An operations team handles hundreds of small cases every day. A delivery is late, an invoice does not match the order, a customer wants to move an appointment. The cases follow a pattern, but each one differs in the details. Fixed automations break on the details, and people spend their days on routine. AI agents promise to close this gap: they read the case, decide on the next steps and use tools to resolve it. The real questions are which processes, with which guardrails and with how much autonomy.
This is part 5 of Level 4, the last part of our AI Work learning path. Level 0 introduced assistants, automations and agents, Level 2 showed how to automate business workflows with triggers and approvals, and Level 3 placed human checks where the risk is. Here you put these pieces together for operations: workflow patterns, how long tasks agents can handle today, process fit, tool access, guardrails, monitoring and a step-by-step path to autonomy.
From fixed workflows to agentic workflows
Anthropic, the company behind the Claude models, draws a useful line. In a workflow, language models and tools follow predefined code paths. An agent directs its own process and tool use (Source: Anthropic, “Building Effective Agents”, 2024, anthropic.com). Between the two lies a middle ground that suits many operations tasks: the agentic workflow. The process and the allowed actions are fixed, but within them the AI decides which step comes next.
The same source describes five common patterns:
- Prompt chaining: a task runs as a fixed sequence of AI steps, and each step can be checked before the next one starts.
- Routing: the AI classifies a case and sends it down the right path.
- Parallelization: several AI calls work on parts of a task at the same time, or vote on an answer.
- Orchestrator-workers: one AI splits a task into subtasks and hands them to others.
- Evaluator-optimizer: one AI produces a result, and another checks it against criteria and asks for a revision.
Its most important design advice is simple: find the simplest solution that works, and add complexity only when it clearly helps. An agent costs more time and money than a workflow, and it is harder to predict. The table compares the three options for one case, a late delivery:
| Fixed workflow | Agentic workflow | Autonomous agent | |
|---|---|---|---|
| Path | Defined in advance | The AI chooses among allowed steps | The AI plans its own steps |
| Late delivery | Every complaint gets the same template reply | The AI reads the email, checks the carrier, then replies with a new date, rebooks or escalates | The AI gets the goal “resolve late deliveries” and decides which systems to use and what to offer |
| Strength | Predictable and cheap | Handles variety within limits | Handles open-ended tasks |
| Main risk | Breaks on exceptions | A wrong choice among allowed actions | Unexpected actions that are hard to audit |
| Fit for operations | Stable, rule-based steps | Most routine cases with variety | Rarely, and only with strong controls |
How long tasks agents can handle today
Multi-step work is hard for a simple reason: errors add up. If each step succeeds 95 percent of the time and the steps are independent, a ten-step task succeeds only about 60 percent of the time (0.95 to the power of 10). At 99 percent per step, it is about 90 percent. Good agents notice and fix some of their own errors, so real results can be better than this simple math. But the direction holds: longer tasks fail more often.
The research organization METR measures this with the time horizon: the length of tasks, counted in the time a skilled human needs for them, that a model completes successfully about half of the time. These are the current leaders in our LLM database:
| # | Model | Released | Result |
|---|---|---|---|
| 1 | Claude Mythos Preview (Early) Anthropic | Apr 7, 2026 | 17 h 25 min |
| 2 | Claude Opus 4.6 (unknown thinking) Anthropic | Feb 5, 2026 | 11 h 59 min |
| 3 | Gemini 3.1 Pro Preview Google DeepMind | Feb 19, 2026 | 6 h 24 min |
| 4 | GPT-5.2 (high) OpenAI | Dec 11, 2025 | 5 h 52 min |
| 5 | GPT-5.3 Codex OpenAI | Feb 5, 2026 | 5 h 50 min |
The length of the tasks a model completes correctly about half of the time, measured by how long a human expert needs for them. The number is a duration, not a score: a longer horizon means the model can work on its own for longer. Data: Epoch AI, retrieved on October 17, 2026, licensed CC BY 4.0. All models: LLM database.
In its 2025 study, METR found that this horizon had doubled roughly every seven months since 2019 (Source: METR, “Measuring AI Ability to Complete Long Tasks”, 2025, metr.org). Three points matter for operations:
- Fifty percent is not reliable enough. At a success rate of 80 percent, METR measured horizons four to six times shorter than at 50 percent. So a model that completes one-hour tasks half of the time reaches 80 percent success only on tasks of roughly 10 to 15 minutes.
- The tasks are software and reasoning tasks with clear success criteria. Real operations work is messier: incomplete data, unclear requests, exceptions. Expect shorter reliable task lengths there than in a benchmark.
