What is agentic AI, in one sentence?

AI that is given a goal rather than a question, and plans, acts in your systems and checks its own work until the goal is met or it reaches a limit you have set.

How is it different from generative AI?

Generative AI produces content when prompted: a draft, a summary, an image. Agentic AI uses generative models as its reasoning engine but adds tools, memory and permission to act, so it completes multi-step work rather than handing you a draft to finish.

Isn’t this just RPA with a language model?

RPA follows a script exactly and stops when the screen or the data changes. An agent decides its next step from what it finds, so it can handle the exceptions that make up much of the cost in many processes. The two work well together: RPA for the predictable steps, agents for the judgement.

Where should we start?

With one process that is frequent, costly and full of exceptions, where today’s baseline can be measured. Not with a platform purchase. A narrow first agent that measurably works earns the trust, and the data, to widen its limits.

How do you stop an agent doing something harmful?

By design rather than by hope. Each agent has its own identity with least-privilege access, irreversible actions wait for a named person, the riskiest actions are simply not available, inputs such as emails are treated as data rather than instructions, and every step is logged. We test against prompt injection before release.

What does it cost to run?

Cost is per completed task: model calls, tool calls and the human review time around them. Multi-agent designs can use many times the model calls of a single agent, so we use them only where they pay. We price the run before building and set spend limits in production.

Will agents replace our people?

In most of the work we see, agents take over steps rather than jobs: gathering, checking, chasing and re-keying. People move to the exceptions, the approvals and the relationships. Planning that shift openly, with the teams affected, is part of every engagement.

Which models and platforms do you use?

We are vendor-neutral. We choose models per task on accuracy, cost, speed and data-residency needs, build to open standards such as MCP so models can be swapped, and work within your existing cloud and security setup.

How does this fit the EU AI Act and UK rules?

The EU AI Act entered into force in August 2024, with obligations phasing in through 2027 depending on the risk category of a use case. The UK applies existing law through sector regulators. We classify each use case against the relevant regime before build, and keep the documentation an auditor would ask for.

What data do agents need?

Access to the systems the task touches, through proper interfaces and permissions, and enough real past cases to test against. Perfect data is not a prerequisite. Knowing where the data is weak is.

How quickly will we see results?

Pilots are scoped to show a measured result against their baseline quickly, running in shadow mode beside your team. If an agent cannot beat the baseline, that is a useful answer too, and far cheaper to learn early.

Agentic AI for enterprise

Give AI a goal,not a prompt.

Agents that plan the steps, work across your systems and check their own results, inside limits you set.

Book a discovery session Watch an agent think

What an agent is

01The shift

An agent is software that pursues a goal.

Most AI in use today answers: you ask, it replies, you do the work. An agent is handed an outcome instead. It breaks the outcome into steps, chooses tools, acts in real systems, looks at what happened and adjusts until the goal is met or it reaches a limit you have set.

PerceiveReads what is in front of it: emails, tickets, documents, records, data feeds.
PlanBreaks the goal into steps and decides which tool or colleague each one needs.
ActCalls APIs, updates records, sends messages, runs code. Real changes in real systems.
CheckVerifies the result, learns from feedback and asks a person when it is unsure.

How much should it decide?

Autonomy is a setting, not a property of the technology. Same request, six settings: a customer asks for a £180 refund on a damaged order. Drag the needle.

Where most enterprise value sits today

L3Act with approval

Who decides
Good for
Watch for

Our autonomy scale, adapted from how driving automation is graded. Most enterprise value today sits at L2 to L4. Autonomy is earned one level at a time, with evidence.

02Inside an agent

Watch one agent think.

A supplier emails asking to change the bank account you pay them into, before Friday’s payment run. It is one of the most common routes to payment fraud. Scroll through what a well-built agent does with it, and which part of the agent is working at each step.

Active componentGoal01 / 08

01 · Goal
Keep supplier records accurate and payments safe.

The agent’s standing objective. It is not “process every email”. That difference matters at step four.
02 · Perceive
An email arrives.

