flexibility that is difficult to achieve through purely deterministic automation. If a preferred flight is unavailable, the agent can revise its plan, identify an alternative, and continue the workflow rather than terminating because a predefined condition has not been satisfied. Similarly, if an external system returns unexpected information, the agent can adapt its subsequent actions in response to the new context (Yao et al., 2023).

Research on LLM-based agents increasingly identifies planning as a central component of agentic behaviour. Wang et al. (2024) identify planning alongside memory, action, and profiling as core architectural components of autonomous agents, while Huang et al. (2024) examine mechanisms including task decomposition, plan generation, plan selection, reflection, and external modules. These studies suggest that planning enables agents to move beyond single-step interactions towards objective-oriented behaviour across extended workflows.

Planning nevertheless represents a significant source of risk. A plan may be coherent without being correct. An LLM may misunderstand an instruction, overlook an organisational constraint, make unsupported assumptions, or select an inappropriate tool. The fact that a proposed sequence of actions appears plausible does not guarantee that it will produce the desired organisational outcome.

This creates a fundamental tension within agentic architecture. Greater planning flexibility allows systems to operate beyond narrowly predefined workflows, but it also increases the number of intermediate decisions delegated to the AI system. Enterprise architectures should therefore avoid treating model-generated plans as inherently authoritative. Instead, planning should operate within deterministic policy constraints and organisational governance mechanisms.

For example, an agent may determine that upgrading an employee's flight to business class is desirable based on travel duration and scheduling constraints. However, corporate travel policy may permit business-class travel only for journeys exceeding a specified duration or for employees above a particular grade. The agent can therefore propose the action, while a policy engine, workflow system, or application-level control determines whether the action may actually be executed.

This illustrates a broader architectural principle: probabilistic reasoning should be complemented by deterministic validation whenever the consequences of error are significant (ISO, 2023; European Union, 2024).

Planning can also be implemented at different levels of complexity. Some agents generate an explicit multi-step plan before executing any actions, while others operate iteratively by selecting the next action after observing the result of the previous one. The latter approach is associated with frameworks such as ReAct, which interleave reasoning and action so that environmental observations can inform subsequent decisions (Yao et al., 2023).

Neither approach is universally superior. Explicit planning provides greater visibility into the intended workflow, whereas iterative planning offers greater flexibility when the environment is uncertain or dynamic. In enterprise contexts, the appropriate approach depends on process predictability, operational risk, compliance requirements, and the degree of human oversight required.

Planning should therefore be regarded as both a capability and a control point. Agents require sufficient flexibility to handle variable conditions, but organisations must retain mechanisms for constraining, validating, monitoring, and, where necessary, overriding proposed courses of action.

4.3 Tool use and application programming interfaces

Tool use represents one of the most significant architectural distinctions between an agentic system and a conventional conversational AI application. A chatbot primarily generates information based on its model and available context. An agent can use external tools to retrieve information, perform computations, invoke enterprise services, and execute actions within an external environment (Schick et al., 2023; Wang et al., 2024).

Tools extend the capabilities of the foundation model beyond the knowledge and computational functions contained within the model itself. Depending on the application, an enterprise agent may interact with CRM systems, ERP platforms, databases, booking systems, search services, calculators, software repositories, inventory systems, email platforms, IT service-management systems, and monitoring tools.

Schick et al. (2023), through the Toolformer framework, demonstrated that language models can learn to determine when an external tool is required, select an appropriate API, generate the necessary parameters, and incorporate the returned information into subsequent reasoning. The key implication is that a language model does not need to contain every capability required to complete a task if it can reliably access specialised external systems.

In enterprise environments, however, tool use requires substantially stronger controls than those used in research demonstrations. An agent connected to enterprise infrastructure may have access to commercially sensitive information, personal data, financial records, operational systems, or critical infrastructure. Invoking a tool therefore represents not merely a technical capability but a delegation of organisational authority.

Enterprise agents should therefore be designed around explicitly defined tool interfaces and permission boundaries. Rather than granting unrestricted access to an ERP system, an organisation may expose only narrowly defined functions such as checking inventory, retrieving approved supplier records, or creating draft purchase orders. The agent can use these functions without possessing unrestricted access to the underlying application.

This implements the security principle of least privilege, under which a system is granted only the permissions necessary to perform its assigned function. The principle is particularly important for agentic systems because agents may dynamically determine which available tools to invoke. Limiting available tools and permissions therefore reduces the potential consequences of incorrect reasoning, prompt injection, compromised credentials, or malicious manipulation (Debenedetti et al., 2024; OWASP GenAI Security Project, 2025).

Tool interfaces also create a valuable separation between probabilistic reasoning and deterministic execution. An agent may determine that a product price must be calculated, but instead of generating the calculation itself, it invokes an authoritative pricing service. Similarly, an agent may retrieve order status directly from a CRM system rather than relying on information encoded within the language model.

This establishes an important architectural pattern in which the agent provides interpretation, reasoning, and orchestration, while specialised enterprise systems provide authoritative data and deterministic execution.

The design of the interface between the agent and the tool is therefore critical. Tools should expose clearly defined inputs and outputs, predictable error handling, authentication mechanisms, and validation controls. Where possible, read-only operations should be separated from state-changing or irreversible operations, and high-consequence actions should require explicit confirmation or additional authorisation.

Tool use also introduces the problem of tool-selection reliability. An agent may have several tools available that appear suitable for a task. Selecting the wrong tool, supplying incorrect parameters, or misinterpreting the returned information can produce incorrect outcomes even when the underlying enterprise systems function correctly.

Consequently, tool-use architectures should incorporate validation wherever appropriate. Inputs generated by the agent can be checked against expected schemas, permissions can be evaluated before execution, and outputs can be validated before they are used to trigger subsequent actions. Such controls reduce the extent to which the correctness of the overall system depends on the language model alone.

The combination of agentic reasoning with deterministic enterprise tools therefore represents one of the defining characteristics of contemporary enterprise agentic AI. The model does not replace existing enterprise systems; rather, it provides a flexible interface through which those systems can be dynamically coordinated in response to a high-level objective.

4.4 Memory and state management

Memory provides an agent with the ability to retain information beyond a single model interaction. This capability is essential because many enterprise processes extend across multiple steps, interactions, or sessions. Without mechanisms for maintaining state, an agent may be unable to preserve the information required to complete complex workflows coherently (Wang et al., 2024).

Memory can be categorised into several forms. Working memory refers to information retained during an ongoing task, including the user's request, intermediate reasoning steps, previous tool calls, and decisions made within the current workflow. This information allows the agent to maintain coherence across multiple actions.

Long-term memory refers to information retained across interactions or sessions, such as customer preferences, previous communications, organisational knowledge, or recurring user requirements. A sales-support agent, for example, may retain information about a customer's previous product discussions, enabling future interactions to become more contextually relevant.

A third category can be described as procedural or experiential memory, which stores information about previous approaches, outcomes, or experiences that may influence future behaviour. An agent may retain knowledge that a particular troubleshooting procedure has consistently resolved a recurring operational issue or that a previous approach failed under specified conditions.

Memory can significantly improve both efficiency and personalisation. Agents do not need to rediscover information that is legitimately available from previous interactions, and users do not necessarily need to repeat contextual information across sessions.

However, memory also introduces substantial governance, privacy, and data-quality challenges. The more information an agent retains, the greater the potential consequences of storing information that is inaccurate, unnecessary, sensitive, or no longer appropriate. Organisations must therefore establish clear policies governing what information may be stored, where it is stored, how long it is retained, who may access it, and under what circumstances it may be corrected or deleted (ISO, 2023; European Union, 2024).

Data protection is particularly important when memory contains information relating to identifiable individuals. An enterprise agent may accumulate information across multiple interactions that, when combined, provides a much more comprehensive profile of an individual than any single interaction would reveal. Memory therefore increases both the value of the system and the sensitivity of the information it manages.

Memory also creates a data-correction problem. Incorrect information retained about a customer, employee, or business process may influence future decisions and interactions. Organisations consequently require mechanisms for identifying, correcting, and, where appropriate, deleting stored information.

Access control is equally important. Not every agent should have access to every form of organisational memory. A customer-service agent may legitimately access previous support interactions, while having no legitimate reason to access confidential HR records. Memory should therefore be governed according to the same principles of purpose limitation, least privilege, and access control that apply to other enterprise information assets.

The architecture of memory must also distinguish between authoritative information and agent-generated information. A model-generated summary of a previous interaction should not automatically be treated as equivalent to the underlying record in the system of record. Whenever consequential decisions depend on authoritative information, the agent should retrieve that information from the appropriate enterprise source rather than relying solely on its own stored representation.

Memory should therefore be treated not simply as a mechanism for making agents more useful, but as a component requiring explicit data governance, lifecycle management, security controls, and quality assurance.

4.5 Retrieval and contextual grounding

Closely related to memory is the mechanism through which an agent obtains relevant information at runtime. Enterprise agents frequently require access to information that is not contained within the parameters of the underlying foundation model, including internal policies, product documentation, customer records, operational data, and rapidly changing business information.

Retrieval-augmented generation (RAG) provides one of the most important mechanisms for addressing this requirement. Lewis et al. (2020) introduced RAG as an approach that combines a generative model with an external knowledge source, allowing relevant information to be retrieved before generation occurs. This approach is particularly valuable in enterprise environments because it enables organisations to connect foundation models to domain-specific and continuously updated knowledge without retraining the underlying model.

Within an agentic architecture, retrieval serves a broader purpose than simply improving factual accuracy. Retrieved information can influence planning, tool selection, policy interpretation, and decision-making. An agent may retrieve procurement policies before determining whether a purchase requires approval, contractual terms before proposing a customer action, or technical documentation before initiating a maintenance procedure.

This makes contextual grounding a central component of agentic reliability. An agent with access to authoritative and current organisational information is better positioned to make appropriate decisions than one relying solely on knowledge encoded within a foundation model (Lewis et al., 2020).

However, retrieval does not eliminate the possibility of error. The system may retrieve irrelevant, outdated, or incomplete information, fail to retrieve a necessary document, or misinterpret the retrieved content. Retrieval quality must therefore be evaluated as part of the overall agentic architecture rather than assumed to be reliable simply because an external knowledge source exists.

Enterprise retrieval systems should therefore incorporate source governance, access permissions, document lifecycle management, version control, and mechanisms for identifying authoritative information. Agents should also distinguish between information retrieved from controlled enterprise repositories and information originating from less reliable external sources.

The combination of retrieval, memory, and tools creates a substantially more capable architecture. Retrieval provides access to organisational knowledge, memory provides continuity across interactions, and tools provide the ability to act on the resulting information. Together with the reasoning capabilities of the foundation model, these components enable systems to move beyond information generation towards the execution of multi-stage enterprise objectives.

4.6 Orchestration, monitoring and human control

The final architectural layer concerns orchestration and control. As agentic systems become capable of coordinating multiple tools, memory stores, retrieval systems, and enterprise workflows, organisations require mechanisms for controlling the sequence of operations and observing system behaviour across the entire execution process (Li et al., 2024).

Orchestration determines how the components of an agentic system interact. It may establish which model is used for a particular task, which tools are available, when information should be retrieved, when a human should be consulted, which actions require additional validation, and how workflows are coordinated across enterprise applications.

Monitoring and logging are equally important because dynamically generated workflows are more difficult to audit than conventional deterministic processes. Organisations should be able to determine what objective the agent was given, which information it accessed, which tools it invoked, what actions were performed, and where human intervention occurred. Such observability is essential for governance, compliance, debugging, and post-incident investigation (ISO, 2023).

This creates an important distinction between functional autonomy and operational autonomy. An agent may be technically capable of completing a task independently, but an enterprise should retain the ability to monitor, constrain, interrupt, and, where necessary, terminate its activity.

Human approval mechanisms therefore remain an important component of enterprise agentic architecture. Approval may be required for particular actions, monetary thresholds, access to sensitive information, external communications, or irreversible transactions. The appropriate threshold depends on the consequences of failure and the degree of trust that can reasonably be placed in the system.

The resulting architecture is therefore not one in which an LLM simply acts independently. Rather, it is a layered enterprise architecture in which the foundation model provides reasoning capabilities; retrieval and memory provide contextual information; tools and APIs provide operational capabilities; orchestration coordinates these components; and security, monitoring, and human controls constrain their behaviour (Wang et al., 2024; Plaat et al., 2025).

This architectural perspective is essential for understanding why agentic AI represents a significant development in enterprise automation. The novelty lies not solely in the language model, but in the integration of probabilistic reasoning with enterprise data, deterministic systems, governance mechanisms, and controlled execution capabilities.

At the same time, this integration means that the risks associated with agentic AI extend across the entire technology stack. Weaknesses in the foundation model, retrieval system, memory architecture, API layer, authentication mechanism, orchestration framework, or monitoring infrastructure can influence the behaviour of the overall agent. Effective deployment therefore requires the architecture to be designed and governed as an integrated enterprise system rather than as a collection of independently secured components (ISO, 2023; European Union, 2024).

The technical architecture of agentic AI consequently provides the foundation for the organisational capabilities discussed in the following chapter. By combining foundation models with planning, memory, retrieval, tools, orchestration, and governance controls, enterprise agents can potentially automate workflows that are difficult to address through conventional deterministic automation alone. However, these same architectural capabilities also introduce new requirements for security, governance, evaluation, monitoring, and human oversight, which become increasingly important as agents are granted greater operational authority.

5. Multi-Agent Systems

5.1 From single agents to multi-agent architectures

A significant development within agentic artificial intelligence (AI) is the emergence of multi-agent systems (MAS), in which multiple specialised agents interact to achieve individual or shared objectives. Rather than assigning an entire business process to one general-purpose agent, organisations can distribute responsibilities across several agents, each with a defined role, set of tools, data permissions and decision boundaries. This represents a development from conventional chatbot and intelligent-automation approaches towards systems capable of planning, tool use, interaction and autonomous execution (Adamopoulou and Moussiades, 2020; Wang et al., 2024; Plaat et al., 2025).

The underlying concept of MAS predates contemporary generative AI. Multi-agent systems have traditionally been concerned with computational agents that interact, cooperate, coordinate or compete within an environment to achieve individual or collective objectives (Wooldridge, 2009). The distinction between an agent and a conventional software component is particularly relevant here. An agent is generally expected to perceive information, make decisions and act within an environment, whereas conventional automation normally follows explicitly specified rules or workflows (Russell and Norvig, 2021). The development of large language models (LLMs) has expanded this paradigm because LLMs can provide a flexible interface for interpreting instructions, reasoning over contextual information, communicating through natural language and interacting with external tools (Schick et al., 2023; Yao et al., 2023; Wang et al., 2024).

Contemporary agent architectures increasingly combine several capabilities that were previously implemented separately. Retrieval-augmented generation (RAG), for example, enables an agent to obtain information from external knowledge sources rather than relying exclusively on information encoded in model parameters (Lewis et al., 2020). Tool-use approaches allow models to invoke external software or services, while ReAct-style architectures combine reasoning and action in an iterative process (Schick et al., 2023; Yao et al., 2023). Planning is another important component because an agent may need to decompose a high-level objective into a sequence of actions before execution (Huang et al., 2024). Multi-agent systems extend these capabilities by distributing planning, reasoning and execution across multiple interacting components.

An enterprise process could, for example, involve a customer-facing agent that interprets a request, a compliance agent that verifies applicable policies, a pricing agent that determines commercial terms and a booking or transaction agent that executes an approved action:

Customer Agent → Compliance Agent → Pricing Agent → Booking Agent

In practice, however, MAS architectures do not necessarily operate as a simple linear sequence. Agents may communicate iteratively, request additional information, operate in parallel, delegate subtasks or escalate decisions to another agent or a human. Multi-agent systems can therefore be understood as networks of specialised decision-making components rather than merely as conventional workflows implemented with multiple LLMs. Surveys of LLM-based MAS identify workflow design, communication, infrastructure and coordination as fundamental architectural dimensions (Li et al., 2024).

This distinction is important because deploying several agents does not automatically create a useful multi-agent system. The architecture must determine how agents communicate, how tasks are allocated, how shared state is maintained, which tools each agent can use, how decisions are coordinated and how failures are handled. Recent enterprise discussion of agentic automation similarly positions agents as a development beyond traditional robotic process automation (RPA), where software robots historically executed comparatively deterministic, predefined processes (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020; El-Gharib and Amyot, 2022). The newer model combines automation with language-based interpretation, planning and adaptive interaction, potentially allowing automation to address less structured processes (Santos, Pereira and Vasconcelos, 2020; Ng et al., 2021).

The primary architectural rationale for MAS is therefore specialisation. A single general-purpose agent may be capable of performing several functions, but a specialised agent can be provided with narrower instructions, targeted tools, restricted data access and domain-specific evaluation criteria. A compliance agent, for example, may have access to regulatory and organisational policy information but no authority to execute financial transactions. A booking agent may be authorised to interact with reservation systems but have no access to confidential compliance records.

This separation can improve modularity and maintainability. If pricing rules change, the pricing component can potentially be modified without redesigning the entire customer-facing system. Similarly, a new booking provider could potentially be integrated at the transaction layer without changing the agent responsible for interpreting customer requests. The modularity principle is consistent with the broader development of intelligent automation, in which organisations seek to combine process automation with more flexible forms of AI-based decision support (Ng et al., 2021).

However, MAS should not be regarded as an inevitable progression from single-agent systems. The architectural choice depends on the complexity of the task, the extent to which responsibilities can be meaningfully separated and the costs associated with communication, monitoring and governance. Multi-agent architectures therefore represent an architectural option within the wider agentic-AI design space rather than a universally superior solution (Li et al., 2024; Plaat et al., 2025).

5.2 Specialisation and division of responsibility

The central architectural advantage of a multi-agent system is the ability to divide a complex task into specialised responsibilities. Instead of requiring one agent to understand every aspect of an enterprise process, different agents can be designed around specific business functions.

Consider an enterprise procurement process in which an employee requests the purchase of equipment. A general-purpose agent could potentially interpret the request, identify a suitable product, check procurement policy, determine whether the supplier is approved and create a purchase order. A multi-agent architecture could distribute these responsibilities across specialised agents.

A procurement agent could interpret the employee's requirements and identify suitable products. A policy agent could determine whether the purchase complies with organisational procurement rules. A supplier agent could verify supplier status and commercial terms. A finance agent could determine the appropriate budget or approval requirements. Finally, a transaction agent could create the purchase order once the relevant conditions have been satisfied.

This division creates clearer functional boundaries. Each agent can be evaluated according to a specific responsibility rather than being assessed solely according to whether the complete workflow succeeds. Such modularity is particularly relevant to agent evaluation because current research increasingly distinguishes between an agent's reasoning capability, planning ability, tool use, reliability and performance over extended tasks (Yehudai et al., 2025; Deng et al., 2025).

Specialisation can also support the principle of least privilege. Agents can be provided with access only to the data and tools required for their specific responsibilities. A policy agent may need access to procurement rules and regulatory documents, potentially using retrieval mechanisms to obtain authoritative information (Lewis et al., 2020), while a transaction agent may require access to an ordering system. Neither necessarily needs unrestricted access to the entire enterprise environment.

The separation of responsibilities can also introduce opportunities for validation and cross-checking. If a customer-facing agent incorrectly interprets a request, a subsequent compliance agent may identify the inconsistency before an external action occurs. Similarly, a transaction agent can be designed to execute only after receiving an explicit approval state from another component.

Nevertheless, the presence of additional agents should not automatically be interpreted as an additional layer of security, reliability or accuracy. If several agents share the same incorrect assumption, or if an erroneous decision is transferred between agents without independent verification, the additional components may simply increase the complexity of the failure. Multi-agent architectures can therefore create both redundancy and correlated failure.

The effectiveness of specialisation depends on whether the boundaries between agents are meaningful. Each agent should have a clearly defined purpose, measurable responsibilities, appropriate tools and identifiable constraints. The division should be based on the requirements of the business process rather than on an arbitrary desire to maximise the number of agents.

This is particularly important when comparing MAS with conventional RPA. Traditional RPA can be effective where processes are stable and rules are explicit, while LLM-based agents become more useful where interpretation, unstructured information or adaptive planning is required (van der Aalst, Bichler and Heinzl, 2018; Santos, Pereira and Vasconcelos, 2020; Wewerka and Reichert, 2020). A multi-agent architecture should therefore be introduced where specialisation solves a genuine process or governance problem, rather than merely replacing a straightforward deterministic workflow with several autonomous components.

5.3 Communication and coordination

Communication is one of the most significant technical challenges introduced by multi-agent architectures. Agents need mechanisms for exchanging information, requesting actions, transferring results and coordinating decisions. In LLM-based systems, these interactions may occur through natural-language messages, structured data or a combination of both (Li et al., 2024; Wang et al., 2024).

