Enterprise AI Agents: What Actually Works in Production

The jobs that succeed share a shape: high volume, text-heavy input that rules could never parse, and a review step that already existed in the process. Where a person was already going to look at the output, a wrong answer gets caught. That is the whole trick.

Support triage and response is the most common first deployment. Classify the ticket, pull the customer record, draft the reply, leave a human to send. Document and invoice processing turns PDFs into structured line items a clerk confirms in seconds instead of typing, covered in depth in automated invoice processing. Internal knowledge answering puts a permission-aware search layer over scattered systems. IT helpdesk resolution handles the password resets and access requests that make up most of the queue, walked through in helpdesk ticket resolution. And employee onboarding chases the forms, accounts, and checklists a coordinator would otherwise track by hand, as in automated onboarding.

These are common patterns, not guaranteed outcomes. Results vary enormously with data quality and process discipline, and any vendor quoting you a fixed percentage improvement before seeing your tickets is guessing. The honest version of the pitch is that these five jobs have the right shape, which makes them cheap places to find out whether your data is good enough.

What still does not work well: anything where a mistake is silent and permanent. Auto-approving expenses, unreviewed customer email at scale, writes to a financial ledger. Those come after months of eval data showing where the model actually fails, not before. Building custom AI agents for enterprise goes further into scoping.

Six controls come up in every security review that ends in an approval. Missing any one of them is the usual reason a pilot never becomes a deployment.

The item teams underestimate is the fifth. Traditional software fails loudly and regression suites catch it. An agent fails by producing something plausible and wrong while the run reports success, and it can start doing that without anyone on your team having changed a line. The eval harness is the only mechanism that surfaces it.

Governance for agents is mostly existing governance applied to a new kind of actor. The novel parts are narrow, and worth isolating so the rest can reuse controls you already run.

Start with an inventory. Most organizations past the pilot stage cannot list every agent running against production systems, who owns each one, and what it is permitted to touch. That inventory is the prerequisite for every other control, and it is usually the finding that stalls the first audit.

Then the classification work. Under the EU AI Act, obligations scale with risk category, and an agent making decisions about people sits in a different tier from one summarising internal documents. Regulated data brings its own constraints: HIPAA governs which models may see protected health information and under what agreements. General policy, roles, and oversight structures are covered in AI governance.

The agent-specific additions are three. Human approval gates on irreversible actions, documented rather than informal. Model-change control, since a provider deprecation can alter behaviour without a change on your side. And retention of prompts and outputs, which are now records containing whatever data the agent touched, subject to the same schedules as anything else you store.

One agent costs nothing worth discussing. Forty agents across six teams, each multi-step, each retrying on failure, is a line item with no owner and no unit. The structural problem is that token spend scales with input length and model tier rather than with headcount, so it does not behave like any other software cost your finance team already models.

Three levers do the work. Per-step routing is the largest by a distance: classification, extraction, and formatting on small models, frontier models reserved for planning and the one step carrying real judgement. The gap between tiers is roughly an order of magnitude, and a multi-step agent multiplies it by turn count.

Prompt caching is the second, and it is close to free money for agents specifically, because agent loops resend a growing conversation on every turn. Cached reads are billed at a fraction of standard input rates, so a long system prompt and a stable tool catalogue stop being charged in full on turn after turn. Details are in prompt caching.

Attribution is the third and the least glamorous. Spend tagged by agent, team, and step turns a budget conversation into a set of specific decisions rather than a blanket freeze. It also surfaces the failure pattern that quietly dominates real bills: a retry loop nobody noticed, running for a fortnight.

Applying these per project means reimplementing them per project. A gateway applies them across the fleet: Connect handles routing, failover, caching, and per-call cost telemetry for every agent on the platform. Model the arithmetic for your own volumes first with the token cost calculator.