Jon CursiThe most common question I get about internal AI agents is some version of "what can they actually do?"
It is the wrong first question.
An Internal AI agent can do a lot. Draft, research, test, update, monitor, summarize, clean up, move recurring workflows forward. The list is long and getting longer.
The question that actually determines whether a deployment holds up is different: what should this agent never own without a human in the loop?
Answer that badly and you get one of two failure modes. An agent with too much authority that makes calls it had no business making. Or an agent so hobbled that it produces drafts nobody trusts, and the whole thing quietly dies.
Answer it well and something better happens. The agent moves faster, because nobody has to stop and debate every output. Boundaries are not red tape. They are what let you delegate real work without holding your breath.
Sort the Work Into Three Buckets
Every workflow you consider handing to an agent lands in one of three buckets. The sorting takes about five minutes per workflow, and it is the highest-value five minutes in the whole deployment.
Bucket one. The agent owns work that is inspectable, reversible, and has clear acceptance criteria. That can mean drafting a report from defined data, opening a pull request, flagging stale records, preparing a weekly brief, or updating a ticket. If the output is wrong, someone catches it in normal review and the fix costs minutes.
Bucket two. The agent prepares work where the output itself is fine to automate but the send or the execution carries weight. The agent does 95% of the labor. A person owns the last 5%.
Bucket three. The agent never owns work where the whole point is human accountability. It can support that work around the edges, but it should never be the actor of record.
Most of the arguments about AI safety inside companies are really arguments about which bucket something belongs in. So let me be specific about the last two, because bucket one takes care of itself.
What Belongs in "Prepare, Then Approve"
Two categories, mostly.
Communication that creates commitments. Customer apologies, contract or pricing language, security updates, executive announcements, anything with a promise in it. The problem is not that agents write badly. They usually write fine. The problem is that "we will have this fixed by Friday" is a commitment, and someone needs to know whether Friday is real before it leaves the building. Let the agent draft and route. Require approval on the send.
Changes that are hard to undo. Deleting production data, changing permissions, touching billing, bulk updates to customer records, risky infrastructure merges. The agent can identify the stale records, draft the migration plan, and open the pull request. The irreversible action gets gated behind explicit approval.
Notice what this setup is not. It is not "AI can never touch important systems." That wastes the agent. It is "AI prepares important changes, humans pull the trigger on the ones you cannot take back." You keep almost all of the speed and none of the 2am incidents.
What Belongs in "Never Owns"
Also two categories.
Final business judgment. Strategy changes, budget approval, hiring and firing, pricing decisions, customer exceptions that affect trust. An agent can make these decisions dramatically easier to make. It can gather context, compare options, flag what is missing, and hand leadership a clean recommendation. But the call belongs to a person, because accountability belongs to a person.
Same logic applies to people problems. Performance, compensation, conflict, discipline. Companies trip on this one because people work looks like paperwork from the outside. Forms, notes, recurring processes. Automate the paperwork. Keep the judgment human.
Work nobody can define. This is the boundary people miss. An agent should not be the first owner of a workflow the company itself cannot explain. "Clean up our CRM" when sales and finance define clean differently. "Improve reporting" when nobody agrees which metrics matter. The agent will produce output, but nobody can judge it, so nobody trusts it, so it goes unused.
The fix is not to skip that work. It is to point the agent at the ambiguity first. Have it inventory current state, surface the duplicates and gaps and unclear owners, and draft a proposed operating model for humans to approve. Once the workflow is legible, hand over the recurring execution. This scoping step is a big part of what our managed model actually does, and honestly it is where most of the value gets created or lost.
A Quick Test When You Are Unsure
If a workflow does not sort cleanly, ask two questions:
- If this output is wrong, how much does the mistake cost, and how fast can we reverse it?
- If a customer, employee, or board member questioned this decision, who defends it?
Cheap and reversible, agent owns it. Expensive or irreversible, agent prepares it. Someone specific has to defend it, that someone owns it.
That is the whole framework. You do not need a governance committee or a 90-page policy. For a first deployment, one page covers it: what the agent does without asking, what always requires approval, what it never touches, when it escalates to a person, and how you will judge the results after 30 days.
Boundaries Are How You Expand, Not How You Stay Small
Here is the part people get backwards. Tight boundaries feel like they limit the agent. In practice they are what lets you widen the lane.
An agent that owns a defined workflow, gets reviewed, and improves builds trust the boring way, through output. Then expansion is easy to justify. Reporting grows into follow-up task creation. Engineering QA grows into maintenance work. Audits grow into updates. Each new lane starts in bucket two and earns its way to bucket one.
An agent with vague authority never earns anything, because nobody can point to a lane it handled well. The first bad outcome kills the whole program, and fairly so.
The companies getting real value out of internal AI right now are not the ones handing agents unlimited authority. They are the ones treating agents like new operators: clear job, clear limits, clear review, growing scope. Less exciting than "AI runs everything." Far more likely to still be running a year from now.
If you are trying to figure out where an internal agent fits in your business, start by sorting the work into those three buckets. It clarifies more than any tool evaluation will. And if you want a second set of eyes on it, book a live demo and we will map your first workflow, boundaries included, before anything gets turned on.