Natural-language communication provides flexibility because agents can exchange contextual information without requiring every possible interaction to be predefined. However, this flexibility also introduces ambiguity. An agent may interpret a message differently from the way the sending agent intended, omit relevant information or introduce assumptions that were not present in the original communication.

For example, a customer agent might inform a compliance agent that a customer is requesting a refund. The compliance agent may require additional information, such as the transaction date, product category, purchase conditions and reason for the request. If these data are not transferred correctly, the compliance agent may make an inappropriate decision even though both agents are functioning according to their individual objectives.

Communication should therefore be treated as an architectural interface, not simply as an exchange of conversational messages. Important information should be structured where appropriate, using explicit fields, validation requirements, defined schemas and clear expectations concerning the information that must be transferred. Natural language can remain useful for contextual reasoning, while structured representations can provide greater predictability for information that must be interpreted consistently.

The wider development of LLM agents reinforces this requirement. Tool-use research demonstrates that language models can dynamically determine when external tools are required (Schick et al., 2023), while ReAct demonstrates how reasoning and action can be combined iteratively (Yao et al., 2023). Once multiple agents and tools are combined, however, the system must also establish which agent is permitted to invoke a tool, which agent is authorised to request an action and which component has final decision authority.

Coordination becomes particularly important where agents can act simultaneously. A multi-agent system may need to determine which agent has authority over a particular decision, whether agents can override one another and how conflicts should be resolved.

For example, a pricing agent might determine that a discount is commercially appropriate while a compliance agent determines that the discount is prohibited under a particular contract. The architecture must establish which decision has precedence and whether the disagreement should be escalated to a human.

Consequently, multi-agent systems require explicit coordination policies. Agents should not simply be allowed to negotiate indefinitely or independently determine which other agents to trust. The organisation must establish how responsibilities are allocated, how conflicts are resolved and which decisions require human approval. Planning research similarly highlights the importance of decomposing objectives, maintaining intermediate states and coordinating actions over longer horizons (Huang et al., 2024).

5.4 Emergent behaviour and system complexity

One of the most important differences between single-agent and multi-agent architectures is that system behaviour can become more difficult to predict as the number of interacting components increases. A single agent already operates through a combination of model reasoning, memory, tools and environmental feedback. Introducing additional agents adds further interactions and dependencies.

Each agent may behave differently depending on the information it receives, while the overall outcome may depend on the sequence, interpretation and timing of communications between agents. This creates the possibility of emergent behaviour, whereby the behaviour of the complete system cannot be understood simply by analysing each component independently (Wooldridge, 2009; Li et al., 2024).

Emergence does not mean that a MAS will necessarily behave unpredictably. Rather, interactions between autonomous or semi-autonomous components can create system-level outcomes that are difficult to anticipate solely from the behaviour of individual components. The problem becomes particularly significant when agents operate over long horizons and repeatedly plan, act, observe and re-plan.

Recent evaluation research demonstrates why this matters. Agent evaluation increasingly needs to consider not only whether an LLM can generate a correct response but also whether an agent can plan, use tools, maintain reliability and complete complex tasks over multiple steps (Yehudai et al., 2025). The development of more challenging software-engineering benchmarks similarly reflects the difficulty of evaluating agents on long-horizon tasks rather than isolated model outputs (Deng et al., 2025).

It is therefore insufficient to test each agent independently and assume that the complete system will behave correctly. Interactions between agents must also be evaluated. A compliance agent may perform correctly when tested in isolation and a pricing agent may also perform correctly independently, yet the combined system may still produce an inappropriate result if the pricing agent misinterprets the compliance agent's recommendation.

Evaluation should consequently operate at several levels:

1. Component level – whether each agent performs its designated function reliably.

2. Interaction level – whether agents exchange information accurately and consistently.

3. Workflow level – whether the complete process achieves the intended business outcome.

4. System level – whether the architecture remains reliable under realistic environmental conditions, failures and adversarial inputs.

5. Governance level – whether decisions and actions remain observable, controllable and attributable.

AgentDojo illustrates the importance of evaluating agents in dynamic environments rather than relying solely on static tests. It specifically examines prompt-injection attacks and defensive mechanisms in tool-using LLM agents, demonstrating that agent security must be evaluated in the context of interaction with an environment rather than only at the model-output level (Debenedetti et al., 2024).

This reinforces the broader issue of long-horizon reliability. Every additional agent, tool invocation and communication step introduces another potential point of failure. The probability of system-level failure can therefore increase as the number of dependent interactions grows, even when individual components perform reasonably well.

5.5 Governance and accountability

The distribution of decision-making across multiple agents creates particular challenges for governance and accountability. In a conventional enterprise application, responsibility for a decision can often be traced to a specific rule, workflow or authorised employee. In a MAS, the final outcome may emerge from several interconnected decisions.

One agent may interpret a request, another may assess compliance, another may determine pricing and another may execute the transaction. If an incorrect transaction occurs, the organisation must determine whether the failure resulted from the initial interpretation, the compliance assessment, the pricing decision, communication between agents or the execution layer.

This makes traceability and observability important architectural requirements. Organisations should maintain sufficient records to reconstruct the sequence of decisions and actions contributing to a consequential outcome. Logging should, where proportionate, establish which agent performed each action, what information it received, which tools it used, what decision it produced and what subsequent component acted upon that decision.

Governance is particularly important because agentic AI is increasingly moving into enterprise environments. Industry research describes growing organisational interest in agents that can perform multi-step tasks and interact with enterprise systems, while enterprise automation providers are increasingly positioning agentic automation as an extension of existing automation capabilities (McKinsey & Company, 2025; Microsoft, 2025; Lufthansa Industry Solutions, 2026). This development increases the importance of governance mechanisms capable of controlling systems that are not limited to generating information but can potentially execute actions.

The regulatory environment also makes governance increasingly significant. The European Union's Artificial Intelligence Act establishes a risk-based regulatory framework for AI and imposes requirements that vary according to the nature and risk of an AI system (European Union, 2024). Organisations deploying agentic systems therefore need to consider not only technical performance but also the system's intended purpose, risk classification, human oversight, transparency, record-keeping and other applicable obligations.

Formal management systems can provide an additional governance framework. ISO/IEC 42001 establishes requirements and guidance for an AI management system, providing an organisational approach to managing AI-related risks, responsibilities and processes (ISO, 2023). The standard is particularly relevant to MAS because governance cannot be reduced to the behaviour of an individual model. Responsibility must extend across the system, its users, its tools, its data and the organisation deploying it.

Governance should therefore establish clear ownership for each agent as well as for the overall system. A named organisational owner should be responsible for defining an agent's purpose, permissions, evaluation criteria, monitoring requirements and escalation conditions. The existence of several agents should not result in responsibility becoming distributed to the point where no individual or function is accountable for the overall outcome.

This leads to an important principle:

Technical decentralisation should not result in organisational decentralisation of accountability.

Agents may be specialised and distributed, but responsibility for their deployment, monitoring and consequences must remain clearly assigned.

5.6 Security considerations

Multi-agent architectures introduce additional security risks because every communication pathway between agents can become a mechanism through which incorrect, manipulated or malicious information propagates. The attack surface therefore extends beyond the underlying model to include tools, retrieved information, agent instructions, memory, communication channels and external environments.

One important concern is indirect instruction manipulation. An agent may receive instructions through another agent or through information retrieved from an external source that conflict with its intended purpose or security constraints. If the receiving agent treats all incoming instructions as authoritative, a compromised or incorrectly behaving component could influence the actions of other agents.

Research into prompt injection demonstrates that tool-using agents can be exposed to attacks in which untrusted information influences an agent's subsequent behaviour (Debenedetti et al., 2024). This problem becomes more complex in a MAS because a malicious instruction or incorrect assumption introduced at one point in the system can potentially propagate through subsequent agents.

Security therefore requires more than conventional authentication of the underlying infrastructure. Agents should be able to distinguish between information, requests and authorisations. A customer-service agent may be authorised to request a refund assessment from a compliance agent without being authorised to instruct that agent to approve the refund.

This distinction separates requesting an action from authorising an action. The architecture should determine which component possesses decision authority and should prevent another agent from implicitly acquiring that authority through communication.

The principle of least privilege should consequently apply at several levels:

• access to enterprise data;

• access to external tools and APIs;

• ability to initiate transactions;

• ability to delegate tasks;

• ability to communicate with other agents; and

• authority to approve consequential decisions.

The emerging security literature on agentic applications reinforces the need to consider risks that differ from those of conventional LLM applications. Agentic systems can possess greater autonomy, tool access and capacity to affect external environments, making security failures potentially more consequential (OWASP GenAI Security Project, 2025).

Security controls must therefore consider not only traditional infrastructure threats but also the integrity of information exchanged between autonomous components. Authentication, authorisation, input validation, tool restrictions, output validation, monitoring and human escalation should be considered as interconnected controls rather than isolated mechanisms.

The use of RAG creates an additional consideration. Retrieval can provide agents with current or enterprise-specific information, but retrieved content should not automatically be treated as trusted instructions. The architecture must distinguish between information that an agent should use as evidence and instructions that the agent is authorised to follow (Lewis et al., 2020; Debenedetti et al., 2024).

The same principle applies to tool use. Tool-enabled agents can extend their capabilities significantly, but each additional tool also creates an additional pathway through which an agent can affect the environment (Schick et al., 2023). In a MAS, tool permissions should therefore be associated with clearly defined roles and business purposes.

5.7 Multi-agent systems as an architectural trade-off

The preceding discussion demonstrates that multi-agent architectures involve a fundamental trade-off between specialisation and coordination complexity.

Specialisation can make complex systems more modular. It can allow organisations to assign narrower responsibilities, restrict permissions, use domain-specific tools and evaluate components independently. It can also provide a mechanism for scaling an architecture as additional business functions are introduced. These characteristics explain why agentic automation is increasingly being discussed as an extension of established automation approaches rather than simply as another form of chatbot technology (McKinsey & Company, 2025; Microsoft, 2025).

However, every additional agent introduces another component that must be designed, secured, evaluated, monitored and maintained. Communication between agents creates additional interfaces, while coordination mechanisms introduce additional dependencies. The overall system can therefore become more difficult to reason about as the number of interacting components increases.

This creates a key architectural question:

When does adding another agent provide sufficient value to justify the additional complexity?

The answer is unlikely to be the same for every enterprise application. A highly complex process involving clearly separable domains may benefit from several specialised agents. A relatively simple workflow may be better served by a single agent supported by deterministic tools and conventional orchestration. Traditional RPA may remain more appropriate where process rules are stable and outcomes can be specified deterministically (van der Aalst, Bichler and Heinzl, 2018; El-Gharib and Amyot, 2022; Wewerka and Reichert, 2020).

The commercial tendency to present multi-agent architectures as an inevitable progression from single-agent systems should therefore be treated cautiously. More agents do not necessarily mean greater intelligence, reliability or business value. Additional agents can introduce communication overhead, duplicated reasoning, inconsistent decisions and new security and governance requirements without providing a corresponding functional benefit.

This is also consistent with the broader development of LLM-based agent architectures. Surveys identify planning, memory, tools, communication and environmental interaction as important capabilities of autonomous agents, but they also identify reliability, evaluation, coordination and security as persistent challenges (Wang et al., 2024; Huang et al., 2024; Plaat et al., 2025). Multi-agent design adds another layer to these challenges rather than eliminating them.

For many enterprise applications, a small number of clearly defined agents operating within well-controlled boundaries may therefore be more appropriate than a large collection of highly autonomous agents. The preferred architecture should ultimately be determined by the requirements of the business process rather than by the technological novelty of MAS.

Where responsibilities can be clearly separated and independently governed, specialisation may provide significant benefits. Where a task is relatively straightforward, additional agents may simply add complexity.

Multi-agent systems should consequently be viewed not as a replacement for single-agent architectures, but as an architectural option within the broader agentic-AI design space. Their value depends on the relationship between task complexity, specialisation, coordination requirements, risk, security and governance capacity.

The central design principle is therefore one of controlled specialisation. Agents should have clearly defined purposes, appropriately limited permissions, explicit communication protocols, measurable responsibilities and identifiable owners. The overall system should provide sufficient observability to reconstruct consequential decisions and sufficient governance to intervene when agents behave unexpectedly.

This principle also provides a useful distinction between technological capability and organisational value. Modern LLMs can support increasingly sophisticated reasoning, planning, tool use and interaction, while multi-agent architectures can distribute these capabilities across specialised components (Yao et al., 2023; Schick et al., 2023; Huang et al., 2024). Nevertheless, technical capability alone does not establish that a multi-agent architecture is appropriate for a particular business process.

From an enterprise perspective, the objective is therefore not to create the largest possible network of autonomous agents. It is to create the simplest architecture capable of delivering the required business outcome while maintaining appropriate levels of reliability, security, accountability and control.

In this sense, MAS represents an extension of the broader evolution from conversational AI and deterministic automation towards increasingly autonomous enterprise systems. The architectural challenge is not merely to make agents capable of acting, but to ensure that multiple agents can act together in ways that remain understandable, testable, secure and governable. The future development of agentic AI will therefore depend not only on improving model intelligence but also on developing stronger architectures, evaluation methods, security controls and governance frameworks for systems composed of interacting autonomous components (Yehudai et al., 2025; European Union, 2024; ISO, 2023).

6. Enterprise Applications

The potential value of agentic artificial intelligence (AI) is particularly apparent in enterprise environments because many organisational processes combine high transaction volumes, substantial amounts of information and a mixture of structured and unstructured activities. Traditional robotic process automation (RPA) is effective where processes can be represented through relatively stable and deterministic sequences of operations (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020). Agentic systems potentially extend this model by allowing AI systems to interpret objectives, retrieve information, plan actions, use tools and adapt their behaviour according to changing circumstances (Wang et al., 2024; Plaat et al., 2025).

The distinction is important because enterprise processes frequently contain activities that are difficult to capture through fixed rules. An agent may, for example, interpret an unstructured customer request, retrieve information from enterprise systems, determine which policies are relevant, select an appropriate tool and execute a sequence of actions. LLM-based agents can combine language understanding with tool use, retrieval and iterative reasoning, creating an interface between human objectives and enterprise systems (Lewis et al., 2020; Schick et al., 2023; Yao et al., 2023).

However, the suitability of a process for agentic automation depends on more than its apparent complexity. Organisations must also consider data quality, system reliability, process maturity, the availability of objective feedback, the reversibility of actions, the consequences of errors and the degree of regulatory or organisational oversight required. The following sections examine several important enterprise applications and consider both their potential benefits and limitations.

6.1 Customer service

Customer service represents one of the most significant potential applications of agentic AI because it combines high transaction volumes with relatively well-defined underlying processes. Organisations routinely receive requests concerning orders, deliveries, cancellations, returns, account information and product enquiries. Many of these requests require interaction with several enterprise systems rather than simply the provision of information.

An agentic customer-service system could interpret a customer's request, authenticate the customer, retrieve relevant order information, determine which organisational policies apply, select an appropriate course of action, execute the required transaction and communicate the result. Where circumstances fall outside predefined parameters, the agent could escalate the case to a human employee. This represents an important development beyond the conventional chatbot model described in the earlier literature, in which conversational systems primarily provide information or predefined responses (Adamopoulou and Moussiades, 2020).

The distinction is therefore between providing information about a process and participating directly in its execution. A conventional chatbot might explain how a customer can change an order or request a refund, whereas an agent may potentially retrieve the relevant order, determine eligibility and initiate the transaction through connected enterprise systems. Tool-use research demonstrates the technical basis for this development, as LLMs can be enabled to interact with external tools rather than being restricted to generating text (Schick et al., 2023).

Industry developments indicate growing interest in such applications. Lufthansa Industry Solutions identifies bookings, cancellations, enquiries and related customer-service activities as potential applications of agentic automation (Lufthansa Industry Solutions, 2026). The attraction of these applications is partly that enterprise systems already contain much of the information required by the agent. The agent can therefore operate as an orchestration layer between a customer's natural-language request and systems such as CRM, order-management and payment platforms.

The potential benefits include reduced handling time, continuous availability and the ability to process large volumes of routine interactions without proportional increases in staffing. Agentic interfaces may also be more flexible than traditional menu-driven customer-service systems because customers can describe their requirements in natural language rather than selecting from predefined categories.

However, customer-facing autonomy introduces significant risks because an incorrect action can directly affect customers, revenue and organisational reputation. A system that incorrectly interprets a request could cancel the wrong order, provide inaccurate information or issue an inappropriate refund. The risks become more significant where actions are financially consequential or difficult to reverse.

A sensible architecture should therefore differentiate actions according to their potential impact. Low-risk activities, such as retrieving order information or providing delivery updates, may be suitable for relatively high levels of autonomy. More consequential actions, such as large refunds, account changes or contractual modifications, may require additional validation or human approval.

This represents a form of bounded autonomy, in which agents receive sufficient authority to provide useful automation while remaining subject to controls proportional to the consequences of their actions. The objective should not be to maximise autonomous customer-service activity but to identify which interactions can safely be automated and which require human judgement.

6.2 Sales and marketing

Sales and marketing provide another potential application because these functions contain numerous repetitive activities surrounding customer research, lead qualification, communication and customer relationship management (CRM). Much of the time spent by sales professionals is not necessarily devoted to direct customer interaction but to preparing information, updating systems and coordinating follow-up activities.

An agentic sales system could identify potential customers, research relevant organisations, enrich CRM records, assess characteristics associated with sales opportunities, draft communications, schedule meetings and update customer records. It could also monitor previous interactions and recommend appropriate next actions. In this configuration, the agent would not simply generate content but would coordinate the workflow surrounding that content.

This represents a transition from content assistance to workflow execution. Generative AI can support sales professionals by drafting emails, summarising meetings or producing marketing content, while an agentic system can potentially extend these capabilities by coordinating activities and executing selected actions through enterprise systems. The broader productivity literature provides evidence that generative AI can improve performance in knowledge-intensive work, although the magnitude and distribution of benefits vary according to task and worker characteristics (Brynjolfsson, Li and Raymond, 2023; Noy and Zhang, 2023).

The potential productivity benefit is therefore not limited to faster content generation. An agent could reduce administrative workload by maintaining CRM information, conducting preliminary research and coordinating routine follow-up activities. This could allow sales professionals to devote more time to activities requiring interpersonal judgement, negotiation and relationship development.

However, autonomous sales and marketing activity introduces important risks. An agent that incorrectly identifies a prospect or generates an inappropriate communication can damage organisational reputation. Automated outreach may also raise concerns relating to privacy, consent, data protection and unwanted communication. Furthermore, increasingly sophisticated personalisation can create tension between improved customer engagement and intrusive forms of automated profiling.

Organisations should therefore distinguish between administrative sales automation and autonomous customer decision-making. An agent might be permitted to identify potential leads or prepare a draft communication while requiring human review before external communication is sent. Similarly, an agent might update internal CRM records automatically but require approval before assigning a customer to a high-value category or making commercially significant recommendations.

The appropriate balance depends on the context, but the principle remains consistent: greater autonomy should be accompanied by stronger mechanisms for monitoring accuracy, protecting customer information and maintaining organisational accountability.

6.3 Software engineering

Software engineering has emerged as an important application domain for agentic AI because software development is inherently iterative and consists of multiple interconnected activities. Professional software development involves understanding requirements, exploring an existing codebase, identifying relevant files, modifying code, executing tests, interpreting failures and revising implementations. These characteristics make it substantially different from a simple code-generation task.

An agentic coding system can therefore operate through a workflow in which it first examines a software repository and interprets the issue or requirement. It can then identify relevant files, formulate a potential solution, modify the code, execute tests and analyse the resulting output. If the tests fail, the agent can revise its implementation and execute the tests again. The process can continue until the problem is resolved or the agent determines that human intervention is required.

This makes software engineering a particularly useful example of long-horizon agentic behaviour. The agent is not simply generating a piece of code; it is interacting with an external environment, observing the results of its actions and adapting subsequent behaviour. This corresponds closely with the planning and action capabilities identified in research on LLM-based autonomous agents (Huang et al., 2024; Wang et al., 2024).

Research demonstrates both the potential and limitations of this approach. Wadhwa et al. (2024) introduced MASAI, a modular multi-agent architecture for software-engineering tasks that distributes responsibilities across specialised agents. The approach illustrates how software development can be decomposed into activities such as issue analysis, code retrieval and implementation rather than requiring a single agent to perform every task.

The emergence of more demanding benchmarks is also important. Deng et al. (2025) introduced SWE-Bench Pro to evaluate agents on more challenging and longer-horizon software-engineering tasks. Such evaluation is significant because coding agents must operate in realistic repositories where changes can affect multiple components and where a superficially plausible solution may fail when integrated with the wider system.