Fromaccounts@northfield-supplies.co

SubjectUpdated bank details, urgent

Please use our new account for Friday’s payment. Our old bank is closing the account this week.

inbox.read()
03 · Memory
It checks what it already knows.

Supplier on file since 2019. Contact domain on record: northfield-supplies.com. This email came from .co. No change requests in five years.

memory.recall("Northfield")
04 · Reason
It recognises the pattern.

Bank change, a deadline, and a lookalike domain. Processing the request would complete the task. It would also fail the goal. The agent plans around the goal.
- Do not change details
- Protect Friday’s payment
- Verify through a known contact
- Escalate with evidence
05 · Guardrail
Policy blocks the risky action.

Bank detail changes need verification through a contact already on file, and agents may never edit payment details themselves. Even if the reasoning had gone wrong, this action was never available to it.

erp.update_bank()Blocked by policy
06 · Act
It does the safe things it is allowed to do.

Places a hold on this supplier in Friday’s run, and writes to the known contact at the .com address asking them to confirm.

erp.hold_payment()inbox.send(to: known_contact)
07 · Human
It hands the decision to a person.

The accounts payable lead gets one message: what happened, why it looks wrong, what the agent has already done, and two buttons.

Escalated to AP lead
08 · Record
Nothing moved. Everything is on file.

Every input, step and decision is logged for audit. The supplier replies from the real address: they never sent the email.

OutcomeFraud attempt stopped before Friday. Time from email to escalation: minutes, not the next morning.

Illustrative scenario. Names and addresses are invented.

03Three generations

Rules, then words, now work.

Agents did not arrive from nowhere. They are what happens when language models that can reason are given tools, memory and permission to act. Drag through sixty years in fourteen moments.

RulesLearningWordsWork

Generation 1Traditional automation Generation 2Generative AI Generation 3Agentic AI

04Architectures

One agent, or a team?

More agents is not better. Each pattern buys something and costs something. We start with the simplest one that can do the job, and add agents only when a single one runs out of context, skill or speed.

0 messages passed

Best for
Watch for
Example

Build effort

Running cost

Handles complexity

The plumbing is standardising

Model Context Protocol MCP

An open standard for connecting agents to tools and data, introduced by Anthropic in November 2024 and adopted across the major AI platforms during 2025. One connector per system, instead of a custom integration for every model.

Agent2Agent A2A

An open protocol for agents to discover each other and hand off work, announced by Google in April 2025 and moved to the Linux Foundation that June. It lets agents from different vendors cooperate on one task.

What it means for you

Agents you build now can plug into systems you buy later. We design to these standards so you are not locked to one model or vendor, and so swapping a model is a configuration change, not a rebuild.

05Where it pays

Where agents earn their keep.

Agents pay where work is frequent enough to matter and varied enough that rules break. Too predictable, and plain automation is cheaper. Too rare or too consequential, and a copilot beside a person is the better tool. Pick a function, then a process.

Automate with rulesPredictable and high volume

Agent sweet spotHigh volume, needs judgement

Leave itRare and simple

Copilot firstRare, high judgement

Judgement needed → Volume and cost of the work →

Finance

Invoice exceptions

What the agent does
Where a person stays
Measure it by

Positions are our qualitative judgement for a typical mid-to-large enterprise. Your map will differ; drawing it is the first thing we do together.

06Reality check

Why most pilots stall.

The opportunity is real, and so is the failure rate. Analysts expect agents inside a third of enterprise software within a few years, and a large share of today’s projects to be cancelled first.

0%+

of agentic AI projects expected to be cancelled by the end of 2027, through escalating costs, unclear business value or inadequate risk controls.

Gartner, June 2025

vendors, out of thousands claiming “agentic AI”, judged to offer real agentic capability. The rest is relabelled chatbots and automation.

Gartner, June 2025

of enterprise software applications forecast to include agentic AI by 2028, up from less than 1% in 2024.

Gartner

of day-to-day work decisions forecast to be made autonomously by agentic AI by 2028, up from none in 2024.

Gartner

The maths nobody puts on the slide.

Errors compound. If every step of a task is right 95% of the time, a twenty-step task finishes correctly only about a third of the time. Move the sliders and watch a hundred runs.

