Agentic AI in operations: where it earns its keep

The most useful autonomous component we have in production anywhere raises support tickets. On the solar grid platform we built for iConcept PowerTech in Indonesia, a layer watches generation telemetry, decides something has gone wrong, and raises and routes a ticket to the right team with no human in the loop. Nobody calls it agentic AI in the status report. It observes, decides and acts on the world, which is the whole of the definition, and it earns its keep because of three properties that every autonomous system we have seen work has had.

Narrow, reversible, instrumented

Narrow means the decision space is small enough to write down. Ticket or no ticket, which queue, what priority, which asset. The system is not asked to fix the plant, order a part or decide whether the site should keep running. Every autonomous component we have had to unpick later was one where the scope had been described with a verb like handle or manage rather than an enumerable set of outcomes.

Reversible means the worst case is cheap. A ticket that should not have been raised costs an engineer five minutes and a small withdrawal from the operations team's patience. Compare that with an agent that dispatches a field crew at two in the morning, issues a refund, changes a firewall rule, or closes a valve. Those actions are expensive or impossible to undo, so the correct architecture puts a human between the decision and the act, and the agent's job becomes preparing a recommendation well enough that the human decision takes seconds.

Instrumented means every decision is recorded with the inputs that produced it, so the false positive rate is a number somebody owns and reviews on a schedule. Without that, nobody can say whether the thing is helping, and the question gets settled by whoever last had a bad experience with it. An autonomous component with no measured precision is a rumour.

Where it turns into a liability

The dangerous failure is the wrong action that stays invisible until reconciliation, weeks later, in a report nobody was reading. Autonomy removes the human who would otherwise have noticed something odd on the way past, so the instrumentation has to replace that person deliberately rather than by accident.

Chain length is the other quiet killer. Multi-step autonomy compounds error: eight sequential steps at ninety-five per cent accuracy each are right about two thirds of the time, and the failures cluster in the cases that were already unusual. Long autonomous chains are where demonstrations look magical and operations look like a bad week. Where we have wanted a long chain, the workable version has been several short ones with an inspectable checkpoint between them.

Regulated decision boundaries are the clearest place autonomy does not belong yet. A bank declining a transaction has to explain that decline to a customer and, later, to a regulator, with the provenance of every feature that fed the decision. The fraud platform we built for a financial institution cut fraudulent transactions by a quarter, and it is deliberately conservative about what it decides on its own, because an unexplainable decline is a compliance event rather than a technical one. Autonomy at the point of a customer-affecting decision buys throughput and pays for it in the audit.

The questions we ask before building one

• What is the largest mistake this component is permitted to make, and how long does a human need to undo it?
• What is the acceptable false positive rate, agreed in writing before launch rather than argued about after?
• Who reads the decision log, how often, and what triggers a review?
• What does the system do when the model is unavailable, and is that fallback exercised or theoretical?
• Who turns it off, and does that person need anyone's permission at three in the morning?

The last one matters more than it sounds. An autonomous component nobody on shift is allowed to disable will be worked around instead, usually by ignoring its output, and then it is running unattended with no one acting on it.

Agentic is a description of an architecture rather than a category of product, and the architecture is only as good as the blast radius it is allowed. The autonomous systems we would defend in a review are the ones where somebody wrote down, in advance and in plain language, the worst thing the machine is permitted to do on its own.