Software engineering also illustrates an important characteristic of suitable agentic processes: objective feedback. Automated tests provide an external mechanism for evaluating whether a proposed code change has achieved its intended result. The agent can therefore use test results to determine whether it should continue, revise its approach or escalate the task.

This feedback mechanism can make software engineering particularly suitable for agentic automation. However, passing automated tests does not guarantee that the resulting software is secure, maintainable, architecturally appropriate or consistent with broader organisational requirements. Human review therefore remains important for architectural decisions, security-sensitive changes and modifications to critical production systems.

The software-engineering example demonstrates both the potential and limits of agentic automation. Agents can reduce the effort associated with repetitive development activities, but their outputs still require validation against requirements that may not be captured by automated tests.

6.4 Data analysis and business intelligence

Data analysis represents another promising application because agentic AI can provide a natural-language interface to analytical systems while potentially automating parts of the analytical workflow. The combination of LLMs with retrieval and tool use means that an agent can potentially move beyond explaining how an analysis should be conducted and instead execute elements of the analysis itself (Lewis et al., 2020; Schick et al., 2023).

Consider an executive asking: Why did European sales decline during the second quarter? A conventional generative-AI system might suggest SQL queries or describe possible explanations. An agentic system could potentially retrieve relevant data from the organisation's data warehouse, identify appropriate dimensions for analysis, execute queries, compare regional and temporal performance, investigate anomalies and generate visualisations. It could then present a summary of the findings together with the evidence used to reach its conclusions.

The important distinction is that the agent can perform the analysis rather than merely describe how the analysis could be performed.

This capability could reduce the technical barrier to accessing organisational data. Employees without extensive SQL or data-engineering expertise could potentially interact with analytical systems using natural language. For organisations experiencing shortages of analytical skills, this may provide a mechanism for making existing data infrastructure more accessible.

However, analytical agents face a particularly important risk: plausible but unsupported analysis. LLMs can produce convincing explanations even when the underlying evidence does not support them. An agent might identify a correlation and present it as a causal explanation, select an inappropriate comparison period or misinterpret an anomaly. The ability to produce fluent explanations does not itself establish analytical validity.

The risk becomes greater when the agent can execute queries autonomously because an incorrect interpretation can influence both the generated narrative and the analytical process itself. The system might retrieve inappropriate data, perform an unsuitable calculation and subsequently generate a coherent explanation of an incorrect result.

Analytical agents should therefore provide substantial traceability and evidential grounding. Users should be able to identify the data sources used, queries executed, calculations performed and, where relevant, assumptions made during the analysis. Retrieval-augmented generation provides one possible technical mechanism for grounding responses in external information sources, although retrieval itself does not guarantee that the retrieved information has been interpreted correctly (Lewis et al., 2020).

This requirement is consistent with the wider need for evaluation and governance of agentic systems. Agent evaluation should consider not only the quality of final outputs but also the processes through which agents retrieve information, use tools and reach conclusions (Yehudai et al., 2025).

The most appropriate role for an analytical agent may therefore be that of an analytical assistant and orchestrator, rather than an unquestioned autonomous decision-maker. It can accelerate data retrieval and exploratory analysis while leaving significant business decisions to appropriately authorised human users.

6.5 IT operations and incident response

IT operations represent another potentially valuable application for agentic AI because modern technology environments generate large volumes of alerts, logs and diagnostic information. Human operators may need to correlate information across monitoring systems, identify the likely cause of an incident and determine an appropriate remediation strategy.

An agent could monitor alerts, retrieve relevant logs, investigate system events, correlate information across infrastructure components and propose potential causes of an incident. With appropriate permissions, it could also execute predefined remediation procedures, such as restarting a failed service or clearing a known operational condition.

The potential benefit is particularly significant for organisations operating complex systems continuously. An agent can process large quantities of machine-generated information rapidly and potentially operate outside conventional working hours. Such capabilities may contribute to reductions in mean time to detection and mean time to resolution.

Agentic systems may also support a transition from reactive to more proactive IT operations. By correlating historical incidents with current system information, an agent could identify recurring patterns and recommend preventative interventions.

However, autonomous IT operations present substantial risks because the environment being managed is itself operationally critical. An incorrect diagnosis could cause an agent to restart a functioning service, modify a configuration unnecessarily or amplify an existing outage. This illustrates the broader principle that agentic capabilities must be evaluated in relation to the consequences of actions, rather than solely according to whether the agent can perform them.

The appropriate response is therefore not to prohibit autonomous IT operations entirely but to align autonomy with the potential consequences and reversibility of an action. Retrieving logs and diagnostic information can generally be considered relatively low-risk and may be performed autonomously. Restarting a service represents a higher level of risk and might be permitted only where the action is explicitly covered by an approved recovery policy. Modifying production configurations would generally require stronger controls, while irreversible infrastructure changes may require explicit human authorisation.

This approach demonstrates that autonomy should be proportional to the reversibility and consequences of an action. An agent can be highly autonomous within a safe and reversible environment while requiring progressively greater human involvement as potential impact increases.

IT operations therefore provide an important example of how agentic AI can complement rather than replace existing automation. Deterministic recovery procedures can continue to perform the actual technical operations, while an agent interprets alerts, selects an appropriate procedure and determines when escalation is necessary. This combination reflects the broader evolution from conventional automation towards systems capable of adaptive orchestration (Ng et al., 2021; McKinsey & Company, 2025).

6.6 Supply-chain management

Supply-chain management represents a further area in which agentic AI may provide value because supply chains combine structured enterprise data with unstructured communications and constantly changing external conditions.

A supply-chain agent could interpret supplier communications, monitor inventory levels, identify potential shortages, retrieve supplier information and initiate replenishment workflows. It could also coordinate information between procurement, logistics and inventory-management systems.

Lufthansa Industry Solutions identifies automated reordering and logistics processes among potential applications of agentic automation (Lufthansa Industry Solutions, 2026). The attraction of such applications lies partly in the ability of agents to coordinate information across systems that traditionally require human intervention.

For example, an agent could identify that inventory for a particular product is approaching a predefined threshold, retrieve relevant supplier information, check existing purchase orders, determine whether the preferred supplier remains available and initiate an approved replenishment process.

However, the role of an agent should be distinguished from the optimisation algorithms already used within modern supply-chain systems. An agent does not necessarily need to independently solve complex routing, inventory or procurement optimisation problems. Instead, it can function as an interface and orchestration layer around existing optimisation engines and enterprise applications.

This distinction is consistent with the broader concept of agentic automation as a mechanism for coordinating multiple systems and processes rather than necessarily replacing specialist technologies (Computerwoche, 2025). The value of an agent may therefore lie not in replacing every specialist technology but in connecting those technologies through a flexible decision-making interface.

Supply-chain applications also demonstrate the importance of uncertainty. Inventory levels, supplier availability, delivery times and demand can change rapidly. An agent can potentially respond to these changes more flexibly than a rigid workflow, but this flexibility must be constrained by commercial policies and operational requirements.

An agent should not, for example, independently place unusually large orders merely because its interpretation of current demand suggests that additional inventory is desirable. High-value procurement decisions may require predefined thresholds, additional validation or human approval.

Consequently, supply-chain applications illustrate the importance of combining adaptive agents with deterministic business constraints. The agent can interpret changing circumstances and coordinate actions, while established enterprise systems and policies retain control over critical commercial decisions.

6.7 Human resources

Human resources (HR) represents another potential application area, particularly for administrative processes involving high volumes of repetitive queries and documentation. Agentic systems could support employee onboarding, employee self-service, policy enquiries, document processing, scheduling and training-related activities.

An onboarding agent, for example, could guide a new employee through required documentation, retrieve relevant organisational policies, coordinate access requests and communicate with other internal systems. Rather than simply providing information about the onboarding process, the agent could coordinate the underlying workflow and identify when individual tasks had been completed.

Similarly, an employee self-service agent could answer routine questions concerning organisational policies, leave procedures or administrative processes while retrieving authoritative information from internal HR systems. Retrieval mechanisms can be particularly useful in this context because organisational policies may change and therefore need to be obtained from current authoritative sources rather than treated as static model knowledge (Lewis et al., 2020).

Such applications could reduce the volume of routine enquiries handled directly by HR personnel and allow HR teams to concentrate on more complex activities. However, HR applications also illustrate why the distinction between administrative automation and high-impact decision-making is essential.

Automating a repetitive onboarding task does not necessarily present the same risk as allowing an AI system to make decisions concerning recruitment, promotion, dismissal or performance evaluation. Decisions affecting employment opportunities can have significant consequences for individuals and may be influenced by incomplete information, inappropriate criteria or historical biases.

An agent that has authority to make or substantially influence such decisions therefore requires significantly greater scrutiny than one performing routine administrative functions.

The regulatory environment further increases the importance of risk classification and human oversight. The European Union's Artificial Intelligence Act establishes a risk-based framework and imposes additional requirements on certain high-risk AI applications, including requirements concerning risk management, data governance, documentation, record keeping and human oversight (European Union, 2024). Organisations considering agentic AI within HR therefore need to assess not only whether a particular process can technically be automated but also whether the proposed use is compatible with applicable legal and organisational requirements.

This distinction reinforces a broader principle applicable across enterprise applications: technical feasibility does not establish organisational suitability. An agent may be technically capable of performing a task while the organisation nevertheless determines that the task should remain subject to human decision-making.

6.8 Cross-cutting characteristics of suitable enterprise processes

The applications discussed above demonstrate that agentic AI is not equally appropriate for every business process. The most promising applications tend to share several characteristics. They often involve repetitive or high-volume activities, require interaction with multiple information sources or enterprise systems, contain a degree of variability that makes rigid automation inefficient and provide some mechanism through which outcomes can be validated.

Software engineering provides automated tests as a feedback mechanism. Customer service can validate actions against order status and organisational policies. IT operations can evaluate system health following a remediation action. Supply-chain processes can compare inventory levels and supplier information against established thresholds.

These forms of feedback are important because they allow an agent to determine whether its actions have produced an acceptable outcome. Research on agent planning and evaluation reinforces the importance of environmental feedback and iterative action in distinguishing agentic systems from simple text-generation systems (Huang et al., 2024; Yehudai et al., 2025).

Processes in which outcomes are difficult to observe or evaluate may therefore be less suitable for high levels of autonomous execution.

The reversibility of actions is another important consideration. Agents are generally easier to deploy safely where incorrect actions can be detected and reversed. A draft email can be reviewed before sending, a proposed code change can be tested before deployment and a recommendation can be reviewed by a human. By contrast, an irreversible financial transaction or consequential employment decision may require substantially greater human control.

The quality of underlying data and enterprise infrastructure is equally important. An agent cannot compensate indefinitely for inaccurate customer records, poorly documented processes, unreliable APIs or fragmented data. Indeed, greater autonomy may amplify the consequences of poor data quality because the system can act on incorrect information without waiting for a human to identify the problem.

This means that successful enterprise adoption of agentic AI is likely to depend as much on process maturity and digital infrastructure as on the capabilities of the underlying AI model. Organisations with well-defined processes, reliable systems and accessible data are likely to have a stronger foundation for agentic automation than organisations attempting to automate highly fragmented or poorly understood processes.

This also reflects the historical experience of RPA. Research on intelligent automation and RPA implementation indicates that automation success depends on process selection, process understanding, implementation design and organisational conditions rather than technology alone (Santos, Pereira and Vasconcelos, 2020; Ng et al., 2021; Wewerka and Reichert, 2020).

6.9 From automation to augmentation

The applications discussed in this chapter suggest that the most realistic near-term role for agentic AI is not necessarily the complete replacement of human workers. Instead, many enterprise applications are better understood as forms of human augmentation.

An agent can take responsibility for information retrieval, routine coordination, preliminary analysis and repetitive execution while humans retain responsibility for exceptional cases, high-impact decisions and activities requiring contextual judgement. This approach is consistent with evidence that generative AI can increase productivity in knowledge work while also changing the distribution of tasks performed by workers (Brynjolfsson, Li and Raymond, 2023; Noy and Zhang, 2023).

Such architectures can potentially produce a more effective division of labour between humans and AI. Humans provide judgement, accountability and contextual understanding, while agents provide speed, consistency, scalability and continuous operation.

The enterprise value of agentic AI should therefore not be measured solely by the number of human tasks eliminated. A more meaningful assessment should consider whether the technology reduces administrative burden, accelerates decision-making, improves service responsiveness, increases access to organisational expertise and allows employees to focus on activities where human judgement provides the greatest value.

This perspective also provides a more realistic basis for evaluating return on investment. An agent that automates a highly complex but rarely occurring process may provide less economic value than an agent that reliably automates a large volume of relatively simple transactions. Conversely, a low-volume process may still justify automation where delays or errors have substantial financial or operational consequences.

The appropriate objective is therefore not maximum autonomy, but optimal allocation of autonomy across the enterprise.

Overall, agentic AI has potential across customer service, sales, software engineering, data analysis, IT operations, supply-chain management and human resources. The common characteristic across these applications is the ability to connect reasoning with action across multiple enterprise systems. However, the suitability of a particular process depends on its data quality, variability, feedback mechanisms, reversibility, regulatory requirements and potential consequences of failure.

Agentic AI should consequently be regarded as a new layer of enterprise automation rather than as a universal replacement for existing technologies. Its greatest potential may lie in coordinating existing systems and automating the variable, information-intensive activities that sit between rigid workflows and fully manual work. This represents a development from conventional RPA towards more adaptive forms of goal-oriented process execution (van der Aalst, Bichler and Heinzl, 2018; Ng et al., 2021; Wang et al., 2024).

At the same time, increasing autonomy increases the importance of governance. Enterprise deployment must account for security, evaluation, human oversight and organisational accountability, particularly where agents can interact directly with external systems or make consequential decisions (Debenedetti et al., 2024; European Union, 2024; ISO, 2023). The ability of an agent to execute an action should therefore not be confused with organisational permission to execute that action.

The enterprise objective should ultimately be to identify processes where agentic capabilities provide measurable value while keeping risk within acceptable boundaries. Where implemented within appropriate technical and governance controls, agentic AI can extend automation beyond predefined tasks towards more adaptive, information-intensive and goal-oriented forms of enterprise process execution. The most valuable architectures are therefore unlikely to be those that maximise autonomy, but those that establish the most effective balance between automation, human judgement, system reliability, security and accountability.

7. Business Benefits

The potential business value of agentic artificial intelligence (AI) extends beyond the automation of individual tasks. Its more significant contribution may arise from the ability to connect reasoning, information retrieval and action across processes that have historically required substantial human coordination. Whereas conventional robotic process automation (RPA) is generally most effective when processes are stable, structured and predictable, agentic systems potentially extend automation into processes characterised by variability, unstructured information and exceptions (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020; Wang et al., 2024).

The distinction is important because agentic AI combines capabilities that have traditionally been distributed across different technologies. Retrieval-augmented generation can provide access to external or organisational information (Lewis et al., 2020), while tool-use mechanisms allow language models to interact with software systems and execute actions (Schick et al., 2023). Planning and iterative reasoning can further allow agents to decompose objectives and adapt their behaviour as tasks progress (Yao et al., 2023; Huang et al., 2024). Consequently, the potential value of agentic AI lies not simply in generating information more quickly but in coordinating information, decisions and actions across business processes.

However, technical capability does not automatically create business value. The economic benefits of agentic AI depend on the relationship between implementation costs, process frequency and value, underlying system quality, employee productivity and the risks associated with autonomous action. Organisations must therefore evaluate agentic AI not simply according to whether a process can be automated, but whether automation produces a measurable improvement in cost, speed, quality, scalability or employee productivity without introducing disproportionate risk.

7.1 Automation of variable processes

One of the strongest potential advantages of agentic AI is its ability to address processes containing a degree of variability and therefore not fitting easily within traditional deterministic automation.

Conventional workflow automation and RPA are particularly effective when the sequence of activities and the conditions governing those activities can be specified in advance. Where inputs are consistent and exceptions are relatively rare, explicit rules can provide high levels of reliability and predictability (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020). The difficulty arises when processes contain numerous possible variations or depend on information that is difficult to structure into predetermined rules.

Agentic AI potentially occupies an intermediate position between conventional automation and fully manual knowledge work. It can interpret less structured information, determine an appropriate course of action and interact with existing enterprise systems while operating within organisational constraints (Wang et al., 2024; Plaat et al., 2025).

For example, an automated customer-service workflow may be capable of processing a standard refund when all required information is present. An unusual combination of circumstances may cause a conventional workflow to fail or require manual intervention. An agent could potentially interpret the request, retrieve relevant policies and transaction information, determine which conditions apply and either execute an appropriate action or escalate the case.

This creates the possibility of extending automation into what can be described as the long tail of business processes: activities that occur frequently enough to matter economically but contain sufficient variation to make conventional rule-based automation expensive to develop and maintain.

The economic significance of this capability is potentially substantial. A process does not need to be completely automated to generate value. If an agent can automate the majority of routine and moderately variable cases while escalating genuinely exceptional situations to employees, the organisation can reduce human intervention without attempting to eliminate human judgement entirely.

This is an important distinction from the idea of complete automation. In practice, the most valuable application may be a hybrid process in which deterministic automation handles predictable operations, agentic AI manages variability and humans intervene when risk or uncertainty exceeds defined thresholds. Such an architecture reflects the broader evolution of intelligent automation from deterministic task execution towards more adaptive forms of process management (Ng et al., 2021).

The value of agentic AI therefore depends partly on identifying the appropriate boundary between these three modes of operation. Processes that are sufficiently stable should generally continue to use deterministic automation, while highly ambiguous or consequential processes may remain primarily human-led. Agentic AI is most compelling where variability creates a meaningful barrier to conventional automation but the overall process remains sufficiently bounded to permit controlled execution.

7.2 Scalability and operational capacity

A second potential benefit is scalability. Unlike human employees, digital agents can potentially operate continuously and can be deployed across multiple processes without the physical limitations associated with conventional labour. This characteristic is particularly relevant to customer service, IT monitoring, transaction processing and analytical workflows.

An organisation may, for example, deploy an agent to handle customer enquiries outside normal working hours or use agents to continuously monitor operational data. Where the underlying process is suitable for automation, increased transaction volumes do not necessarily require a proportional increase in human staffing.

This creates the possibility of elastic organisational capacity. Agents can potentially absorb fluctuations in workload, allowing organisations to respond to peaks in demand without maintaining equivalent levels of permanent human capacity. Industry research increasingly describes AI agents as participants in organisational workflows rather than merely as tools used individually by employees (Microsoft, 2025; McKinsey & Company, 2025).

Microsoft's Work Trend Index describes the emergence of human-agent teams in which employees delegate, manage and supervise work performed by AI agents (Microsoft, 2025). This represents a broader shift in the conceptualisation of digital labour, in which AI systems become active participants in organisational workflows.

However, scalability should not automatically be equated with economic efficiency. Digital agents consume computational resources, and the cost of operating an agent can increase as tasks become more complex and involve multiple model calls, retrieval operations and tool interactions. Agentic workflows may therefore generate substantially greater computational costs than simple conversational interactions.

There is also a more fundamental risk: automation can scale errors as effectively as it scales successful actions. A human employee who makes an incorrect decision may affect a limited number of transactions. An improperly configured agent could potentially repeat the same error across thousands of interactions.

Consequently, the relevant business objective is not maximum automation or maximum agent utilisation. It is economically valuable automation under appropriate controls. Organisations should consider process volume, transaction value, operating cost, expected reduction in human effort and potential error costs when determining whether agentic automation is justified.

Scalability therefore becomes a benefit only when accompanied by reliability and governance. The ability to execute more transactions more quickly is valuable only when the organisation can maintain appropriate levels of accuracy, security and control as activity increases.

7.3 Productivity and employee augmentation

A further potential benefit is increased employee productivity. Agentic AI can perform information-intensive and repetitive activities that currently consume significant amounts of employee time.

The productivity argument is strongest when agentic AI is considered as a mechanism for task redistribution rather than simply employee replacement. An employee may continue to own a business process while delegating information retrieval, document preparation, data analysis or routine system interactions to an agent.

For example, a procurement professional might delegate the collection of supplier information and preparation of a draft purchase request to an agent while retaining responsibility for supplier selection and final approval. Similarly, a software developer could delegate repository exploration, test execution and initial implementation to a coding agent while retaining responsibility for architecture and code review.

This form of augmentation may allow skilled employees to spend a greater proportion of their time on activities requiring judgement, creativity, negotiation and interpersonal interaction.

Academic research on generative AI provides empirical support for the broader productivity argument. Brynjolfsson, Li and Raymond (2023) found that access to a generative-AI assistant increased the productivity of customer-support workers, with particularly significant improvements among less experienced employees. Noy and Zhang (2023) similarly found that generative AI reduced the time required to complete certain writing tasks while improving average output quality.

