From Chatbots to Agents: What Changes When AI Takes Actions

The interesting shift in enterprise AI over the past year has not been model capability. It has been the move from systems that produce text for a human to read towards systems that take actions in other systems.

That is a change of kind rather than degree, and most organisations’ governance was written before it.

The failure mode moves from wrong to done

When an assistant drafts an email, a poor output is visible before it has any effect. A human reads it and discards it.

When a system issues a refund, updates a record, places an order or sends a message, the error has already occurred by the time anyone notices. The control has to move from reviewing the output to constraining what the system is permitted to do.

Permissions matter more than prompts

A great deal of attention goes into instructing these systems carefully. Far less goes into what they can reach.

The durable control is the same one that applies to any automated process: least privilege, explicit scopes, and hard limits on value and volume. A system that cannot issue a refund above a threshold cannot issue a large wrong refund, whatever it was persuaded to attempt.

Reversibility should drive autonomy

A useful way to sort use cases is by how easily an action can be undone. Updating an internal draft is trivially reversible. Sending a message to a customer is not. Moving money is not.

Grant autonomy in inverse proportion to reversibility. Where an action cannot be undone, a human decision point belongs in the path, and it should be a real decision rather than a confirmation dialogue nobody reads.

Logging becomes the primary evidence

With an assistant, the transcript is a convenience. With an agent, the action log is the only record of what your organisation did and why.

It needs to capture the decision, the inputs available at the time, and the identity under which the action was taken. Organisations that treat this as an afterthought find they cannot answer basic questions when something goes wrong.

Start where the blast radius is small

The sensible entry points are internal, reversible and bounded: reconciling records, preparing routine documents, triaging requests into queues.

These build the operational muscle, the logging discipline and the permission model you will need before anything touches a customer or a payment. Organisations that begin at the ambitious end usually end up pausing the whole programme after the first incident, which sets them back further than starting small would have.