Yes, when it is scoped properly — and the scoping is the entire answer. The risk in an AI agent has almost nothing to do with how capable the model is and almost everything to do with what it is permitted to do, what happens when it is uncertain, and whether anyone can see afterwards what it did.
A cautious agent with narrow permissions is safer than a brilliant one with the run of your systems. That is not a compromise; it is how these are supposed to be built.
The four questions worth asking any vendor
- What exactly is it allowed to do, stated as a list? If the answer is vague, the scope is vague.
- What does it do when it is not sure? "Escalates to a person" is the right answer. "It figures it out" is not.
- What can it never do without a human approving first? There should be a firm list, and money should be on it.
- Can we see what it did? Every action logged, attributable, reviewable after the fact.
A vendor who cannot answer those crisply has not thought about it, which is itself the answer.
The real risks, in order
The big one is confident wrongness. A model that does not know something will often produce a plausible answer rather than stopping. Told to a customer as fact, that is worse than silence. The mitigation is not a better model, it is an explicit rule for uncertainty and a narrow enough scope that it rarely arises.
The quiet one is doing the right thing to the wrong record. An agent that books, updates or cancels against the wrong job is not hallucinating — it is acting correctly on a bad match. This is why the identification step deserves as much care as the action step.
The one nobody plans for is scope creep after launch. The system works, people trust it, and someone widens what it handles without revisiting the rules. The permissions should be reviewed on purpose, not extended casually.
Data, plainly
Your data stays in systems you own. An automation moving information between your tools is moving your data between your accounts. What is worth asking about specifically is what leaves that circle — which model provider is involved, what is sent to it, what is retained, and for how long. That is a question with a factual answer, and you should get one.
Anything with a legal, financial or safety consequence keeps a person in the loop. That is not timidity — it is the line that makes everything on the other side of it safe to automate.
How to deploy one without taking a risk
Start with one job that has a clear finish line and a cheap failure mode. Run it alongside the existing process for a few weeks so you can compare rather than trust. Read what it actually did on the odd cases, not the ordinary ones. Widen only when you have watched it handle something unexpected sensibly.
Done that way the question stops being "is this safe" in the abstract and becomes "did this behave" about something you can observe — which is a question you can actually answer.
What agents are good and bad at, concretely: What can an AI agent actually do?
The limits we build in, and where we stop: AI agent development