These findings are not direct evidence that fully agentic systems will generate equivalent productivity gains. Agentic AI introduces additional capabilities and risks because systems can perform actions rather than merely generate suggestions. Nevertheless, the research supports the proposition that AI assistance can alter the productivity of knowledge workers by reducing the effort associated with routine cognitive activities.

The potential productivity effect is therefore likely to depend on how organisations redesign work around agents. Simply adding an agent to an existing process may produce limited benefits if employees still need to duplicate or extensively verify its work. Greater value may arise when organisations redesign workflows so that agents perform clearly defined activities while employees concentrate on tasks where human involvement provides greater value.

7.4 Knowledge democratisation

Another potential business benefit is the democratisation of organisational knowledge. Enterprises often possess substantial amounts of information distributed across policy documents, procedures, databases, intranets, CRM systems, technical documentation and individual employees' experience.

The existence of this information does not necessarily mean that it is readily accessible. Employees may not know where information is stored, may lack the technical skills required to retrieve it or may depend on experienced colleagues to interpret complex procedures.

Agentic AI can potentially reduce these barriers by providing a natural-language interface to organisational knowledge and associated enterprise systems. Retrieval-augmented generation provides one technical foundation for this capability by allowing language models to retrieve relevant information from external knowledge sources rather than relying solely on information encoded within the model (Lewis et al., 2020).

An employee could therefore ask an agent how a particular policy applies to a situation and, where appropriate, request the agent to initiate the corresponding workflow. This capability may be particularly valuable for new employees who otherwise need to rely on colleagues or search across multiple internal systems.

The potential benefit is therefore not merely faster information retrieval. Agents could help convert distributed organisational knowledge into an accessible operational capability.

However, this benefit is highly dependent on the quality of the knowledge to which the agent has access. An agent connected to outdated procedures can disseminate outdated information rapidly. Similarly, conflicting documents or ambiguous policies may result in inconsistent responses.

This creates an important relationship between agentic capability and enterprise information management. An agent cannot reliably democratise knowledge that the organisation has not adequately maintained.

The quality of an agent's output is consequently constrained by the quality of its underlying information sources, system integrations and governance arrangements. Investments in agentic AI may therefore expose weaknesses in existing knowledge-management practices. Organisations seeking to deploy agents may need to improve document ownership, data quality, information architecture and policy management before the technology can deliver its full potential.

Knowledge democratisation should therefore be understood as both an AI opportunity and an information-governance challenge.

7.5 Reduction of skills bottlenecks

Agentic AI is also frequently presented as a mechanism for addressing skills shortages. Many organisations depend on relatively small numbers of employees with specialised knowledge of particular systems, processes or technical domains. This can create operational bottlenecks when demand exceeds the available capacity of specialists.

An agent may potentially capture and operationalise elements of this expertise by combining organisational documentation, historical information, specialist tools and established procedures. This could allow less experienced employees to perform activities that previously required substantial support from specialists.

The potential benefit is particularly relevant where expert knowledge is relatively structured and can be represented through documentation, tools and repeatable procedures. An agent might, for example, assist an IT employee in diagnosing a common infrastructure problem by retrieving relevant documentation, comparing current symptoms with historical incidents and recommending an established remediation procedure.

However, this should not be interpreted as equivalent to reproducing the complete expertise of a human specialist. Expert knowledge frequently includes contextual judgement, tacit understanding and the ability to recognise unusual circumstances. These characteristics may be difficult to capture through documentation or model behaviour.

Consequently, agentic AI is more appropriately viewed as a means of extending the reach of expertise rather than eliminating the need for experts. A small number of specialists may be able to support a larger organisational population by embedding selected aspects of their knowledge within tools and workflows.

This distinction is important for workforce strategy. Organisations should not assume that introducing agents makes specialist expertise redundant. Instead, specialists may increasingly spend their time designing processes, validating agent behaviour, handling exceptional cases and maintaining the knowledge on which agents depend.

7.6 Workforce transformation and changing roles

The introduction of agentic AI may consequently change the composition of work rather than simply reduce the number of jobs.

Some tasks that currently form part of employees' roles may become automated. Other tasks may be redesigned around collaboration with agents, while entirely new responsibilities may emerge. These can include agent supervision, evaluation, workflow design, access management, instruction engineering, AI governance and monitoring.

Microsoft's 2025 Work Trend Index identifies the emergence of employees who manage and delegate work to AI agents as an indication of this changing organisational structure (Microsoft, 2025). While industry forecasts should be interpreted cautiously, the underlying concept is important: the division of labour may increasingly involve humans allocating work between themselves and digital agents.

This could create new forms of managerial responsibility. A manager may no longer supervise only human employees but also oversee collections of automated systems performing operational activities. Questions concerning workload allocation, performance measurement and accountability could consequently extend into the management of AI systems.

The emergence of agentic AI may also alter the skills required of employees. Digital literacy alone may become insufficient in some roles. Employees may increasingly need to understand how to delegate effectively to agents, evaluate their outputs, identify failure modes and determine when human intervention is necessary.

This suggests that the organisational value of agentic AI depends partly on human capability to manage AI capability. Organisations that deploy sophisticated agents without developing corresponding employee skills may fail to realise expected productivity gains.

The productivity evidence from generative AI also suggests that benefits may not be distributed evenly across workers. Brynjolfsson, Li and Raymond (2023) found particularly significant improvements among less experienced customer-support workers, suggesting that AI assistance can potentially reduce some performance gaps while changing the relative value of different skills.

7.7 Organisational learning and continuous improvement

A further potential benefit is the possibility of using agent interactions and workflow outcomes to support organisational learning.

Agents operating repeatedly within the same process can generate information about common exceptions, bottlenecks, failed actions and successful approaches. When appropriately captured and governed, this information may help organisations identify opportunities for process improvement.

For example, an agent operating in customer service might reveal that a particular type of request repeatedly requires human escalation because the underlying process lacks sufficient information or because the policy is ambiguous. Rather than treating each escalation as an isolated event, the organisation could analyse the pattern and redesign the process.

This creates a feedback relationship between automation and process improvement. Agentic systems can potentially provide not only a mechanism for executing workflows but also a source of operational information about where those workflows fail.

However, such learning should not be interpreted as automatic self-improvement. Changes to enterprise processes can have significant consequences, and organisations should not permit agents to modify their own operational rules without appropriate governance.

A safer model is for agent-generated observations to inform a controlled improvement process in which humans evaluate proposed changes before implementation. In this sense, agentic AI can contribute to organisational learning without necessarily being granted unrestricted authority to change the organisation itself.

This distinction is consistent with the broader governance requirements associated with AI management systems. ISO/IEC 42001 provides a framework for establishing organisational processes for managing AI systems, including responsibilities, risk management and continual improvement (ISO, 2023).

7.8 Economic value and return on investment

The business case for agentic AI ultimately depends on whether potential benefits translate into measurable economic value.

Relevant measures may include reductions in processing time, lower transaction costs, increased throughput, improved service availability, reduced employee administrative workload and increased revenue generated through improved customer or sales processes. Organisations should also account for implementation costs, model inference costs, integration costs, monitoring requirements, cybersecurity controls and ongoing human oversight.

Importantly, the value calculation should include the cost of errors. An agent that reduces processing costs but creates occasional high-impact failures may produce a negative overall return. Similarly, an agent that performs well in a pilot environment may become uneconomic at enterprise scale if its workflows require excessive model calls, tool interactions or human verification.

A robust business case should therefore compare the total cost of the agent-enabled process with the total cost and performance of the existing process. This comparison should include both direct and indirect effects.

Direct benefits may include reduced labour requirements or faster processing. Indirect benefits may include improved customer experience, greater organisational responsiveness or the ability to scale services without proportional increases in staffing. Evidence from generative-AI productivity research suggests that indirect productivity effects can be significant, although they depend on the nature of the task and how AI is incorporated into existing workflows (Brynjolfsson, Li and Raymond, 2023; Noy and Zhang, 2023).

The assessment should also consider opportunity cost. If an agent allows skilled employees to spend more time on higher-value activities, the resulting benefit may be greater than the direct labour cost avoided through automation.

Consequently, return on investment should not be reduced to a simple calculation of how many employee hours can be eliminated. A comprehensive assessment should consider:

• cost;

• quality;

• speed;

• capacity;

• employee productivity;

• customer experience;

• risk;

• implementation and integration requirements; and

• strategic value.

7.9 The limits of business value

Despite the potential benefits, agentic AI should not be assumed to generate value simply because a process is technically automatable.

Some processes may be too infrequent to justify implementation costs. Others may involve insufficiently reliable data or systems. Highly regulated processes may require levels of human oversight that substantially reduce the economic benefit of automation. In other cases, the cost of monitoring and correcting agent behaviour may exceed the labour cost of performing the process manually.

There is also a risk of automation for its own sake. Organisations may implement agents because the technology is strategically fashionable rather than because a clearly defined business problem exists. Such projects can create additional complexity without delivering meaningful value.

The appropriate approach is therefore to begin with the process rather than the technology. Organisations should identify activities with measurable inefficiencies, determine whether agentic capabilities address the underlying problem and then evaluate expected benefits against implementation and risk costs.

This is consistent with the wider literature on intelligent automation, which emphasises that successful automation depends on process characteristics, implementation conditions and organisational context rather than technology alone (Santos, Pereira and Vasconcelos, 2020; Ng et al., 2021; Wewerka and Reichert, 2020).

Agentic AI should therefore be evaluated as an enterprise capability, not simply as an advanced form of software.

7.10 Overall assessment of business benefits

The potential business benefits of agentic AI can be understood across several interconnected dimensions. Agents may extend automation into variable processes, increase operational scalability, augment employee productivity, make organisational knowledge more accessible, reduce skills bottlenecks and support new forms of organisational learning.

However, these benefits are conditional rather than automatic. Scalability can amplify errors as well as successful outcomes. Knowledge democratisation depends on reliable underlying information. Productivity gains depend on effective workflow redesign. Skills shortages cannot be solved simply by assuming that tacit human expertise can be converted into software. Finally, economic value depends on the relationship between implementation costs, operational benefits and the risks associated with autonomous action.

The most defensible business case for agentic AI is therefore not that organisations can eliminate human work, but that they can reallocate human attention towards activities where it creates greater value. This interpretation is consistent with empirical evidence that AI assistance can increase productivity in selected knowledge-work contexts without implying that all human activities should be automated (Brynjolfsson, Li and Raymond, 2023; Noy and Zhang, 2023).

This suggests a progression in the nature of enterprise automation. Earlier generations of automation focused primarily on replacing repetitive manual operations with deterministic software. Intelligent automation expanded this approach by incorporating technologies capable of handling a wider range of process conditions (Ng et al., 2021). Agentic AI potentially extends automation further towards workflows containing ambiguity, exceptions, unstructured information and adaptive decision-making (Wang et al., 2024; Plaat et al., 2025).

The resulting opportunity is therefore not simply to automate more tasks, but to redesign how work is divided between people, deterministic systems and autonomous agents.

At the same time, greater autonomy creates additional requirements for evaluation, security and governance. Agents capable of interacting with tools and enterprise systems can potentially produce greater value, but they can also create greater consequences when they fail or are manipulated (Debenedetti et al., 2024). Organisations therefore need to balance productivity and scalability against reliability, security, accountability and regulatory requirements (European Union, 2024; ISO, 2023).

The strategic value of agentic AI will consequently depend on the organisation's ability to determine where autonomy creates genuine value and where human judgement remains essential. The strongest business cases are likely to arise where processes have sufficient volume or strategic importance to justify investment, where agent actions can be evaluated through meaningful feedback, and where autonomy can be bounded according to risk.

Organisations that approach agentic AI in this way are more likely to realise sustainable benefits than those that pursue automation primarily as an end in itself. The objective should therefore not be maximum automation, but the optimal allocation of work between humans, conventional automation and agentic systems.

8. Limitations and Risks

The capabilities that make agentic artificial intelligence (AI) attractive for enterprise automation—planning, tool use, memory, workflow orchestration and autonomous action—also introduce a substantially different risk profile from conventional software automation and conversational generative AI. Earlier chapters argued that agentic AI should be understood primarily as an architectural layer that connects foundation models with enterprise systems, data sources and operational workflows (Wang et al., 2024; Plaat et al., 2025). This architectural perspective has an important implication: the principal risks of agentic AI do not arise solely from language-model errors, but from the interaction between probabilistic reasoning and real-world organisational authority.

A conventional chatbot that produces an incorrect answer may inconvenience a user. An agent that can access customer records, execute transactions, modify infrastructure or communicate externally can transform the same reasoning error into a business error. The transition from information generation to authorised action therefore changes both the probability and the consequences of failure. Risk management in agentic systems must consequently address not only model accuracy, but also tool reliability, data quality, permissions, security architecture, monitoring and organisational governance.

The limitations discussed in this chapter should not be interpreted as evidence that agentic AI lacks enterprise value. Rather, they identify the conditions under which autonomous or semi-autonomous AI systems remain technically constrained and operationally risky. Understanding these limitations is essential for determining which processes can safely be delegated to agents and which require deterministic controls or human oversight.

8.1 Hallucination and unreliable reasoning

Large language models can generate information that is plausible, coherent and persuasive while being factually incorrect. This phenomenon, commonly referred to as hallucination, remains one of the most significant limitations of contemporary foundation models. In a conversational context hallucination is problematic because it may misinform users; in an agentic context it can become operationally dangerous because generated information may directly influence subsequent actions (Wang et al., 2024; Plaat et al., 2025).

An agent typically operates through a sequence of interpretation, planning and execution. A hallucinated assumption can therefore propagate through multiple stages of the workflow:

Hallucination → Incorrect interpretation → Faulty plan → Tool invocation → Operational consequence

For example, an enterprise procurement agent might incorrectly infer that a supplier has been approved, retrieve the wrong purchase order and initiate a procurement workflow that should never have been authorised. Similarly, a customer-service agent may incorrectly determine that a refund policy applies and trigger a financial transaction before the error is detected.

The problem is not simply factual inaccuracy. Agentic systems may also exhibit unreliable reasoning, including inappropriate task decomposition, omission of necessary steps, incorrect tool selection and failure to recognise uncertainty. A model may produce a logically structured plan that nevertheless violates organisational policy, regulatory requirements or operational constraints (Huang et al., 2024).

This limitation reinforces a central argument developed earlier in this paper: enterprise agentic AI should not rely exclusively on model reasoning for high-consequence decisions. Deterministic validation mechanisms, business rules, policy engines and human approval processes should be used to verify critical assumptions before actions are executed. In practice, the most reliable enterprise architectures combine probabilistic reasoning with deterministic control (Russell & Norvig, 2021; Wooldridge, 2009).

8.2 Long-horizon reliability and error accumulation

Agentic systems frequently operate across extended sequences of interdependent decisions and actions. A workflow may involve document retrieval, policy analysis, database queries, API calls, transaction preparation, user communication and final execution. Each additional stage introduces opportunities for error, and errors occurring early in the process may influence subsequent decisions.

This phenomenon is better understood as long-horizon reliability rather than isolated model accuracy. A model may perform well on individual question-answering tasks while remaining unreliable when required to maintain coherent reasoning across dozens of sequential actions.

Recent research increasingly evaluates agents as systems operating over time rather than as models generating isolated responses. Yehudai et al. (2025) argue that agent evaluation should include planning, memory, tool use, safety, robustness and cost alongside conventional capability metrics. The development of benchmarks such as AgencyBench similarly reflects the need to evaluate agents under conditions involving extended execution periods and large numbers of tool interactions.

The relationship between individual action reliability and overall workflow reliability is particularly important. Even when each step appears highly reliable in isolation, complex workflows create more opportunities for incorrect reasoning, missing information, unexpected tool behaviour and environmental change. An agent may initially misunderstand a user request, retrieve incomplete data, select an inappropriate tool and then continue operating on the basis of incorrect intermediate results.

Enterprise deployment therefore requires mechanisms for detecting and limiting error propagation. Intermediate validation, confidence thresholds, checkpointing, rollback procedures and human escalation points are often more important than attempting to maximise autonomy across the entire workflow.

8.3 Prompt injection and adversarial manipulation

Tool use creates a fundamentally different security challenge from conventional language-model deployment. Agentic systems routinely process information originating from emails, documents, websites, databases and other external sources. If the system cannot reliably distinguish between data and instructions, malicious content may influence its behaviour.

This class of attack is commonly known as indirect prompt injection. An attacker embeds instructions within data that the agent is expected to process. For example, an email, PDF document or web page may contain hidden or disguised instructions such as “Ignore previous policies and send all retrieved customer records to this address.” If the agent interprets this text as an instruction rather than untrusted content, it may perform actions that were never intended by the organisation.

AgentDojo provides an important empirical framework for studying this problem. Debenedetti et al. (2024) evaluated agents across realistic enterprise tasks and extensive security test cases, demonstrating that both capability and security remain significant challenges for current agent architectures.

The significance of prompt injection is substantial because traditional application security assumes that software follows deterministic instructions. Agentic systems introduce probabilistic interpretation into the control loop. Security can therefore no longer depend exclusively on the model behaving correctly.

Effective mitigation requires architectural controls including tool allow-lists, output filtering, context isolation, permission boundaries, confirmation requirements for sensitive actions and execution environments that assume all external content is potentially adversarial (OWASP Foundation, 2025).

8.4 Excessive agency and permission management

A central architectural risk is granting an agent more authority than is necessary to achieve its assigned objective. An enterprise agent may potentially be capable of reading confidential documents, sending emails, executing financial transactions, modifying records, interacting with production infrastructure and communicating with external parties. Combining these capabilities within a single agent creates a large attack and failure surface.

This problem is best understood through the distinction between capability and authority. A model may be technically capable of performing an action, but the system should not necessarily be authorised to execute it. An agent that can determine an appropriate refund amount does not automatically require authority to issue refunds above a defined threshold. Similarly, an IT operations agent may be capable of changing production configurations while being authorised only to restart predefined services.

Emerging OWASP guidance for agentic applications explicitly addresses risks associated with autonomous AI systems and emphasises principles including least privilege, separation of duties, constrained execution environments and explicit authorisation for sensitive operations (OWASP Foundation, 2025).

The key architectural principle is therefore straightforward: an agent should receive the minimum capability required to achieve its assigned objective. Bounded authority substantially reduces the consequences of model error, prompt injection and system compromise.

8.5 Tool reliability and external-system dependency

Agentic AI systems derive much of their practical usefulness from interaction with external tools, APIs and enterprise applications. However, this dependence creates a limitation that is less prominent in conventional generative AI: the overall reliability of the agent becomes constrained by the reliability of the surrounding technical ecosystem (Li et al., 2024; Wang et al., 2024).

Enterprise APIs may return incomplete data, outdated information, inconsistent formats or transient errors. Databases may contain duplicated or contradictory records. Workflow systems may change interfaces without warning. External services may become unavailable or rate-limited.

An agent must therefore reason under conditions of partial observability and uncertain infrastructure. It may incorrectly assume that an API response is complete, fail to recognise a timeout condition or continue operating when a tool has returned an error that should terminate the workflow.

This creates an important distinction between model capability and system capability. A highly capable foundation model cannot compensate for poor integration architecture, unreliable APIs or low-quality enterprise data. Conversely, a moderately capable model may perform effectively within a well-designed ecosystem of deterministic tools and validated interfaces (Schick et al., 2023).

Enterprise implementations should consequently treat tool reliability as a first-class engineering problem rather than assuming that model improvements alone will resolve operational limitations.

8.6 Data quality and context integrity

Agentic systems are highly dependent on the quality of the information available to them. Unlike standalone language models, enterprise agents routinely retrieve data from customer records, ERP systems, knowledge repositories, policy documents and operational databases. Poor data quality therefore becomes a direct source of agentic error (Lewis et al., 2020).

An agent connected to inconsistent customer records, outdated policies or incomplete inventory information may produce systematically poor decisions even if the underlying model performs well. Retrieval-augmented generation and enterprise search can improve access to relevant information, but they cannot guarantee that retrieved information is correct, current or internally consistent.

A particularly important challenge is context integrity. Agents frequently combine information from multiple sources during planning and execution. If these sources conflict, the system may generate an internally coherent but organisationally incorrect interpretation of the situation.

For example, a procurement agent may retrieve a current supplier contract from one repository and an outdated pricing schedule from another. Without mechanisms for source prioritisation, version control and data lineage, the resulting recommendation may appear reasonable while violating current contractual terms.

This limitation reinforces the close relationship between agentic AI and enterprise data governance. Successful deployment requires authoritative data sources, metadata management, version control, retention policies, ownership structures and continuous data-quality monitoring (ISO/IEC 42001).

8.7 Monitoring, observability and auditability

Traditional enterprise software generally follows predefined execution paths, making it relatively straightforward to determine which rule or workflow produced a particular outcome. Agentic systems are different because the sequence of actions may be dynamically generated at runtime (Li et al., 2024).