Accuracy per step 95.0% Steps in the task 20 Check and retry each stepAssumes a check catches 70% of mistakes before they pass on

0.950²⁰ = 35.8% of runs fully correct

36 correct64 went wrong somewhere

1 stepChance of a fully correct run, by length40 steps

How we design for the three reasons projects get cancelled

Escalating cost

Price the run, not the tokens.

We model cost per completed task, including model calls, tool calls and human review time, before anything is built, and set hard spend limits in production.

Unclear value

Baseline first.

Every pilot starts from a measured baseline and one metric the business has signed: cost per case, cycle time, error rate. If it doesn’t move, we say so.

Risk controls

Guardrails on day one.

Permissions, approvals, evaluation suites and audit logs are part of the first build, not a phase after the demo.

07Governance

Autonomy, inside limits.

Every action an agent can take is a decision about risk. Set what this agent may do on its own, what needs a person, and what it can never do. The trade-off is the whole job: more autonomy finishes more work, and widens the damage when something goes wrong.

ActionRiskSetting

Blast radius

Work it finishes alone0%

Exposure if it is wrong0%

Least privilege

Each agent gets only the tools and data its task needs, through its own identity, never a shared admin account.

People on the irreversible

Payments, deletions and anything sent outside the company wait for a named approver.

Inputs are data, not orders

Emails and documents can carry hidden instructions. Agents treat them as content to read, never commands to follow.

Spend and rate limits

Hard ceilings on cost, calls and actions per hour, so a loop cannot run up a bill or flood a system.

Tested before release

An evaluation suite of real cases runs before every change, the way regression tests guard software.

Every step traced

Inputs, reasoning, tool calls and outcomes are logged, so any decision can be replayed and explained.

Mapped to the frameworks your risk team already uses

OWASP Top 10 for LLM Applications, 2025

LLM01 Prompt injection and LLM06 Excessive agency are the two risks agents raise most. Controls 02 to 04 address them directly.

NIST AI Risk Management Framework

Four functions, Govern, Map, Measure, Manage, give the structure for our risk register and review cadence.

ISO/IEC 42001:2023

The international standard for an AI management system. We build the evidence trail an auditor would ask for.

EU AI Act

In force since August 2024, with obligations phasing in through 2025 to 2027. We classify each use case against it before build.

08How we deliver

Earn autonomy with evidence.

01Frame

Find the work worth delegating.

We map the processes, measure today’s cost and cycle time, and score candidates on value and risk. Most organisations have more candidates than they think, and fewer good ones.

Process and data map
Baseline metrics
Scored shortlist

GateA baseline and a target the business signs.

02Prove

A bounded pilot, on real data.

We build the smallest agent that could work and run it in shadow mode beside your team: it proposes, people decide, and we compare every case against the baseline.

Working pilot agent
Evaluation set from real cases
Cost per task, measured

GateAccuracy and cost per task beat the baseline in shadow mode.

03Harden

Make it safe to rely on.

Permissions, approvals, prompt-injection testing, observability and cost controls, wired into your identity, logging and change processes.

Guardrails and approval flows
Red-team report
Monitoring and spend limits

GateSecurity and risk sign-off, with people on every irreversible step.

04Scale

Hand over, then widen the limits.

A staged rollout, training for the people who work beside it, a named owner in the business, and autonomy widened only where the data supports it.

Rollout and training
Owner and runbook
Quarterly autonomy review

GateAn owner, a dashboard and a review date in the diary.

09Questions

Ask us anything.

The questions boards and teams ask us most. Type to search.

Next action / awaiting you

Find your first agent worth building.

A focused session with Aamar Hussain, our lead on enterprise AI and multi-agent systems. Bring a process that hurts. Leave with a clear view of whether an agent is the answer, at what autonomy level, and with which controls.

Two or three candidate processes, scored on value and risk
The autonomy level and controls each one would need
An honest “not yet” where agents are not the answer

Book a discovery session Get the free AI opportunity report

Your session lead Aamar Hussain Enterprise AI, data and agentic systems View profile

Taking sessions