- Design far below the horizon. Cut work into steps that are much shorter than the horizon, with a check after each step. You can compare models and their results in our LLM database.
Which processes fit an agent
Two questions sort most processes: How different are the cases — their inputs, paths and exceptions? And how easily can you undo an error?
Fixed rules handle uniform cases best, and an agent only adds cost and risk there. Agents earn their place where cases vary but mistakes are cheap to fix: answering delivery questions, rescheduling, sorting and enriching tickets. Where mistakes are expensive or final, the AI prepares and a person acts. Good candidates share six traits:
- A high volume of similar but not identical cases.
- A clear goal and a way to check the result.
- Actions that can be undone, or an approval step for those that cannot.
- Data and tools that the agent can reach through interfaces.
- A fallback: a queue where people take over.
- An owner who is responsible for the results.
Poor candidates are rare decisions with high stakes, decisions about people such as hiring or credit — high-risk uses under the EU AI Act — and processes where nobody can say what a good result is. Part 3 explains how such uses are classified in AI governance for business teams.
Give the agent tools, not keys
An agent acts through tools: functions it can call, such as “look up an order”, “rebook a delivery” or “send an email”. The design of these tools decides most of the risk:
- Narrow tools beat broad ones. “Rebook the delivery for this order” is safer than “update any field in the database”.
- Separate reading from writing. Most steps only need to read. Tools that write get extra checks.
- Least privilege. The agent gets its own service account with only the permissions its task needs.
- Limits inside the tool: maximum amounts, a daily number of actions, time windows. A limit in code still holds when the AI makes a mistake.
- Repeat-safe actions. If a step runs twice after an error, it must not book twice. This is the idempotency rule from Level 2.
- A test mode: a sandbox or dry run that shows what the agent would do without doing it.
The OWASP Top 10 for LLM Applications calls the main risk here excessive agency and names three root causes: too much functionality, too many permissions and too much autonomy (Source: OWASP Top 10 for LLM Applications 2025, LLM06, owasp.org). A related risk is prompt injection: instructions hidden in an email, a document or a web page that the agent reads. Treat every outside text as data, never as an instruction, and never let content change what the agent is allowed to do. Our AI Security section explains these attacks and the defenses against them.
Guardrails in five layers
No single control is enough. Put guardrails in layers, so that one layer catches what another one misses:
- Scope: a clear goal, the cases the agent may handle, stop conditions and a maximum number of steps.
- Tools and permissions: narrow tools, separate read and write access, a service account of its own.
- Action limits: approval above thresholds, for example for refunds above a set amount, and budgets for money, actions and time.
- Checks: inputs and outputs are validated against rules, for example that a new delivery date lies in the future and that the customer exists.
- Monitoring and stop: a log of every step, alerts for unusual patterns and a kill switch.
Monitor agents like a new colleague
Watch an agent the way you would watch a new colleague in the first months: closely at first, then with regular checks. These metrics show whether it works:
| Metric | What it shows | Warning sign |
|---|---|---|
| Task success rate | Share of cases resolved correctly, checked by sampling | Falls after a model or prompt change |
| Escalation rate | Share of cases handed over to people | Rises suddenly, or drops to zero |
| Override rate | How often people reverse an action | Any rise in cases with high value |
| Blocked actions | Actions stopped by limits or checks | A sudden rise points to a new pattern or an attack |
| Cost per case | Model usage and tool calls per resolved case | Loops that run up costs |
| Time to resolution | From the incoming case to its closure | Cases stuck between agent and people |
An escalation rate of zero is a warning sign, not a success: either the agent is overconfident or the handover is broken. Log every step — input, tool call, result and decision — so that you can trace any case afterward. Review a sample every week. Rerun your test cases after every model update or prompt change, because the same agent can behave differently on a new model.
Earn autonomy step by step
Do not switch an agent on at full autonomy. Let it earn each step:
Shadow mode comes first: the agent proposes actions for real cases, people act as before, and you compare the two. This shows the agent’s quality without any risk to customers. Then a person approves every action, then only actions above thresholds, then people check samples and read a daily report. Even at the top step, monitoring, alerts and regular audits remain. Before each step up, agree on criteria: enough cases, agreement with human decisions above a level you set in advance, no serious incidents and stable costs. After a serious incident, step back down.
Products in our comparison show the range from fixed flows to agents. According to the vendors, Ignition brings proposals, engagement letters and billing together in one flow. Typewise runs AI agents that handle customer requests across channels and work in CRM and ERP systems. Vida’s AI phone agents answer calls and schedule appointments, and AiSDR is an AI sales agent that handles first outreach and replies:
Short descriptions from our tool comparison, based on the vendors' information — not tested by ABXK.