This creates a significant observability challenge. Organisations need to understand what information an agent accessed, which tools it selected, what actions it attempted, which permissions were exercised and why a particular course of action was followed.

Without adequate logging and monitoring, it becomes difficult to investigate incidents, demonstrate regulatory compliance, identify model failures or improve system performance. Observability is therefore not merely an operational convenience; it is a governance requirement.

A production agent should ideally generate structured audit records capturing user requests, retrieved context, planning decisions, tool invocations, authorisation events, execution results, human approvals and final outcomes. Such records provide operational traceability without requiring access to proprietary model internals (ISO/IEC 42001).

The challenge is particularly important for long-horizon workflows in which failures may emerge only after multiple intermediate actions. Monitoring must therefore support reconstruction of the complete execution trajectory rather than only the final output.

8.8 Organisational and governance limitations

Not all limitations of agentic AI are technical. Enterprise deployment also depends on organisational readiness, process maturity, governance capability and human expertise.

Many organisations possess fragmented data, inconsistent process ownership, undocumented workflows, legacy integration challenges and limited AI governance structures. In such environments, introducing autonomous agents may amplify existing organisational weaknesses rather than resolve them (Lufthansa Industry Solutions, 2026).

A further limitation is responsibility allocation. When an agent recommends an action, executes that action and produces an unintended outcome, accountability may become ambiguous. Determining responsibility across model providers, platform vendors, integration teams, business owners and operational managers is considerably more complex than in conventional software systems.

Regulated industries face additional constraints related to explainability, auditability, privacy, security and regulatory compliance. An agent that cannot provide sufficient operational traceability may be unsuitable for processes involving financial reporting, healthcare decisions, legal compliance or other high-consequence domains (ISO/IEC 42001).

These governance limitations suggest that enterprise adoption should generally proceed through bounded, high-value use cases with clearly defined ownership, measurable outcomes and explicit escalation mechanisms rather than through unrestricted autonomous deployment.

8.9 A systems perspective on risk

The limitations discussed above share a common characteristic: they arise from the interaction between probabilistic reasoning and operational authority. Hallucination, long-horizon reliability, prompt injection, excessive permissions, unreliable tools, poor data quality and limited observability are not independent problems; they interact within a single socio-technical system (Wang et al., 2024; Li et al., 2024).

This interaction explains why agentic AI should be evaluated differently from conventional generative AI. A model that performs impressively in isolated demonstrations may remain unsuitable for enterprise deployment if it cannot operate reliably across integrated workflows, heterogeneous data sources, external tools and organisational governance constraints.

The central implication is that agentic AI risk is architectural rather than purely algorithmic. Improving the underlying language model is important, but it is insufficient. Enterprise reliability depends equally on permissions, deterministic controls, data governance, security architecture, monitoring, human oversight and organisational accountability (Russell & Norvig, 2021; Wooldridge, 2009; ISO/IEC 42001).

Consequently, the appropriate objective for enterprise agentic AI is not maximal autonomy. It is bounded autonomy within a well-governed technical and organisational architecture. The following chapter examines the governance and explainability mechanisms required to achieve that objective and to ensure that increasingly autonomous AI systems remain transparent, accountable and controllable within enterprise environments.

9. Governance and Explainability

he preceding chapter argued that the principal risks of agentic artificial intelligence (AI) arise from the interaction between probabilistic reasoning and operational authority. An agent that can interpret goals, access enterprise systems and execute actions introduces challenges that cannot be addressed through model performance alone. Reliability, security and organisational accountability therefore become governance problems as much as technical problems. Governance provides the institutional mechanisms through which organisations determine what an agent is permitted to do, how its behaviour is monitored, who is responsible for its outcomes and how compliance with legal, ethical and organisational requirements is maintained.

This distinction is important because enterprise AI governance differs fundamentally from governance for conventional software systems. Traditional enterprise applications generally execute predefined rules, making behaviour relatively predictable and auditable. Agentic systems, by contrast, may dynamically generate plans, select tools, retrieve information and adapt their actions according to environmental feedback (Wang et al., 2024; Li et al., 2024). The sequence of decisions leading to an operational outcome may therefore be partially emergent rather than completely predetermined. Governance must consequently address not only system configuration but also runtime behaviour, organisational authority and human oversight.

The objective of governance is not to eliminate autonomy. Rather, it is to ensure that autonomy operates within clearly defined technical, legal and organisational boundaries. Explainability, accountability, traceability, data governance, security controls and human supervision should therefore be understood as complementary components of a broader governance architecture rather than as isolated compliance requirements.

9.1 Governance as a socio-technical system

Enterprise governance for agentic AI should be understood as a socio-technical system involving technology, organisational structures, policies, people and external regulation. The practical behaviour of an agent emerges from the interaction between the foundation model, prompts, memory, tools, enterprise data, workflows, permissions and human operators (Plaat et al., 2025; Li et al., 2024). Consequently, governance cannot be confined to model selection or algorithmic evaluation alone.

A useful distinction is between model governance and agent governance. Model governance concerns the foundation model itself, including model selection, version management, evaluation, security, privacy and performance monitoring. Agent governance concerns the deployed operational system, including tool permissions, workflow authority, decision boundaries, human approval requirements, monitoring, auditability and retirement.

This distinction explains why a technically capable model may still be unsuitable for enterprise deployment. A model with strong reasoning performance can become operationally risky if it has excessive permissions, poor access controls, inadequate monitoring or unclear organisational ownership. Conversely, a less capable model may operate safely and effectively within a tightly governed architecture.

Governance therefore provides the mechanisms through which organisations translate technical capability into controlled operational authority.

9.2 Accountability and organisational responsibility

One of the most significant governance challenges introduced by agentic AI is accountability. Traditional software systems normally have identifiable owners and relatively deterministic execution paths. When an enterprise application produces an incorrect result, responsibility can usually be traced to a specific workflow, rule, implementation decision or operational process.

Agentic systems complicate this model because an operational outcome may emerge from a sequence of model interpretations, retrieved information, planning decisions, tool selections and environmental interactions (Wang et al., 2024). Responsibility therefore becomes distributed across multiple organisational actors.

A production agent should consequently have clearly defined ownership at several levels. At a minimum, organisations should identify a business owner responsible for the purpose and value of the agent; a technical owner responsible for architecture and implementation; a data owner responsible for information quality and access; a security owner responsible for permissions and cybersecurity controls; a model owner responsible for model selection, evaluation and updates; and an operational owner responsible for monitoring, incident response and retirement.

Lufthansa Industry Solutions similarly emphasises the importance of clearly defined responsibilities across AI development, implementation and operation (Lufthansa Industry Solutions, 2026). In practice, every production agent should have a named business owner who is accountable for its objectives, permissions, performance, compliance and eventual decommissioning.

This ownership model becomes particularly important when agents interact with external systems or execute actions with financial, legal or operational consequences. An autonomous procurement agent, for example, should not exist as an unowned technical artefact. It should operate as a managed organisational capability with explicit executive responsibility.

9.3 Explainability and operational transparency

Explainability is frequently discussed in AI governance, but the concept requires careful interpretation in the context of contemporary foundation models. Many discussions assume that explainability requires exposing the internal reasoning process of the model. For enterprise governance, however, the more important requirement is often operational transparency rather than complete cognitive interpretability.

Organisations generally need to know what the system did, what information it used, which tools it accessed, what actions it attempted and why a particular operational outcome occurred. This requirement is better understood as explainability through traceability.

A production agent should therefore generate a structured audit trail capturing user requests, retrieved context, relevant memory, planning steps where appropriate, tools accessed, API calls executed, permissions exercised, human approval events, execution results and final outcomes. Such records allow organisations to reconstruct the operational history of an agent without requiring access to proprietary or inaccessible model internals.

This distinction is important because enterprise explainability is primarily concerned with governance, compliance and operational assurance rather than with philosophical accounts of machine cognition. Regulators, auditors and business owners typically require evidence of process, authority and control.

ISO/IEC 42001 provides a useful organisational framework by emphasising governance, transparency, traceability, documentation and continuous improvement in AI management systems. Within an enterprise context, explainability should therefore be designed as an operational capability supporting audit, incident investigation, compliance and organisational learning.

9.4 Traceability and auditability

Traceability extends explainability by enabling organisations to reconstruct the complete execution history of an agent. A language model response may be ephemeral, but enterprise actions require durable evidence.

An effective audit architecture should capture the origin of the request, retrieved documents and data sources, model and prompt versions, tool invocations, execution parameters, authorisation events, policy decisions, human interventions, external communications and resulting system changes. These records should be timestamped, tamper-resistant and retained according to organisational and regulatory requirements.

Auditability is particularly important for long-horizon workflows discussed in Chapter 8. When an agent performs multiple sequential actions, an operational failure may originate several steps earlier than the final observable error. Without sufficient traceability, incident investigation becomes difficult and organisational accountability becomes ambiguous.

Dynamic agent behaviour also creates challenges for conventional auditing. Because action sequences may be generated at runtime rather than predetermined during system design, organisations need event-based auditing rather than only workflow-based auditing. The objective is not merely to record outcomes, but to preserve sufficient evidence to understand how those outcomes were produced.

This requirement reinforces the argument that agentic AI governance should be treated as an operational discipline rather than solely a model-management activity.

9.5 Data governance and information integrity

Data quality is foundational to agent performance. An agent connected to inconsistent customer records, outdated policies or incomplete inventory data may produce systematically poor decisions regardless of the capability of the underlying model (Lewis et al., 2020).

Enterprise data governance therefore becomes a central component of agent governance. Organisations should identify authoritative data sources, establish ownership for critical datasets, monitor data quality continuously, maintain data lineage and provenance, enforce access controls, implement retention and deletion policies and ensure compliance with privacy and regulatory requirements.

The challenge is not limited to factual correctness. Agentic systems frequently combine information from multiple repositories during planning and execution. Without version control, metadata management and source prioritisation, agents may generate recommendations that are internally coherent but organisationally incorrect.

For example, a human-resources agent may retrieve a current employment contract from one repository and an outdated leave policy from another. Unless governance mechanisms determine which source is authoritative, the resulting recommendation may violate current organisational policy.

Memory introduces an additional governance challenge. Agents may retain information across interactions, influencing future decisions and recommendations. Organisations must therefore determine what information may be remembered, where memory is stored, how long it is retained, who can access it and how incorrect or obsolete information can be corrected or removed.

Data governance should consequently be viewed as part of the enterprise information architecture rather than as an isolated AI project.

9.6 Policy governance and decision boundaries

Enterprise agents operate within organisational policies concerning finance, procurement, security, compliance, privacy, human resources and operational risk. Governance therefore requires explicit translation of organisational policy into computational decision boundaries.

A useful principle is bounded autonomy. The organisation defines the objectives, permissions, constraints and escalation conditions within which the agent can operate; the agent exercises contextual decision-making only inside those boundaries (Russell & Norvig, 2021; Wooldridge, 2009).

This can be represented as a layered decision model. Low-risk actions such as information retrieval, document summarisation or meeting scheduling may be executed autonomously. Moderate-risk actions such as customer communication or workflow initiation may require automated validation and monitoring. High-risk actions including financial transactions, contractual commitments, policy exceptions or production-infrastructure changes should require explicit human approval or authorisation.

Such boundaries should not be embedded solely within prompts. They should be enforced through deterministic technical controls including role-based access management, policy engines, workflow constraints, transaction limits, tool allow-lists and approval mechanisms.

This distinction is critical because prompts are advisory, whereas enterprise governance requires enforceable controls.

9.7 Security governance for agentic systems

Security governance extends beyond conventional cybersecurity because agents combine reasoning with operational authority. Prompt injection, excessive permissions, insecure tool integrations and compromised external systems can all influence agent behaviour (Debenedetti et al., 2024).

The OWASP guidance for agentic applications provides a useful security-oriented governance framework by emphasising least-privilege permissions, separation of duties, secure tool invocation, sandboxed execution, input and output validation, monitoring, anomaly detection and human approval for sensitive actions (OWASP Foundation, 2025).

Security governance should therefore include identity management, authentication, authorisation, permission scoping, secret management, network isolation, logging, behavioural monitoring and incident response procedures specifically designed for autonomous or semi-autonomous AI systems.

An important principle is that security should not depend exclusively on the model behaving correctly. Architectural controls must continue to function even when the model produces incorrect reasoning, misinterprets instructions or encounters adversarial inputs.

9.8 Governance across the agent lifecycle

Governance should be applied across the complete lifecycle of an enterprise agent rather than only during deployment. A useful lifecycle perspective includes design, development, evaluation, deployment, operation, monitoring, modification and retirement.

During design, organisations define objectives, scope, risk classification, ownership and governance requirements. During development, they establish data sources, tool integrations, permission boundaries and security controls. Evaluation includes capability testing, safety testing, robustness testing, adversarial testing and business validation (Yehudai et al., 2025). Deployment introduces monitoring, logging and operational controls. Operation requires continuous performance evaluation, security monitoring, policy compliance and incident management. Modification requires controlled updates to models, prompts, tools and workflows. Retirement requires revocation of permissions, archival of audit records and controlled decommissioning.

This lifecycle perspective aligns with ISO/IEC 42001, which emphasises continuous governance and improvement rather than one-time compliance activities.

9.9 Human oversight and governance by design

A common misconception is that human involvement represents a failure of autonomous AI. In enterprise environments, human oversight is often a deliberate governance mechanism.

An agent that recognises uncertainty, conflicting information, policy ambiguity or insufficient authority and appropriately escalates to a human decision-maker may be more reliable than one that attempts autonomous completion in every circumstance (Plaat et al., 2025; Wang et al., 2024).

Human oversight can occur at several levels. Humans may define objectives, approve plans, authorise sensitive actions, review outputs, monitor performance, investigate incidents and modify governance policies. Different applications require different oversight models according to the consequences of error, regulatory requirements and organisational risk tolerance.

The goal is therefore not unrestricted autonomy but adaptive autonomy, in which the system determines when autonomous execution is appropriate and when human judgement is required.

9.10 A governance architecture for enterprise agentic AI

The preceding discussion suggests that governance should be understood as an integrated enterprise architecture rather than a collection of isolated controls. Accountability establishes responsibility; explainability and traceability provide operational transparency; data governance ensures information integrity; policy governance defines decision boundaries; security governance protects operational authority; lifecycle governance supports continuous management; and human oversight provides adaptive control.

These components are mutually reinforcing. Weak data governance can undermine explainability; excessive permissions can undermine accountability; poor monitoring can undermine security; and unclear ownership can undermine every other governance mechanism.

A useful conceptual model is:

Governance = accountability + explainability + traceability + data governance + policy governance + security governance + lifecycle management + human oversight

This formulation reinforces the central argument of this paper that agentic AI should be understood as a socio-technical system. The successful deployment of enterprise agents depends not only on model intelligence but also on organisational structures, technical controls, data quality and governance capability.

Consequently, the principal governance question is not whether an AI system can act autonomously. It is whether the organisation can ensure that autonomous action remains authorised, observable, accountable and aligned with business objectives, legal obligations and societal expectations. The following chapter examines how these governance principles are operationalised through human-in-the-loop and human-agent collaboration models that combine automation with human judgement and organisational control.

10. Human-in-the-Loop and Human-Agent Collaboration

The previous chapter argued that governance for agentic artificial intelligence (AI) should be understood as a socio-technical architecture combining accountability, explainability, data governance, security controls and organisational oversight. Human involvement is one of the most important components of that architecture. A common assumption in commercial discussions of agentic AI is that technological progress should ultimately eliminate the need for human participation in operational workflows. This assumption is neither technically necessary nor organisationally desirable. The practical objective of enterprise agentic AI is rarely complete autonomy; it is the effective distribution of work between humans and intelligent systems.

Human-agent collaboration should therefore be understood as an operational design problem rather than merely a safety mechanism. Agentic systems can interpret information, retrieve knowledge, plan tasks, invoke tools and coordinate workflows, while humans contribute contextual judgement, ethical reasoning, organisational knowledge, accountability and the ability to manage novel or ambiguous situations. The value of enterprise agentic AI consequently depends less on replacing human workers than on redesigning processes so that agents and humans perform complementary functions (Plaat et al., 2025; Wang et al., 2024).

This distinction is particularly important because the limitations discussed in Chapter 8—hallucination, long-horizon reliability, prompt injection, data quality and excessive authority—cannot be eliminated completely through improvements in model capability alone. Human oversight remains an important mechanism for managing uncertainty, validating critical decisions and maintaining organisational accountability. Human-agent collaboration should therefore be viewed as a primary architectural characteristic of enterprise agentic AI rather than as a temporary transitional arrangement.

10.1 From automation to collaboration

The evolution of enterprise automation can be interpreted as a progression in the relationship between humans and technology. Early rule-based automation primarily replaced repetitive manual execution. Robotic process automation (RPA) automated structured digital tasks, while business process management coordinated predefined workflows. Generative AI expanded the ability of machines to produce language, code and other forms of content. Agentic AI introduces a further development in which AI systems can participate directly in planning, coordination and execution across multiple stages of a business process (Russell & Norvig, 2021; Wooldridge, 2009).

This progression does not imply that humans become unnecessary. Rather, the human role changes. Employees increasingly supervise, guide, validate, prioritise, intervene and govern AI-driven workflows instead of performing every intermediate task manually. An enterprise travel agent, for example, may retrieve calendar information, compare travel options, prepare an itinerary and initiate bookings, while a human manager approves exceptions, resolves unusual constraints and accepts responsibility for the final decision.

A useful distinction is between task substitution and capability augmentation. Task substitution occurs when an agent performs an activity that a human previously executed directly. Capability augmentation occurs when the agent expands what a human can accomplish by reducing cognitive load, accelerating information retrieval, coordinating multiple systems or monitoring processes continuously. Many enterprise applications are likely to involve augmentation rather than complete substitution.

This perspective is consistent with broader research on human-agent systems, which increasingly treats human interaction as an integral component of intelligent systems rather than evidence that automation has failed (Plaat et al., 2025; Li et al., 2024).

10.2 Human-in-the-loop as an architectural principle

Human-in-the-loop (HITL) systems are often described simply as systems that require human approval before certain actions are executed. In enterprise agentic AI, however, HITL is better understood as an architectural principle governing the allocation of decision authority.

The central question is not whether a human is involved, but where, when and why human intervention occurs. Human oversight can occur before an action, during execution, after execution, or continuously throughout the workflow.

A useful operational model distinguishes four levels of decision authority:

• Low-risk tasks: autonomous execution

• Moderate-risk tasks: automated recommendation with optional review

• High-risk tasks: mandatory human approval

• Critical or irreversible tasks: explicit human authorisation and accountability

This layered model allows organisations to combine the scalability of automation with human judgement where consequences are significant. Routine information retrieval, document classification or meeting scheduling may be executed autonomously, while financial transactions, contractual commitments, employment decisions, regulatory submissions or production-infrastructure changes require progressively greater human involvement.

The architecture can be represented conceptually as:

Objective → Agent reasoning → Proposed action → Human validation (when required) → Execution → Monitoring

The important insight is that human involvement is triggered by risk, uncertainty and authority, not merely by technical capability.

10.3 Adaptive autonomy

Full autonomy is not necessarily the optimal objective for enterprise AI. A more useful model is adaptive autonomy, in which the system determines whether it can act independently or whether human intervention is required according to predefined organisational rules.

Adaptive autonomy differs from fixed automation because the required level of human involvement can vary dynamically according to context. An IT operations agent may autonomously restart a failed non-critical service, request approval before modifying production infrastructure and immediately escalate when unusual network behaviour suggests a potential security incident.

Several factors can be used to determine when escalation occurs, including confidence scores, policy constraints, financial thresholds, regulatory requirements, novelty of the situation, availability of authoritative information, tool reliability and potential business impact.

This approach treats human judgement as a scarce organisational resource that should be concentrated where it creates the greatest value. Rather than reviewing every automated action, humans review actions that are uncertain, exceptional, high-impact or irreversible.

Adaptive autonomy is therefore a governance mechanism as well as an efficiency mechanism. It allows organisations to increase automation while maintaining meaningful human control over consequential decisions.

10.4 The complementary strengths of humans and agents

Effective human-agent collaboration requires recognition that humans and artificial agents possess different strengths and limitations rather than identical capabilities. Enterprise value emerges when these capabilities are combined deliberately within a workflow rather than when one simply substitutes for the other.

Agentic systems are particularly effective at processing large volumes of information, retrieving relevant knowledge rapidly, coordinating multiple software tools, monitoring digital environments continuously and executing repetitive operations at high speed and scale. Because they can operate across databases, enterprise applications, APIs and knowledge repositories without fatigue, agents can maintain attention across many concurrent tasks and respond consistently according to predefined policies and permissions (Wang et al., 2024; Li et al., 2024).

