Changes nothing
A chatbot answers
It turns a question into a reply. Bounded, useful, and it changes nothing in your systems. When it is wrong, a person notices and moves on.
01 · AI Agent Development
Agents that do the work, not just talk about it
An agent is only useful once it can reach the systems where work happens. Yours gets real tool access, a scoped identity, and behaviour you can measure.
Agents need somewhere to act. If the systems involved have no API, no database access and no export, opening that door is the first piece of work, and you will hear that before you commit to an agent.
Illustrative run · choose a request
Try an example.
Read the request
Intent: Change a delivery dateFind the context
OrderContractDelivery termsChoose a tool
Orders: updateEmail: draftCheck permission
Over its limitOutcome
Waiting for approval
Every run is recorded: the request, the sources read, the tools called, the decision and who made it.
01What it is
What this is, concretely
An agent is a model given a job, a set of tools, and a boundary. The model works out what to do next. The tools let it read a record, call an API, write a file, open a ticket. The boundary decides what it may touch, what it must confirm, and what it can never do alone.
Almost all of the engineering is in the second and third part. Choosing a model is a weekend decision. Getting an agent to read the right data, act through the right interface, refuse the right requests, and hand back to a person at the right moment is the work, and it is the difference between something load-bearing and something quietly abandoned.
02What it is not
An agent is not a chatbot, and the difference is not the interface.
What separates them is what the system may change when nobody is watching.
Changes only the scripted path
A script executes
It follows a path someone wrote in advance. Dependable while the world matches the path, and a maintenance problem from the day it stops matching.
Changes what its permissions allow
An agent decides, then acts
It is given a goal, a set of tools and a boundary. It works out the order, calls the tools, and either finishes the work or hands it back with its reasoning attached.
Agentic AI is the industry's name for the third column: a system choosing what to do next rather than following a route someone drew. If what you need is software a team uses every day with a model helping at the slow steps, that is a custom application rather than an agent, and the two compose.
Guardrails written into a prompt are advice. Guardrails built into the tool surface and the permission boundary are enforcement.
03Where it fits
The work an agent is genuinely good at.
Repetitive, but not simple
Triage, classification, reconciliation, first-pass research. Too variable for a rules engine, too frequent to keep doing by hand.
Stranded between two systems
Someone reads one screen and retypes into another. An agent with access to both removes the copying and the transcription errors that come with it.
Arriving faster than people can absorb
Requests, documents and tickets growing faster than headcount. The predictable share gets handled, the rest escalates with its reasoning attached.
04Permissions
What it may touch is decided before it runs.
Read, prepare or commit, system by system. Where it stops, a person takes over.
Tool permissions · one agent
Illustrative policy · select any cell
| System | Read | Prepare | Commit |
|---|---|---|---|
| Orders | |||
| Documents | |||
| Payments |
05Approach
How we build one that survives contact with production.
01
Tools before prompts
The tool surface is defined first: what can be read, what can be changed, what must be asked about. A tool the agent cannot misuse beats an instruction telling it not to.
02
Permissions it inherits
Agents act with a scoped identity, never a shared admin key. Access is granted per tool and per record set, so the blast radius of a bad decision is bounded by design.
03
Evaluations from real cases
The evaluation set comes from your actual inputs, awkward ones included. Without it, 'the new model seems better' is a feeling rather than a result.
04
A run record you can read
Each run stores its inputs, the tools called, the arguments, the results, and the final action. Why it did that has an answer, not a reconstruction.
06Examples
Systems of this shape
Build patterns and capabilities, not client projects.
Pattern 01
Internal research agent
Searches internal documents and approved sources, and cites the exact passage. Says it does not know rather than filling the gap.
Pattern 02
Document-processing agent
Reads incoming contracts, invoices or forms, extracts the fields, validates them against your rules, and routes anything ambiguous to a person.
Pattern 03
Operations workflow agent
Watches a queue, gathers the context a person would gather, then acts inside its permissions or presents the step for approval.
Pattern 04
Orchestrated agent group
Narrow agents under a supervisor that decides which to call, keeps a shared record, and holds the budget and stop conditions.
07In production
Running it responsibly
Agents need somewhere to act. If the systems involved have no API, no database access and no export, opening that door is the first piece of work, and you will hear that before you commit to an agent.
It can be turned off
Kill switches per tool and per agent, plus a documented manual fallback for the work it took over.
It knows when to stop
Budgets on steps, tokens, spend and wall-clock time, with hard stop conditions on the actions that matter.
It escalates well
When it hands work back it hands back the context too: what it tried, what it found, what it was unsure about.
It is measured after launch
Success rate, escalation rate, cost per task and latency tracked from day one, so drift shows up as a number rather than a complaint.
The day it goes live is the day the clock starts.
- 01
It is deployed, not handed over
Into your environment through a pipeline, with staging, rollback, budgets and kill switches already in place. A repository and a set of instructions is not a deployment.
- 02
It acts under its own identity
Credentials scoped per tool and per record set, never a shared administrator key. The blast radius of a bad decision is settled at design time rather than discovered during an incident.
- 03
It is watched by the numbers that move first
Success rate against the evaluation suite, escalation rate, tool errors, latency and cost per task. Uptime tells you it responded, not that it responded correctly.
- 04
It survives the model changing underneath it
Providers retire and revise models on their own schedule. The evaluation suite is what turns that from an emergency into a planned migration with a measured before and after.
Keeping it correct is a piece of work in its own right, and it can be yours or ours. Here is what operating one actually involves.
08Where and next
Where we do this work
Most of this work runs for businesses in the UAE and Saudi Arabia. We also take on selected projects in the United States and Europe, where the systems an agent has to reach usually look much the same.
Start a projectThe other two lines
- 02Custom AI ApplicationsProduction software where AI is a working part of the product, not a chat box bolted on the side.Explore
- 03Managed AI SupportEngineering operations for AI already in production: evaluation, monitoring, and the change that keeps it correct.Explore
Is there a queue someone works through every morning?
That is usually where the first agent goes. Bring the queue, the systems it touches and the exceptions everyone knows about, and we will tell you whether an agent belongs in it.