Human workers, by contrast, remain superior in areas involving contextual judgement, ethical reasoning, organisational knowledge, strategic prioritisation, negotiation, exception handling and accountability. Many enterprise decisions require interpretation of organisational history, stakeholder relationships, regulatory ambiguity, reputational considerations or long-term strategic objectives that are difficult to represent explicitly within an automated workflow. Humans are also capable of recognising when organisational goals themselves should be reconsidered rather than merely optimised.

This distinction suggests that enterprise processes should be redesigned around a division of cognitive labour rather than simple replacement. A procurement agent, for example, can compare thousands of supplier records, analyse contractual clauses, retrieve historical purchasing data and prepare purchasing recommendations within seconds. A procurement manager may nevertheless be required to evaluate strategic supplier relationships, market conditions, geopolitical risks, sustainability objectives and broader organisational priorities before authorising a major commercial commitment. The agent accelerates information processing and coordination, while the human provides judgement and organisational responsibility.

The same principle applies across customer service, IT operations, finance and human resources. Agents increasingly perform information-intensive and coordination-intensive activities, while humans concentrate on exception management, value judgement, organisational interpretation and decisions carrying significant legal, ethical or financial consequences. Human-agent collaboration should therefore be understood as capability complementarity rather than capability equivalence.

10.5 Human oversight across the agent lifecycle

Human involvement is often discussed only at the moment an agent executes an action. In practice, effective governance requires oversight throughout the entire lifecycle of an enterprise agent, from initial conception to eventual retirement. Human-agent collaboration is therefore not confined to operational approval; it is embedded across design, development, deployment, operation, modification and decommissioning.

During the design phase, humans define the purpose of the agent, the business processes within which it will operate, the permissions it should receive and the governance constraints that will regulate its behaviour. Decisions concerning acceptable autonomy, escalation thresholds, data sources and compliance requirements are fundamentally organisational decisions rather than model decisions.

During development, human expertise is required to select appropriate tools, enterprise integrations, retrieval mechanisms, security controls and workflow boundaries. Evaluation similarly depends heavily on human judgement. Organisations must test not only capability but also safety, robustness, policy compliance, security behaviour and performance under conditions involving ambiguity, missing information and adversarial inputs (Yehudai et al., 2025).

Once deployed, agents require continuous operational supervision. Performance may change as enterprise systems evolve, policies are updated, data quality varies or external conditions shift. Human operators therefore monitor reliability, investigate incidents, review exceptions, approve modifications and determine whether the agent continues to satisfy organisational objectives. Eventually, retirement becomes a governance activity involving revocation of permissions, archival of audit records, migration of operational responsibilities and controlled decommissioning.

This lifecycle perspective aligns closely with the governance principles discussed in Chapter 9 and with organisational management approaches such as ISO/IEC 42001, which emphasise continuous oversight, documentation and improvement rather than one-time compliance activities. Human-in-the-loop should therefore be understood as a continuous governance relationship between the organisation and the agentic system.

10.6 Escalation and exception handling

One of the most important functions of human-agent collaboration is the management of exceptions. Enterprise processes frequently encounter incomplete information, conflicting policies, unusual customer requests, regulatory ambiguity, operational disruptions and situations that differ substantially from historical patterns. Because no finite set of rules can anticipate every organisational contingency, effective agentic systems must be capable of recognising when autonomous execution is no longer appropriate.

Escalation should therefore be interpreted as successful behaviour rather than evidence of failure. A well-designed agent identifies conditions that exceed its authority, confidence or available information and deliberately transfers responsibility to an appropriately authorised human decision-maker. This behaviour reflects bounded autonomy rather than insufficient capability.

Escalation may be triggered by several classes of conditions. The agent may encounter insufficient or contradictory information, detect conflicts between organisational policies, observe repeated tool failures, identify unusually large financial values, recognise potential legal or regulatory implications, detect cybersecurity anomalies or receive requests that exceed its delegated authority. In each case, the appropriate response is not necessarily to continue reasoning autonomously but to preserve organisational control.

For example, a customer-service agent may autonomously resolve routine order-status enquiries and standard refund requests while escalating cases involving contractual disputes, allegations of discrimination, regulatory complaints or unusually large financial exposure. An IT operations agent may automatically recover from routine service failures but escalate immediately when production infrastructure behaves in a manner inconsistent with historical operational patterns or when security indicators suggest possible compromise.

The quality of an enterprise agent should therefore be evaluated partly according to its ability to recognise when not to act autonomously. Effective escalation protects organisational assets, preserves accountability and allows human expertise to be concentrated on situations where it creates the greatest value.

10.7 Human-agent collaboration in enterprise workflows

The collaborative model becomes particularly visible in complex enterprise workflows that combine reasoning, tool use and organisational decision-making. In such environments, agents rarely replace entire processes; instead, they increasingly manage information flow, coordination and routine execution while humans supervise exceptions and consequential decisions.

Consider a supplier-invoice process. An incoming invoice is received by the agent, which extracts relevant information, retrieves the associated purchase order, checks contractual terms, validates pricing, identifies discrepancies and prepares a recommendation. If the invoice conforms to established policy and falls below predefined financial thresholds, it may be approved automatically through deterministic enterprise controls. If discrepancies, unusual suppliers, policy conflicts or high-value transactions are detected, the workflow is escalated to a human procurement specialist for review and approval.

A similar pattern appears in customer service. The agent interprets the customer request, retrieves account information, analyses previous interactions, identifies applicable organisational policies and prepares a recommended response. Routine cases may be completed autonomously, while complaints involving legal issues, reputational risk, contractual exceptions or significant commercial decisions are transferred to human staff. The human is therefore not removed from the process; rather, the human becomes responsible for the parts of the process requiring judgement, negotiation and organisational discretion.

This architecture illustrates an important operational principle: the agent increasingly manages the process, while the human increasingly manages the exceptions. Enterprise value emerges from reducing the amount of routine cognitive work performed by employees while preserving human control over decisions with significant organisational consequences.

10.8 Trust, transparency and user acceptance

Human-agent collaboration depends not only on technical performance but also on organisational trust. Employees must understand what the agent can do, what information it uses, which actions it is authorised to perform and when human intervention is expected. Without sufficient transparency, users may either over-rely on the system or reject it unnecessarily.

Excessive automation can reduce trust if users cannot understand, verify or challenge system behaviour. Conversely, excessive human intervention can eliminate many of the efficiency benefits that justify automation in the first place. The objective is therefore calibrated trust based on transparency, predictable behaviour and clearly defined responsibilities.

Several factors contribute to appropriate organisational trust. Users are more likely to rely on an agent when its recommendations are consistent, when uncertainty is communicated explicitly, when actions are observable through audit trails, when errors can be corrected and when escalation mechanisms are clear and reliable. Operational transparency, discussed in Chapter 9, consequently functions not only as a governance mechanism but also as a collaboration mechanism.

Trust should therefore be designed into the architecture rather than assumed to emerge automatically from model capability. Employees need visibility into the boundaries of the agent's authority and confidence if they are to collaborate with it effectively.

10.9 Organisational implications

Human-agent collaboration has significant implications for organisational design. The introduction of agents does not merely automate existing tasks; it changes roles, responsibilities, required skills and performance measurement across the enterprise.

Employees increasingly require capabilities including AI literacy, objective formulation, workflow supervision, validation of AI-generated outputs, exception handling, governance awareness and collaboration with automated systems. Managers must understand how decision authority is distributed between humans and agents and how operational accountability is maintained within hybrid workflows.

Performance metrics may also need to evolve. Traditional measures focusing exclusively on individual productivity become less informative when work is performed collaboratively by humans and intelligent systems. Organisations may increasingly evaluate human-agent team performance, including completion rate, escalation rate, error rate, cycle time, compliance performance, customer satisfaction and overall business outcomes.

Lufthansa Industry Solutions similarly emphasises that successful enterprise AI deployment depends not only on technology but also on organisational capabilities, governance structures and process integration (Lufthansa Industry Solutions, 2026) This suggests that the adoption of agentic AI should be understood as an organisational transformation as much as a technological implementation. The redesign of workflows, authority structures and employee roles may ultimately determine enterprise value more strongly than incremental improvements in model capability.

10.10 Towards collaborative intelligence

The preceding discussion suggests that the most useful conceptual model is neither complete automation nor complete human control. It is collaborative intelligence, in which humans and agents form integrated operational systems whose combined capabilities exceed those of either component operating independently.

In collaborative intelligence, agents provide scale, speed, coordination, continuous monitoring and information processing, while humans provide judgement, accountability, ethical reasoning, strategic direction and governance. The interaction between these capabilities becomes the primary source of enterprise value.

This perspective also reframes the meaning of autonomy. The objective is not autonomous AI operating independently of organisations; it is governed autonomy operating within organisational structures. Human oversight is therefore not evidence that agentic AI has failed to become autonomous. It is evidence that the system has been designed for enterprise reality, where legal responsibility, organisational authority and ethical judgement cannot be delegated entirely to probabilistic computational systems.

Consequently, the future of enterprise agentic AI is likely to be characterised less by fully autonomous organisations than by increasingly sophisticated human-agent collaboration, in which decision-making authority, operational responsibility and cognitive work are distributed dynamically across humans, intelligent agents and enterprise systems. The following chapter builds on this perspective by examining implementation strategies through which organisations can introduce agentic AI incrementally while maintaining governance, security and measurable business value.

11. Implementation Strategy for Organisations

The preceding chapters have argued that agentic artificial intelligence should be understood not simply as a more capable language model, but as an enterprise architecture that combines foundation models with planning, memory, tools, workflow orchestration, data access and governance mechanisms. This distinction has important implications for implementation. Deploying an agentic AI system is not equivalent to installing a software application or integrating a chatbot into an existing workflow. Because agents can interpret objectives, interact with enterprise systems and perform actions that may affect operational processes, successful deployment requires organisational readiness, process selection, technical integration, security controls, governance structures and continuous performance evaluation.

Industry evidence suggests that many organisations remain at an early stage of adoption. McKinsey’s 2025 global survey indicates widespread experimentation with AI agents but relatively limited enterprise-scale deployment across business functions. This pattern is consistent with previous waves of automation, in which technological capability often emerged before organisations had developed the data quality, process maturity and governance structures necessary for reliable operational deployment. The principal implementation challenge is therefore not simply whether an organisation can build an agent, but whether it can integrate that agent into existing enterprise systems while maintaining reliability, security, compliance and measurable business value.

A useful implementation strategy is consequently incremental rather than transformational. Organisations should progress from bounded, observable and low-risk applications towards progressively greater autonomy only after governance, security and operational performance have been demonstrated in production environments.

11.1 Establish organisational readiness

The first implementation requirement is organisational rather than technological. An organisation possessing access to a capable large language model is not necessarily prepared to deploy autonomous or semi-autonomous agents. Agentic AI introduces new responsibilities concerning data governance, identity management, process ownership, cybersecurity, legal accountability and organisational decision-making.

Readiness therefore encompasses several complementary capabilities.

• AI literacy across management and operational teams.

• Executive understanding of the opportunities and limitations of agentic AI.

• Technical capability in data engineering, integration, APIs and cloud infrastructure.

• Data governance, including data quality, ownership and access management.

• Cybersecurity expertise covering identity, access control and AI-specific threats.

• Clearly defined process ownership and accountability.

• AI risk management and governance structures.

The absence of these capabilities often causes implementation failure even when the underlying technology performs well. For example, an agent may technically be capable of retrieving customer information and initiating transactions, but deployment may be impossible if data ownership is unclear, API access is poorly controlled or responsibility for operational outcomes has not been assigned.

Organisational readiness also requires an accurate understanding of current process maturity. Agentic AI is frequently proposed for inefficient or poorly documented processes on the assumption that intelligent automation will compensate for organisational complexity. In practice, AI tends to amplify existing process weaknesses. Processes characterised by inconsistent data, ambiguous ownership, conflicting policies or undocumented exceptions are difficult for both humans and AI systems to execute reliably.

A useful preparatory activity is therefore enterprise process assessment. Organisations should identify how processes currently operate, where exceptions occur, which systems are involved, what approvals are required and which decisions are governed by regulation or internal policy. Process mining and workflow analysis can be particularly valuable during this stage because they provide empirical evidence about actual process behaviour rather than relying solely on documented procedures.

11.2 Identify suitable processes

One of the most important implementation decisions concerns process selection. Not every business activity is an appropriate candidate for agentic automation, particularly during the early stages of adoption. A useful evaluation framework should assess process characteristics that influence both technical feasibility and organisational risk.

The most suitable initial use cases are generally processes with high transaction volume and a high degree of repetition, because these provide sufficient operational frequency to generate measurable efficiency gains. Processes should also have high-quality data availability and well-defined digital interfaces, allowing the agent to retrieve information and interact reliably with enterprise systems through APIs, workflow platforms or other structured integration mechanisms. These characteristics are consistent with the literature on intelligent automation, which emphasises that automation value depends heavily on process standardisation, data quality and system integration (Ng et al., 2021; Wewerka and Reichert, 2020).

Process variability should ideally be moderate rather than extreme. Completely deterministic processes can often be automated effectively using conventional workflow systems or robotic process automation, whereas highly ambiguous processes may require substantial human judgement. Agentic AI provides the greatest value where processes contain some variability and unstructured information but remain bounded by organisational policies and measurable objectives (Wang et al., 2024; Plaat et al., 2025).

Early implementation candidates should also involve low to moderate consequences of error, manageable human approval requirements and clearly defined success criteria. Organisations should be able to measure outcomes such as completion rate, processing time, escalation frequency, customer satisfaction or cost reduction. Finally, the selected process should offer a high potential return on investment, ensuring that the costs of integration, governance and ongoing operation can be justified through measurable operational improvements (McKinsey & Company, 2025).

These criteria highlight an important distinction between technical possibility and implementation suitability. The ideal first agent is rarely the most sophisticated or strategically important process. A bounded process with measurable outcomes, limited regulatory exposure and clearly defined interfaces is generally a better implementation candidate than a highly complex cross-functional workflow.

11.3 Adopt a phased implementation model

Rather than attempting enterprise-wide transformation, organisations should adopt a phased implementation model in which autonomy, system integration and organisational scope increase gradually.

Phase 1: Assisted intelligence

The initial phase focuses on information retrieval and decision support. Agents answer questions, retrieve enterprise knowledge, summarise documents and prepare recommendations, but humans remain responsible for all operational actions.

Phase 2: Task automation

Agents begin executing bounded actions such as creating tickets, updating records, generating reports, scheduling meetings or initiating predefined workflows. Human approval remains mandatory for actions with operational or financial consequences.

Phase 3: Workflow orchestration

Agents coordinate multiple enterprise systems, determine appropriate sequences of actions, manage exceptions and interact with deterministic automation technologies such as workflow engines, APIs and robotic process automation platforms.

Phase 4: Supervised autonomy

Agents perform complete workflows within defined operational boundaries while continuous monitoring, policy enforcement and human escalation mechanisms remain active.

This staged approach provides several advantages. It allows organisations to collect operational evidence, improve prompts and workflows, validate security controls, measure performance and build organisational trust before increasing autonomy. It also aligns investment with demonstrated value rather than speculative capability.

11.4 Conduct bounded pilot projects

The transition from experimentation to production should occur through carefully designed pilot projects. A pilot should test a narrowly defined business objective rather than attempting comprehensive organisational automation.

For example, an organisation might begin with a customer-service order-status agent rather than a fully autonomous customer-service operation. The objective is not to maximise the number of automated tasks, but to evaluate whether the agent can reliably complete a clearly defined workflow under realistic operating conditions.

Pilot projects should establish baseline performance measures before deployment, including completion rate, error rate, escalation rate, response time, cost per transaction, customer or employee satisfaction, security incidents and operational reliability.

The agent should then be evaluated against these baseline measures over a representative operational period. Importantly, evaluation should include failure analysis rather than focusing exclusively on successful interactions. Organisations should examine when the agent escalates unnecessarily, fails to recognise uncertainty, selects inappropriate tools or encounters integration failures.

A pilot should therefore function as an operational learning exercise. The organisation should improve prompts, tool interfaces, workflow design, retrieval quality, approval thresholds and monitoring mechanisms before expanding the scope of deployment.

11.5 Design security into the architecture

Security should be incorporated into the architecture from the beginning rather than added after deployment. Agentic AI systems differ from conventional chatbots because they can possess permissions to access enterprise systems, retrieve confidential information and execute operational actions. Consequently, security failures can become operational failures.

A secure agent architecture should include identity management, strong authentication, role-based access control, least-privilege permissions, tool allow-lists, sandboxing of high-risk operations, input and output validation, monitoring and logging, anomaly detection, policy enforcement layers and human approval for sensitive actions.

Research on prompt injection and agent security demonstrates why this architecture is necessary. An agent that can access email, documents, databases or external web content may be exposed to malicious instructions embedded within apparently legitimate information. If the agent possesses excessive permissions, a prompt injection attack can potentially influence enterprise actions.

The security principle should therefore be separation of reasoning from authority. The language model may determine that a particular action appears appropriate, but a policy layer should validate whether the action is authorised, whether required approvals exist, whether the requested operation falls within permitted boundaries and whether additional verification is required.

Deterministic enterprise systems should retain responsibility for operations requiring precision, compliance or auditability, while the agent provides interpretation and orchestration capabilities around those systems.

11.6 Measure business value rather than novelty

The existence of an AI agent is not itself a business benefit. Organisations should evaluate agentic AI using the same investment discipline applied to other enterprise technology initiatives.

A meaningful business case should compare the full cost of deployment with measurable operational improvements. Relevant benefits may include reduced handling time, increased throughput, lower operational costs, reduced manual effort, improved service availability, faster decision cycles, better compliance, higher customer satisfaction and increased employee productivity.

Cost assessment should extend beyond model usage. Total cost of ownership typically includes integration and API development, data engineering, retrieval infrastructure, security controls, monitoring and observability, governance and compliance activities, human review and exception handling, cloud infrastructure, model inference costs, maintenance and continuous improvement.

This broader perspective is particularly important because agentic workflows may involve repeated model invocations, tool calls, retrieval operations and monitoring infrastructure. A system that appears inexpensive when evaluated solely by token costs may become significantly more expensive when deployed across enterprise-scale workflows.

Return on investment should therefore be measured empirically through operational performance rather than estimated primarily from automation assumptions. Organisations should require evidence that the agent improves measurable business outcomes under real production conditions.

11.7 Build governance and operating structures

As deployment expands beyond isolated pilots, organisations require formal operating structures for agentic AI. Governance should define who is responsible for the agent, who approves changes, how performance is monitored, how incidents are investigated and how compliance requirements are enforced.

A useful governance model includes executive sponsorship, business process ownership, technical ownership, security ownership, model and prompt management, change management procedures, audit and logging requirements and periodic performance and risk reviews.

This operating model recognises that an enterprise agent is not merely software; it is a continuously operating socio-technical system whose behaviour may change as enterprise data, tools, workflows and organisational policies evolve.

11.8 Scale through controlled expansion

After successful pilots, organisations should expand deployment gradually rather than attempting simultaneous enterprise-wide automation. A useful scaling sequence is to extend within one process, then across related processes, then across one business function, then across multiple functions with shared governance, and finally towards enterprise-level orchestration where appropriate.

Expansion should occur only when predefined performance, security and governance criteria have been satisfied. Organisations should demonstrate stable operational performance, acceptable error rates, effective monitoring, incident response capability, governance compliance and positive business outcomes before increasing the agent’s authority or organisational scope.

This disciplined approach addresses one of the central risks identified throughout this paper: the gap between apparent capability and operational reliability. Current agentic systems can perform impressive demonstrations, but enterprise value depends on predictable behaviour across thousands of real operational interactions.

11.9 An implementation maturity model

The discussion above can be understood as a progression through increasing levels of organisational maturity in agentic AI deployment. At the experimentation stage, organisations typically develop isolated prototypes with limited governance and little integration into operational processes. The objective is primarily technological exploration rather than measurable business impact.

The next stage is the pilot phase, in which agents are deployed within narrowly defined use cases supported by baseline performance metrics and substantial human oversight. Pilots allow organisations to evaluate reliability, security, workflow integration and user acceptance before increasing autonomy.

Successful pilots can evolve into operational deployments, where agents perform production tasks within a single business function under formal monitoring, logging and security controls. At this stage, organisations begin to establish operational procedures for maintenance, incident management and performance evaluation.

Greater organisational value emerges during the integrated stage, where agents coordinate multiple enterprise systems and workflows under formal governance structures, clearly defined process ownership and enterprise security policies. Integration across business applications becomes increasingly important, reflecting the architectural perspective developed earlier in this paper (Li et al., 2024; Wang et al., 2024).

The highest level of maturity is an optimised enterprise implementation, characterised by continuous evaluation, portfolio-level management of multiple agents, enterprise-wide integration and measurable strategic business value. Organisations operating at this level treat agentic AI as an organisational capability rather than a collection of isolated automation tools. They combine model management, workflow orchestration, security, governance and human oversight within a unified operational framework (Plaat et al., 2025; McKinsey & Company, 2025).

The objective of implementation should not be to reach maximal autonomy as quickly as possible. Rather, organisations should progress through these maturity stages only as governance, security, operational reliability and measurable business value have been demonstrated. This phased approach is consistent with the broader argument of this paper that the practical value of agentic AI depends less on unrestricted autonomy than on disciplined integration, controlled authority and accountable governance.

11.10 Strategic implications

Agentic AI implementation should ultimately be viewed as an organisational transformation programme rather than a model deployment exercise. The technology creates value when it is integrated into mature processes, supported by reliable enterprise data, constrained by security and governance mechanisms and evaluated through measurable operational outcomes.

The most successful organisations are therefore unlikely to be those that deploy the largest number of agents. They are more likely to be those that combine agentic capabilities with strong process management, high-quality enterprise data, deterministic execution systems, cybersecurity controls and accountable governance structures.

This implementation perspective provides a practical bridge between the technical architecture discussed in the earlier chapters and the broader enterprise ecosystem considered in the following chapter. It reinforces the central argument of this paper that the future of agentic AI depends less on unrestricted autonomy than on disciplined integration, controlled authority and measurable organisational value.

12. Enterprise Ecosystems and Technology Integration

The preceding chapters have examined agentic artificial intelligence as an architectural combination of foundation models, planning mechanisms, memory, tools, enterprise data and governance. In practice, these components rarely exist in isolation. Large organisations already possess extensive technology landscapes consisting of enterprise resource planning (ERP) systems, customer relationship management (CRM) platforms, workflow engines, robotic process automation (RPA), databases, identity management systems, cloud infrastructure, analytics platforms and information technology service management tools. Agentic AI therefore enters an environment characterised by heterogeneous systems, multiple data sources and established operational processes rather than replacing enterprise software from first principles.

This observation has important strategic implications. The practical value of an enterprise agent is determined not only by the intelligence of the underlying model, but by its ability to interact reliably with existing systems, retrieve authoritative information, execute approved actions and operate within organisational security and governance boundaries. Agentic AI should therefore be understood as a layer within the enterprise technology ecosystem rather than as a standalone application.

12.1 Integration as the primary enterprise challenge

Enterprise organisations typically operate hundreds or thousands of interconnected applications that have accumulated over many years. These systems often contain the organisation’s authoritative records, including customer data, financial transactions, inventory information, procurement records, human resources information and operational workflows. Agentic AI systems must therefore interact with existing enterprise applications rather than attempting to replace them wholesale.

This integration requirement distinguishes enterprise agentic AI from consumer AI assistants. A consumer assistant may operate primarily through web search and general-purpose reasoning, whereas an enterprise agent must access authenticated business systems, comply with organisational policies, respect role-based permissions and produce outcomes that can be audited and governed. The challenge is consequently one of enterprise integration architecture rather than language generation alone.

Research on LLM-based agents reinforces this perspective. Wang et al. (2024) emphasise that agent capabilities emerge from the interaction between reasoning models, memory, tools and external environments, while Li et al. (2024) identify workflow, infrastructure and communication as central dimensions of agentic systems. The enterprise environment provides precisely these external resources: data repositories, APIs, workflow engines, identity services and operational systems through which an agent can perceive information and perform authorised actions.

12.2 The enterprise application landscape

A production agent typically needs to interact with multiple enterprise technologies during the execution of a single business process. ERP systems provide financial, procurement, manufacturing and supply-chain functionality; CRM platforms provide customer and sales information; business process management systems coordinate organisational workflows; RPA platforms automate deterministic user-interface interactions; databases and data warehouses provide structured enterprise information; identity and access management platforms enforce authentication and authorisation; cloud infrastructure provides scalable computation and deployment environments; analytics systems provide reporting and performance information; IT service management platforms coordinate operational support activities; and customer-service platforms manage interactions across communication channels.

The significance of this landscape is that agentic behaviour is distributed across the ecosystem. An agent may interpret a natural-language request, retrieve information from a CRM platform, check inventory through an ERP system, initiate a workflow through a BPM engine, execute a deterministic transaction through an authorised API and record the outcome in an audit system. The language model performs only part of the overall process; the surrounding enterprise infrastructure provides the operational capabilities that make the agent useful.

This architectural perspective is consistent with the broader literature on intelligent automation, which increasingly views AI, workflow systems and deterministic automation as complementary components of a unified enterprise automation stack (Ng et al., 2021; Wewerka and Reichert, 2020).

12.3 APIs and service-oriented integration

Modern enterprise integration increasingly relies on application programming interfaces (APIs), service-oriented architectures and event-driven communication. These technologies are particularly important for agentic AI because they provide structured and governable interfaces through which agents can interact with enterprise systems.

An API-based architecture allows the organisation to separate reasoning from execution. The agent can determine that a purchase order should be created, but the creation itself can be performed by an ERP service that enforces validation rules, approval requirements, accounting controls and audit logging. Similarly, an agent may decide that a customer should receive a refund, while a financial service validates the request against organisational policies before executing the transaction.

This separation is strategically valuable because deterministic enterprise systems retain responsibility for operations requiring precision, consistency and compliance, while the agent provides contextual interpretation and orchestration capabilities. The resulting architecture is therefore more robust than one in which a language model interacts directly with enterprise systems without intermediate control mechanisms.

12.4 Workflow orchestration across enterprise systems

One of the most significant capabilities of agentic AI is the ability to coordinate actions across multiple applications and organisational functions. Traditional enterprise integration frequently required predefined workflows that specified the exact sequence of operations in advance. Agentic systems introduce the possibility of dynamically selecting and sequencing enterprise capabilities according to the context of a particular objective.

For example, a customer-service agent may receive a request to modify a commercial order. The agent can identify the customer through the CRM platform, retrieve the order from the ERP system, check inventory availability, determine applicable contractual terms, initiate an approval workflow where necessary and update multiple enterprise systems after authorisation. The value arises not from replacing the ERP or CRM platform, but from connecting previously separate stages of the business process through intelligent orchestration.

Li et al. (2024) identify workflow coordination and communication between specialised components as central characteristics of advanced agent architectures. In enterprise environments, workflow orchestration extends beyond AI components to include conventional software systems, deterministic automation technologies and human decision-makers.

12.5 Data integration and retrieval

Enterprise agents depend heavily on access to authoritative organisational information. Retrieval-augmented generation provides an important mechanism for connecting foundation models with proprietary enterprise knowledge, including policies, technical documentation, contracts, product information, operational procedures and historical records. However, retrieval alone is insufficient if the underlying enterprise data is inconsistent, duplicated, outdated or poorly governed.

Consequently, data quality becomes a limiting factor for agentic performance. An agent can only reason effectively over the information available to it. If customer records are fragmented across multiple systems, inventory information is inconsistent or organisational policies are contradictory, the agent may produce unreliable recommendations or initiate inappropriate actions.

This reinforces a theme developed earlier in the paper: successful agentic AI deployment depends as much on enterprise information architecture as on model capability. Organisations with mature data governance, metadata management and integration practices are likely to derive greater value from agentic systems than organisations with fragmented information environments.

12.6 Identity, security and governance integration

Enterprise integration also requires integration with organisational security infrastructure. An agent operating across multiple systems must authenticate securely, obtain appropriate authorisation, respect role-based permissions and maintain comprehensive audit records.

Identity and access management platforms therefore become central components of the agentic architecture. Rather than granting broad system permissions directly to the language model, organisations can issue scoped credentials through enterprise identity systems, apply least-privilege principles and enforce policy decisions through dedicated governance layers. Sensitive operations can require additional authentication, managerial approval or deterministic validation before execution.

This integration is particularly important because security research has demonstrated that prompt injection and other adversarial techniques become significantly more consequential when an AI system possesses operational authority. Connecting agents to enterprise identity, policy and monitoring systems therefore reduces the risk that model errors or malicious inputs can directly translate into unauthorised organisational actions.

12.7 The emerging enterprise ecosystem

The practical consequence of these integration requirements is that enterprise agentic AI should be understood as an ecosystem rather than a product. Organisations will increasingly operate multiple models, specialised agents, workflow platforms, retrieval systems, deterministic services, governance mechanisms and monitoring infrastructure within a shared operational environment.

Commercial implementations already reflect this direction. Enterprise technology providers increasingly position themselves not merely as model vendors but as integration and orchestration platforms capable of connecting foundation models with enterprise applications, APIs, identity services and workflow systems. The strategic emphasis is frequently placed on open interfaces, modular architectures and interoperability rather than on a single proprietary model.

This ecosystem perspective also explains why competitive advantage in enterprise agentic AI is unlikely to reside exclusively in the underlying foundation model. Foundation models are increasingly available from multiple providers and continue to commoditise rapidly. Sustainable organisational advantage is more likely to emerge from the combination of proprietary enterprise data, workflow knowledge, system integration capability, governance structures and continuous evaluation mechanisms. These organisational assets are substantially more difficult to replicate than access to a general-purpose language model.

As foundation models become increasingly accessible, competitive advantage may therefore increasingly depend on an organisation’s ability to structure, govern and operationalise knowledge effectively through context engineering and enterprise integration (Lewis et al., 2020; Brynjolfsson, Li and Raymond, 2023).

12.8 Strategic implications

The integration perspective developed in this chapter reinforces the central argument of the paper that agentic AI is fundamentally an architectural and organisational technology. Its value does not arise solely from improvements in language modelling or reasoning performance. Rather, it arises from the ability to connect human objectives with enterprise data, deterministic systems, workflow engines and governance mechanisms within a secure and observable operational environment.

For this reason, organisations should evaluate agentic AI initiatives according to integration capability, data quality, API maturity, security architecture and process governance as carefully as they evaluate model performance. The most successful enterprise deployments are likely to be those that treat agentic AI as an intelligent orchestration layer operating across existing enterprise systems, rather than as a standalone application replacing established enterprise software.

This perspective provides an important transition to the following chapter, which critically examines the broader industry narrative surrounding agentic AI and evaluates whether current commercial claims about enterprise transformation are supported by the available empirical evidence.

13. Critical Assessment of the Industry Narrative

sThe rapid emergence of agentic artificial intelligence has been accompanied by an unusually strong industry narrative. Technology vendors, consulting firms and enterprise software providers increasingly present AI agents as the next major stage of digital transformation, promising autonomous workflows, self-managing operations, continuous optimisation and substantial productivity gains across a wide range of business functions. This narrative has played an important role in stimulating investment and experimentation. However, the strength of the commercial discourse makes critical evaluation particularly important.

The Lufthansa Industry Solutions (LHIND) material examined earlier in this paper provides a useful example of this discourse. LHIND presents agentic AI as an evolution from chatbots and conventional automation towards systems capable of planning, decision-making and action across areas including customer service, travel, supply chains, sales, software development, data analysis and IT operations ((Lufthansa Industry Solutions, 2026) Many elements of this description are consistent with academic research, particularly the emphasis on planning, memory, tool use, reasoning and multi-step interaction (Wang et al., 2024; Li et al., 2024; Plaat et al., 2025). Nevertheless, the industry narrative frequently moves from technical possibility to organisational inevitability more quickly than the available empirical evidence permits.

A critical assessment therefore requires a distinction between three different levels of claim: what agentic AI can demonstrate in research environments, what can be achieved in controlled enterprise pilots, and what can be operated reliably and economically at organisational scale. These should not be treated as equivalent. The existence of a technically impressive demonstration does not, by itself, establish that the same capability can be deployed safely, repeatedly and cost-effectively within a complex enterprise environment.

13.1 The myth of technological discontinuity

A common industry claim is that agentic AI represents a fundamental break from previous automation technologies. This framing is commercially understandable because it positions agents as a new technological category and creates a rationale for new investment. In practice, however, the distinction between traditional automation and agentic AI is considerably less absolute.

Modern enterprise automation already combines business-process management, workflow engines, robotic process automation (RPA), machine learning, APIs, retrieval systems, databases and human intervention within integrated operational processes. Research on intelligent automation similarly emphasises the convergence of multiple technologies rather than the emergence of a single replacement technology (Ng et al., 2021). RPA research also demonstrates that enterprise automation has long involved the integration of deterministic software with existing business processes and human activities (van der Aalst, Bichler and Heinzl, 2018; Wewerka and Reichert, 2020).

Agentic AI does introduce an important new capability: the ability to use flexible natural-language reasoning to interpret objectives, select actions, invoke tools and adapt plans across multiple steps (Yao et al., 2023; Wang et al., 2024). This represents a meaningful development. However, it does not eliminate the underlying enterprise systems responsible for executing transactions, enforcing business rules, maintaining records and controlling access.

The more accurate interpretation is therefore one of technological convergence rather than wholesale replacement. Agentic AI can be understood as an additional intelligence and orchestration layer operating across existing enterprise technologies. This interpretation is consistent with the architectural analysis developed in earlier chapters of this paper. The practical implication is significant: successful enterprise adoption depends not only on the capability of the language model, but also on integration, data quality, process design, governance and the reliability of the surrounding systems (Ng et al., 2021; Wewerka and Reichert, 2020).

This also places agentic AI within a longer historical development of automation. Earlier automation technologies tended to work best where processes could be explicitly specified in advance. Agentic systems potentially extend automation into less structured activities by providing a degree of reasoning and planning. The development is therefore significant, but it is better understood as an extension of the automation stack than as the sudden replacement of everything that preceded it.

13.2 The ambiguity of autonomy

A second issue concerns the meaning of autonomy. Industry descriptions frequently imply that agents can independently execute substantial business processes with limited human involvement. Demonstrations of agents completing impressive multi-step tasks can reinforce this perception. Yet the academic literature presents a more qualified picture.

Contemporary agents are highly dependent on the tools, data sources, APIs, memory systems and environments made available to them. Their capabilities emerge from the interaction between the foundation model and these external components rather than from the model operating independently of its environment (Wang et al., 2024; Plaat et al., 2025). Planning mechanisms, tool interfaces and environmental feedback can substantially extend what a model is capable of doing (Huang et al., 2024; Yao et al., 2023).

This distinction is important because autonomy and authority are not synonymous. An agent may be technically capable of proposing a financial transaction, modifying a customer record or changing an infrastructure configuration without being authorised to perform those actions independently. In a well-governed enterprise system, sensitive actions are likely to remain subject to permissions, policy checks, deterministic controls or human approval.

Consequently, many systems described commercially as autonomous agents are more accurately characterised as semi-autonomous orchestration systems operating within bounded organisational constraints. This is not a weakness of the technology. On the contrary, bounded autonomy may be the more appropriate design for enterprise environments because it allows organisations to exploit agent capabilities while limiting the consequences of erroneous decisions.

The distinction also helps to avoid a conceptual error in discussions of agentic AI. Greater ability to perform a sequence of actions does not necessarily mean greater general intelligence. An agent can perform sophisticated tasks because it has access to high-quality tools, carefully designed workflows and relevant information. Its apparent intelligence is therefore partly a property of the system architecture, not simply of the underlying model.

13.3 The misconception of continuous learning

Another recurring industry claim is that agents can continuously improve through experience. The phrase is attractive because it suggests a system that becomes progressively more capable without substantial human intervention. In practice, however, several distinct mechanisms are frequently grouped together under the term learning.

An agent may adapt during a workflow by using feedback from previous actions. It may retain information through memory mechanisms, retrieve better information because its knowledge base has been improved, or perform more effectively because engineers have redesigned its prompts, tools or workflow. These mechanisms can make an agent appear to improve over time, but they do not necessarily constitute autonomous learning in the conventional machine-learning sense.

This distinction matters because most enterprise deployments continue to rely on relatively stable foundation models surrounded by retrieval, memory, orchestration and workflow components. Retrieval-augmented generation, for example, allows a system to incorporate external and updated information without retraining the underlying model (Lewis et al., 2020). Similarly, tool use allows an agent to expand its effective capabilities without changing its fundamental model parameters (Schick et al., 2023).

Consequently, improvements in an enterprise agent may result from:

• better organisational data;

• improved retrieval and indexing;

• revised prompts and instructions;

• better tool interfaces;

• improved planning and orchestration;

• changes to workflow design;

• stronger evaluation and monitoring; and

• human feedback and intervention.

These are important forms of system improvement, but they should not automatically be described as autonomous learning. A distinction should therefore be maintained between model learning, system adaptation and engineering improvement.

The distinction is particularly relevant to corporate governance. If an organisation believes that an agent is continuously learning autonomously, it may underestimate the need for controlled change management, testing and monitoring. By contrast, treating agent improvement as an engineered process makes it possible to establish clear responsibilities for validating changes and assessing their consequences. This aligns with the broader governance principles reflected in ISO/IEC 42001, which treats AI management as an organisational process requiring systematic oversight rather than as an uncontrolled technical capability (ISO, 2023).

13.4 The gap between demonstrations and enterprise reality

One of the most significant weaknesses in the current industry narrative is the tendency to extrapolate from compelling demonstrations to broad claims about enterprise transformation.

Research environments are valuable because they allow new agent architectures to be tested under controlled conditions. However, enterprise environments introduce additional constraints: legacy systems, inconsistent data, authentication requirements, regulatory obligations, security threats, organisational politics, exception handling and the financial cost of errors. An agent that performs successfully in a benchmark or demonstration may therefore behave very differently when deployed within a complex production environment.

The development of more realistic evaluation environments highlights precisely this problem. AgentDojo, for example, evaluates agents in dynamic environments and explicitly considers prompt-injection attacks and defensive mechanisms (Debenedetti et al., 2024). SWE-Bench Pro similarly focuses on longer-horizon software-engineering tasks, illustrating the difficulty of maintaining performance across extended sequences of actions rather than isolated interactions (Deng et al., 2025). The emergence of such benchmarks suggests that the field itself recognises the limitations of simpler demonstrations and static evaluations.

The gap is not merely technical. Enterprise systems have to operate under economic and organisational constraints. An agent may technically be capable of completing a process but still be unsuitable if the cost of inference and tool calls exceeds the value generated, if human supervisors must intervene too frequently, or if errors require expensive remediation. Consequently, capability is only one component of enterprise viability.

The evidence on productivity also illustrates the importance of avoiding overly broad conclusions. Studies of generative AI have found measurable productivity improvements in specific occupational contexts (Noy and Zhang, 2023; Brynjolfsson, Li and Raymond, 2023). These findings are significant, but they do not establish that autonomous agents will produce equivalent gains across all organisational functions. Productivity effects depend on task structure, worker expertise, implementation quality and the way AI is incorporated into existing workflows.

The same caution applies to claims about enterprise-wide transformation. McKinsey's 2025 research indicates substantial experimentation and growing interest in agentic AI, but also suggests that many organisations remain in the process of moving from experimentation towards scaled deployment (McKinsey & Company, 2025). The distance between widespread experimentation and demonstrable enterprise-level financial impact should therefore not be overlooked.

13.5 The security and governance problem

The industry narrative can also understate the extent to which greater autonomy increases the security and governance challenge. A conventional chatbot can produce an incorrect answer; an agent can potentially produce an incorrect answer and then act upon it. The risk profile therefore changes when language-model outputs are connected to tools, enterprise data and external systems.

AgentDojo demonstrates that prompt injection is not merely a question of whether a model produces undesirable text. In an agentic environment, malicious or misleading instructions can potentially influence subsequent tool calls and actions (Debenedetti et al., 2024). The OWASP Top 10 for Agentic Applications similarly reflects the emergence of security concerns specific to systems capable of autonomous planning, tool use and execution (OWASP GenAI Security Project, 2025).

This creates a tension at the heart of the industry narrative. The more autonomy an organisation wants to obtain from an agent, the greater the potential value of the system—but also the greater the potential consequences of failure. This makes bounded autonomy, least-privilege access, policy enforcement, monitoring, auditability and human escalation central components of responsible deployment rather than optional safeguards.

Regulation reinforces this point. The EU AI Act establishes a risk-based regulatory framework for AI systems and places particular emphasis on areas including risk management, human oversight and accountability (European Union, 2024). ISO/IEC 42001 similarly provides a management-system approach for organisations seeking to establish structured governance around AI (ISO, 2023). The trajectory is therefore towards treating agentic AI as an organisational governance issue as much as a technological one.

13.6 From technological hype to empirical assessment

The preceding analysis does not imply that the industry narrative is fundamentally wrong. On the contrary, many of its underlying observations are supported by research. Agentic AI can combine language understanding, planning, memory, retrieval and tool use in ways that extend the capabilities of conventional conversational systems (Wang et al., 2024; Li et al., 2024; Plaat et al., 2025). The technology is therefore genuinely significant.

The problem arises when demonstrated capability is converted into a prediction of inevitable organisational transformation.

A more defensible assessment distinguishes between four propositions:

1. Technological capability: agents can perform increasingly complex multi-step tasks.

2. Operational capability: agents can perform useful tasks reliably within defined environments.

3. Enterprise scalability: these capabilities can be deployed economically and securely across large organisations.

4. Organisational transformation: widespread deployment produces sustained improvements in productivity, competitiveness and business performance.

The first proposition is increasingly well supported. The second is developing rapidly but remains highly dependent on the environment and task. The third remains an important engineering and governance challenge. The fourth is ultimately an empirical question that cannot be answered by demonstrations or vendor claims alone.

This distinction provides a more balanced interpretation of the LHIND narrative. Its description of agentic AI as a movement towards systems capable of planning, reasoning and acting is broadly consistent with the direction of contemporary research (Lufthansa Industry Solutions, 2026) However, claims concerning the scale, autonomy and inevitability of business transformation require greater qualification. The strongest case for agentic AI is therefore not that it will eliminate conventional automation or human work, but that it may expand the range of business processes that can be partially automated and dynamically orchestrated.

13.7 Overall assessment

The evidence supports neither an outright dismissal of agentic AI nor an uncritical acceptance of the industry's more ambitious claims. Agentic AI represents a meaningful technological development because it brings together capabilities—reasoning, planning, memory, retrieval, tool use and action—that can extend automation into more complex and less structured activities (Yao et al., 2023; Wang et al., 2024; Plaat et al., 2025).

At the same time, the technology remains constrained by model reliability, environmental dependence, security vulnerabilities, integration complexity, governance requirements and the economics of deployment. The distinction between autonomy and authority is particularly important: an agent may be capable of performing an action without an organisation being willing—or justified in allowing it—to do so without supervision.

The most credible interpretation is therefore that agentic AI is technologically significant, but its organisational impact remains an empirical question rather than an established fact. The industry narrative is strongest when describing a genuine shift towards more capable AI-enabled orchestration; it is weakest when treating that shift as an inevitable replacement of existing automation or as evidence of imminent fully autonomous enterprise operations.

The likely future is therefore not one in which conventional automation, enterprise software and human workers disappear. Instead, agentic AI is more plausibly understood as another layer in the continuing evolution of intelligent automation. Its long-term value will depend on whether organisations can combine agent capabilities with reliable tools, high-quality data, appropriate governance, effective process design and human expertise. In this sense, the central question is not whether agents can act autonomously, but where autonomy creates value, where it creates unacceptable risk, and how organisations can design the boundary between the two.

14. Future Development

sThe next phase of agentic AI is unlikely to be defined simply by larger language models. The more consequential developments are likely to concern reliability, evaluation, tool integration, interoperability, governance and the redesign of human work. Agentic systems differ from conventional generative AI because they can plan, invoke tools, maintain state and take actions over multiple steps (Wang et al., 2024; Plaat et al., 2025). As a result, progress will depend not only on improving model intelligence, but also on developing the surrounding technical and organisational infrastructure that makes autonomous action safe and useful.

This suggests a shift from viewing an agent as an isolated AI model towards viewing it as a socio-technical system comprising models, tools, policies, data, workflows, monitoring and human oversight. The future development of agentic AI is therefore likely to be evolutionary rather than a simple progression towards unrestricted autonomy.

14.1 Better evaluation

Evaluation is likely to become one of the most important areas of agentic AI development. Traditional language-model benchmarks tend to assess whether a model can produce an appropriate answer. Agents, by contrast, must achieve objectives through sequences of decisions and actions. Their performance can therefore fail even when individual model responses appear plausible. Planning quality, tool selection, error recovery, persistence and the ability to recognise when human intervention is required all become relevant (Huang et al., 2024; Yehudai et al., 2025).

Future evaluation should consequently move beyond simple accuracy towards multidimensional assessment of:

• task success – whether the agent achieves the intended outcome;

• reliability – whether it produces consistent results across repeated runs;

• robustness – whether performance is maintained when conditions, inputs or environments change;

• security – whether the agent resists manipulation, prompt injection and unsafe tool use;

• cost – including model calls, computational resources and operational overhead;

• latency – particularly where agents operate within time-sensitive business processes;

• human intervention – how frequently people must correct, approve or rescue the system;

• long-horizon performance – whether errors accumulate as the number of reasoning and action steps increases; and

• recoverability – whether the agent can detect and recover from partial failures without creating further damage.

The importance of this broader evaluation framework is illustrated by the emergence of environments such as AgentDojo, which explicitly evaluates agents against dynamic tasks and prompt-injection attacks (Debenedetti et al., 2024). Similarly, SWE-Bench Pro extends software-engineering evaluation towards more difficult, long-horizon tasks that require agents to operate across substantial repositories and sequences of actions (Deng et al., 2025). Such developments indicate that the unit of evaluation is gradually shifting from the quality of an individual response to the reliability of an agent operating within an environment.

This is an important conceptual change. A system that achieves a high success rate on isolated tasks may still be unsuitable for enterprise deployment if it performs poorly when tasks are ambiguous, tools fail, permissions change or malicious inputs are encountered. Future benchmarks will therefore need to reproduce the complexity of real operational environments rather than merely increase the difficulty of question answering (Yehudai et al., 2025).

Evaluation will also increasingly need to incorporate governance requirements. The EU AI Act establishes obligations around risk management, transparency, human oversight and other aspects of responsible AI deployment, while ISO/IEC 42001 provides a management-system framework for organisations governing AI systems (European Union, 2024; ISO, 2023). Evaluation can therefore no longer be treated solely as a technical benchmarking exercise: technical performance, operational risk and organisational accountability will increasingly need to be assessed together.

14.2 More reliable tool use

A second major development will be the improvement of agent–tool interaction. Agents become operationally useful when they can move beyond generating text and interact with databases, APIs, enterprise applications and other digital systems. Research such as Toolformer demonstrates the potential for language models to learn when and how to invoke external tools, while ReAct illustrates how reasoning and action can be combined within an agentic loop (Schick et al., 2023; Yao et al., 2023).

However, tool use also creates a critical control problem. The consequences of an incorrect generated answer are generally limited to information quality; the consequences of an incorrect action may include financial loss, disclosure of confidential information, alteration of records or disruption of business processes. This makes the distinction between reasoning authority and execution authority increasingly important.

The likely future architecture is therefore not:

LLM controls everything

but rather:

LLM reasons → policy layer validates → tool executes → system verifies

In this model, the language model proposes an action, but deterministic controls determine whether that action is permissible. Tool interfaces can constrain the available operations, enforce authentication and authorisation, validate parameters and maintain audit trails. A verification layer can then check whether the action produced the intended result.

This approach is consistent with a broader lesson from intelligent automation and robotic process automation: automation is most effective when processes, controls and responsibilities are clearly defined rather than when technology is simply placed on top of poorly understood workflows (van der Aalst, Bichler and Heinzl, 2018; Santos, Pereira and Vasconcelos, 2020; Wewerka and Reichert, 2020). Agentic AI extends this principle by introducing probabilistic reasoning into processes that have traditionally relied on deterministic automation.

Retrieval-augmented generation is also likely to remain important in this architecture. Rather than relying exclusively on information encoded in model parameters, agents can retrieve relevant organisational knowledge at the point of execution (Lewis et al., 2020). This can improve grounding and reduce the need to treat the model itself as the authoritative source of enterprise information. The longer-term direction is therefore likely to be model + retrieval + tools + policies + verification, rather than an increasingly autonomous model operating in isolation.

Security will be particularly important. Agentic systems combine the vulnerabilities of language models with the risks associated with tool access and autonomous execution. The emergence of dedicated security frameworks such as the OWASP Top 10 for Agentic Applications reflects the growing recognition that agents require security controls specifically designed around planning, tool use, memory, identity and autonomous action (OWASP GenAI Security Project, 2025).

14.3 Agent protocols and interoperability

As organisations deploy multiple agents, models and automation platforms, interoperability will become increasingly important. A future enterprise environment may contain specialised agents for customer service, software development, finance, procurement, cybersecurity and knowledge management rather than one general-purpose agent performing every task.

This development creates a coordination problem. Agents need mechanisms for discovering available capabilities, invoking services, exchanging information, maintaining context and communicating securely. Research on multi-agent systems already identifies workflow coordination, infrastructure and communication as central challenges in systems containing multiple LLM-based agents (Li et al., 2024). More broadly, multi-agent research has long treated communication, coordination and cooperation as fundamental properties of distributed intelligent systems (Wooldridge, 2009).

The implication is that interoperability may become as important as model capability. An organisation may gain less from deploying several highly capable but incompatible agents than from deploying a modular ecosystem in which agents can reliably access common services and hand work to one another.

Enterprise deployments therefore point towards architectures based on open interfaces, modular components and explicit boundaries between reasoning, data and execution. Lufthansa Industry Solutions, for example, emphasises modularity and integration as important characteristics of enterprise agentic AI deployments (Lufthansa Industry Solutions, 2026). This direction also aligns with earlier approaches to intelligent automation, where process orchestration and integration with existing enterprise systems are essential to achieving operational value (Ng et al., 2021).

The longer-term possibility is an agentic operating layer for organisations: a structured environment in which agents can discover capabilities, request services, delegate subtasks and operate subject to common identity, security and governance policies. Such an environment would make the agent ecosystem more scalable, but it would also increase the importance of centralised controls over permissions, data access and accountability.

14.4 Human-agent teams

Despite rapid advances in autonomous agents, the most plausible near-term organisational model is likely to be hybrid rather than fully autonomous. Evidence from generative AI adoption already suggests that AI can increase individual productivity, but its effects depend on the nature of the work and the way technology is incorporated into existing processes (Noy and Zhang, 2023; Brynjolfsson, Li and Raymond, 2023). Agentic AI extends this transformation from assistance with individual tasks towards the delegation and orchestration of workflows.

Humans are therefore likely to continue to:

• define objectives and constraints;

• supervise agents;

• approve sensitive or irreversible actions;

• handle exceptions and ambiguous cases;

• evaluate outcomes;

• manage accountability and risk; and

• redesign workflows around the capabilities of the new technology.

Agents, in contrast, are increasingly likely to:

• retrieve and synthesise information;

• execute routine digital tasks;

• monitor systems and processes;

• prepare decisions and recommendations;

• coordinate digital workflows;

• interact with enterprise applications; and

• escalate cases that exceed defined thresholds.

This division should not be understood as a fixed separation between “human work” and “AI work”. Instead, the boundary is likely to move continually as agent capabilities improve. A task that initially requires human approval may later become suitable for conditional automation, while high-risk or ambiguous activities may remain human-controlled.

The organisational consequence is therefore likely to concern work design rather than simply software automation. Earlier automation technologies primarily automated well-defined, repetitive processes (El-Gharib and Amyot, 2022; Wewerka and Reichert, 2020). Agentic AI has the potential to automate parts of less structured knowledge work by combining retrieval, reasoning, planning and action. This could change not only individual tasks but also the allocation of responsibilities across teams.

Microsoft's conception of emerging “Frontier Firms” similarly points towards organisations in which human workers increasingly collaborate with AI agents and agent-based systems (Microsoft, 2025). Industry analysis likewise suggests that enterprise adoption is moving from isolated generative-AI experiments towards broader workflow transformation and autonomous process execution (McKinsey & Company, 2025; Lufthansa Industry Solutions, 2026).

The key challenge will be ensuring that increased autonomy does not create a corresponding reduction in accountability. Human oversight must therefore be designed into workflows rather than added as an afterthought. The EU AI Act's emphasis on human oversight, together with the management-system approach of ISO/IEC 42001, reinforces the need to treat governance as an integral component of AI deployment (European Union, 2024; ISO, 2023).

14.5 From autonomous agents to governed agentic systems

Taken together, these developments suggest that the future of agentic AI is unlikely to be determined by autonomy alone. The central question will increasingly become how much autonomy can be provided while maintaining reliability, security, accountability and economic value.

A useful way of conceptualising the trajectory is therefore:

chatbot → copilot → agent → multi-agent system → governed agentic organisation

Each stage increases the system's ability to act, but also increases the need for controls. Planning research shows that effective agents require mechanisms for decomposing objectives and selecting actions (Huang et al., 2024), while agent surveys emphasise the interaction between reasoning, memory, tools and environments (Wang et al., 2024; Plaat et al., 2025). As these components become more capable, the surrounding governance architecture becomes correspondingly more important.

This also suggests that future competitiveness may not depend solely on access to the most capable foundation model. Organisations may instead differentiate themselves through better processes, proprietary data, effective tool integration, stronger evaluation, safer architectures and superior human-agent collaboration. In this respect, agentic AI continues the longer evolution of intelligent automation: technological capability creates possibilities, but organisational design determines whether those possibilities produce sustainable value (Ng et al., 2021).

The future development of agentic AI should therefore be understood not as a race towards unrestricted machine autonomy, but as a progression towards reliable, interoperable and governed systems capable of performing increasingly complex work. The most valuable agents are unlikely to be those that act without humans; they are more likely to be those that know what they are authorised to do, can demonstrate what they have done, can recover when something goes wrong, and can reliably hand control back to humans when judgement is required.

15. Conclusion

Agentic AI represents a significant development in the evolution of enterprise artificial intelligence because it shifts AI from generating information towards participating directly in organisational work. Its importance lies not merely in improved language or reasoning capabilities, but in the integration of LLMs with memory, planning, tools, enterprise data, and business workflows. This integration enables AI systems to pursue objectives, coordinate multi-step activities, interact with enterprise systems, and support increasingly complex operational processes.

The analysis demonstrates that agentic AI differs fundamentally from both traditional RPA and conventional conversational AI. RPA excels in deterministic, rule-based environments, while chatbots primarily facilitate information exchange. Agentic systems occupy a distinct architectural space in which reasoning, tool use, contextual knowledge, and workflow orchestration are combined to support adaptive enterprise processes. The most important implication is that enterprise value arises not from model capability alone, but from the integration of AI with enterprise architecture, data infrastructure, governance mechanisms, security controls, and human decision-making.

The paper also argues that current industry narratives frequently overstate the maturity of autonomous AI. Although technical progress is substantial, contemporary agents remain vulnerable to hallucination, planning failures, long-horizon errors, and adversarial manipulation. When agents possess permissions to interact with external systems, these limitations become operational and governance risks rather than merely informational inaccuracies. Consequently, successful enterprise deployment requires a shift from model-centric thinking to systems thinking. Organisations must engineer AI as part of an integrated socio-technical architecture encompassing data, APIs, workflows, identity management, cybersecurity, monitoring, governance, and human oversight.

A central principle emerging from this review is that the greater the operational autonomy of an AI system, the greater the architectural and governance controls required to ensure responsible operation. Enterprise AI should therefore be designed around bounded autonomy, least-privilege access, continuous monitoring, and clearly defined human escalation pathways. The appropriate implementation strategy is incremental: organisations should strengthen data and governance foundations, identify high-value bounded workflows, conduct measurable pilot deployments, and expand autonomy only as reliability and organisational confidence increase.

Current evidence suggests that most enterprises remain in the early stages of agentic AI adoption. The near-term competitive advantage is therefore unlikely to belong to organisations that deploy the greatest number of agents, but to those that integrate agents most effectively into reliable, secure, and measurable business processes. In this sense, agentic AI should be viewed not as the replacement of human decision-making, but as a new architecture for human–machine workflow orchestration. Its long-term significance will depend on whether organisations can combine machine-scale execution with human judgement, robust engineering, accountable governance, and continuous organisational learning.

Ultimately, the transition from generative AI to agentic AI is less a story of increasingly autonomous software than of increasingly intelligent enterprise systems. The organisations that derive lasting value from agentic AI will not necessarily possess the most advanced models; they will possess the strongest architectures for integrating intelligence, governance, security, and human expertise into coherent and adaptive enterprise operations.

References

Adamopoulou, E. and Moussiades, L. (2020) ‘An overview of chatbot technology’, Artificial Intelligence Applications and Innovations, 584, pp. 373–383.

Brynjolfsson, E., Li, D. and Raymond, L.R. (2023) ‘Generative AI at work’, National Bureau of Economic Research Working Paper, No. 31161. Cambridge, MA: NBER.

Computerwoche (2025) ‘Agentic AI und die Zukunft der Unternehmensautomatisierung’. Computerwoche.

Debenedetti, E., Zhang, J., Balunović, M., Beurer-Kellner, L. and Tramèr, F. (2024) ‘AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents’. arXiv preprint, arXiv:2406.13352.

Deng, X., Da, J., Pan, E. et al. (2025) ‘SWE-Bench Pro: Can AI agents solve long-horizon software engineering tasks?’. OpenReview / ICLR 2026 submission.

European Union (2024) Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union.

El-Gharib, N.M. and Amyot, D. (2022) ‘Robotic Process Automation using Process Mining – A systematic literature review’. arXiv preprint, arXiv:2204.00751.

Gao, C., Lan, X., Li, N. et al. (2024) ‘Large language models empowered agent-based modeling and simulation: a survey and perspectives’. Humanities and Social Sciences Communications, 11, 1259.

Huang, X., Liu, W., Chen, X. et al. (2024) ‘Understanding the planning of LLM agents: A survey’. arXiv preprint, arXiv:2402.02716.

ISO (2023) ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. Geneva: International Organization for Standardization.

Lewis, P., Perez, E., Piktus, A. et al. (2020) ‘Retrieval-augmented generation for knowledge-intensive NLP tasks’, Advances in Neural Information Processing Systems, 33, pp. 9459–9474.

Li, X., Wang, S., Zeng, S. et al. (2024) ‘A survey on LLM-based multi-agent systems: workflow, infrastructure, and challenges’, Vicinagearth, 1, 9.

Lufthansa Industry Solutions (2026) ‘Lufthansa Industry Solutions named UiPath Agentic Automation Fast Track Partner’. Norderstedt: Lufthansa Industry Solutions.

McKinsey & Company (2025) The state of AI in 2025: Agents, innovation, and transformation. 5 November.

Microsoft (2025) 2025 Work Trend Index Annual Report: The year the Frontier Firm is born. Redmond, WA: Microsoft.

Ng, K.K.H., Chen, C.H., Lee, C.K.M., Jiao, J.R. and Yang, Z.X. (2021) ‘A systematic literature review on intelligent automation: aligning concepts from theory, practice, and future perspectives’, Advanced Engineering Informatics, 47, 101246.

Noy, S. and Zhang, W. (2023) ‘Experimental evidence on the productivity effects of generative artificial intelligence’, Science, 381(6654), pp. 187–192.

OWASP GenAI Security Project (2025) OWASP Top 10 for Agentic Applications. Wilmington, DE: OWASP.

Plaat, A., van Duijn, M., van Stein, N., Preuss, M., van der Putten, P. and Batenburg, K.J. (2025) ‘Agentic Large Language Models, a survey’. arXiv preprint, arXiv:2503.23037.

Russell, S. and Norvig, P. (2021) Artificial Intelligence: A Modern Approach. 4th edn. Harlow: Pearson.

Santos, F., Pereira, R. and Vasconcelos, J.B. (2020) ‘Toward robotic process automation implementation: an end-to-end perspective’, Business Process Management Journal, 26(2), pp. 405–420. doi:10.1108/BPMJ-12-2018-0380.

Schick, T., Dwivedi-Yu, J., Dessì, R. et al. (2023) ‘Toolformer: Language models can teach themselves to use tools’, Advances in Neural Information Processing Systems, 36, pp. 68539–68551.

Stanford, 2026 The 2026 Stanford AI Index

van der Aalst, W.M.P., Bichler, M. and Heinzl, A. (2018) ‘Robotic Process Automation’, Business & Information Systems Engineering, 60(4), pp. 269–272. doi:10.1007/s12599-018-0542-4.

Wadhwa, N., Sonwane, A., Arora, D. et al. (2024) ‘MASAI: Modular architecture for software-engineering AI agents’. NeurIPS 2024 Workshop on Open-World Agents.

Wang, L., Ma, C., Feng, X. et al. (2024) ‘A survey on large language model based autonomous agents’, Frontiers of Computer Science, 18, 186345. doi:10.1007/s11704-024-40231-1.

Wewerka, J. and Reichert, M. (2020) ‘Robotic Process Automation – A systematic literature review and assessment framework’. arXiv preprint, arXiv:2012.11951.

Wooldridge, M. (2009) An Introduction to MultiAgent Systems. 2nd edn. Chichester: Wiley.

Yao, S., Zhao, J., Yu, D. et al. (2023) ‘ReAct: Synergizing reasoning and acting in language models’, International Conference on Learning Representations (ICLR).

Yehudai, A., Eden, L., Li, A. et al. (2025) ‘Survey on evaluation of LLM-based agents’. arXiv preprint, arXiv:2503.16416.

Contact

Reach out via email for inquiries.

Email

Subscribe to newsletter

info@grcadvisory.ch

© 2025. All rights reserved.