AI agents in operations: what may an agent do on its own?

What is an AI agent, in plain terms?

A chatbot gives an answer. An AI agent does something. It reads an email, looks up the customer in your ERP, checks stock, creates a document and prepares a message. So it carries out a series of steps in your systems, rather than returning a single piece of text.

The difference from classic automation (RPA) is a matter of freedom. An RPA robot follows a fixed script. An agent determines its own steps. Microsoft writes of its order processing agent that the steps are not fixed: AI determines them based on the context, and the agent tries to resolve validation errors itself. That makes an agent flexible. It also makes it less predictable than a script.

The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) sums up the risk briefly in its Rapportage AI & Algoritmes Nederland (AI and Algorithms Report Netherlands) of March 2026. Unlike a language model, an AI agent can carry out actions independently without human intervention, and it can make mistakes in doing so. The AP also notes that companies already advertise their own AI agents, while the question often remains whether the product really is an agent or existing technology such as a chatbot. So first ask a vendor what the system actually does itself.

Which AI agents really exist today?

Four examples from well-known business software. We mention them for their design choices, not as a recommendation.

• Financial Agent from Exact, presented on 3 September 2026. It analyses the balance sheet and the profit and loss account using more than sixty financial KPIs, such as liquidity, solvency and profitability. It flags trends, risks and opportunities, helps explain why something is happening and shows which actions the user can consider. The design is advisory: Exact calls the agent a partner in decision-making.
• Sales Order Agent in Microsoft Dynamics 365 Business Central. It monitors a designated mailbox, looks up the customer, checks availability and draws up a quote or order. All outgoing messages first go to a designated employee, who reviews and approves them.
• Payables Agent in the same software. It reads PDF purchase invoices from a mailbox, creates a draft purchase invoice and submits it to an employee for review. The agent does not post the invoice itself.
• Copilot Cowork in Microsoft 365, generally available since 16 June 2026. According to Microsoft, it carries out complex, long-running tasks with multiple tools and delivers a finished result, not just a draft or a recommendation. It is off by default. Administrators decide whether it is switched on and for whom, and can set spending limits.

Four autonomy levels: what an agent may do for each task

Put those examples side by side and you see that the vendors themselves already choose how much their agent may do. One advises, another prepares, a third executes. Autonomy is therefore not a property of the model, but a choice. In a 2025 paper, researchers Feng, McDonald and Zhang argue that an agent's level of autonomy can be treated as a deliberate design decision, separate from what the agent is capable of. With Microsoft's order agent, that is literally a setting: you have the customer confirm a quote first, or you let the agent create an order directly without the customer seeing the quote.

In this piece we use four levels. You choose them per task, not per system.

• 1. Proposing. The agent analyses and advises, but changes nothing in your systems. The human carries out every action.
• 2. Preparing. The agent creates a draft that has no consequences yet: a draft order, a draft purchase invoice, a proposal for a new loading slot. A human reviews it and passes it on. Here Microsoft deliberately chooses a quote as the first step, because a quote has no effect on planning, reservations, availability calculations or cash flow forecasts.
• 3. Executing after approval. The agent carries out the action itself, but only after an authorised employee has given approval for that specific case. Examples are sending an order confirmation or putting a rebooking through.
• 4. Executing independently. The agent acts without case-by-case approval, within fixed limits, and you see afterwards what it did. This suits only actions that are reversible, that fall within clear rules and where an error stays small and visible.

Applied to order intake, customer service and planning

The examples below are illustrative, not client stories. They show that the same framework gives a different answer for each task.

• Order intake from email or PDF, for example at a fresh produce wholesaler (AGF: potatoes, vegetables and fruit) or a food producer. Start at level 2. The agent reads the order, matches customer and items and prepares a draft order. An order handler checks the discrepancies: unknown item codes, unusual quantities or prices, a delivery date that cannot be met. The confirmation is sent at level 3. We described how extracting fields from documents works, and where it goes wrong, in our piece on document extraction for CMR, T1 and eCMR.
• Status questions in a haulier's customer service. An answer to the question of where a shipment is, with the status and the expected time of arrival from your TMS, can be given at level 4. The condition is that the customer knows they are communicating with AI and can always get through to an employee. As soon as the answer promises a new delivery time, handles a claim or offers compensation, it goes back to level 3 or lower.
• Rebooking a missed loading slot or a delayed trip. Level 2. The agent looks for a new slot and prepares a proposal. The planner decides, because the planner knows what is not in the system: what was agreed with a customer that morning, which driver still has room, which refrigerated capacity is really free.
• Checking a purchase invoice against the order and the goods receipt. Level 2. The agent creates a draft and flags differences. An employee posts it, and the agent does not make payments. By default, Microsoft sets a supplier that the agent creates itself to blocked, because suppliers and their bank accounts are generally only approved after human contact with the supplier. The agent does not approve suppliers itself.
• Release of a batch, a deviation at a CCP or a question about allergens. Level 1. The agent may collect data, summarise it and make a proposal. The person responsible for HACCP decides and signs. Why that is so, and how to set it up so that you can demonstrate it within FSSC 22000, BRC and IFS, is explained in our piece on HACCP and AI.

What always stays with a human, and why

We keep four kinds of action outside level 4, however well the agent performs. The reason is the same each time: an error there is not small, not immediately visible or not reversible. The AP also points out that autonomy makes it important to think in advance about responsibility and liability for an agent's actions.

• Money. Payments, credit notes, price agreements and new bank accounts. As an example of an agent error with far-reaching consequences, the AP mentions transferring money to the wrong recipient.
• Food safety. Release, decisions at a CCP, allergen information and recalls. In an audit you must be able to show who decided and on what basis.
• Commitments to customers that go beyond the standard. A different delivery time, compensation, non-standard terms. What the agent promises, your company has promised in the customer's eyes.
• Decisions about people. Who gets which shift, or who gets which task based on their performance. Article 22 GDPR already applies here today: a data subject has the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them. In that case a signature alone is not enough, as we set out in our piece on meaningful human intervention.

What 2026 showed about the limits of agents

The makers themselves are also struggling with those limits. At the end of September 2026, OpenAI abandoned the launch of its GPT-6.1 Astra model. According to Al Jazeera, Saachi Jain, head of safety systems at OpenAI, said that the model did not meet the requirements on scope and authorisation, and on the way it reports back to the user what work it has done.

Those are precisely the two questions in this piece. Does the agent stay within the task you gave it, and can you see what it did? The first point is also a security question. On 7 September 2026, the UK National Cyber Security Centre wrote that an attacker who exploits a vulnerability can gain access to the same data, services and permissions that the agent legitimately has access to. Every permission an agent does not need is therefore a risk without a return. How this relates to the duty of care in the Cyberbeveiligingswet (Dutch Cybersecurity Act) is explained in our piece on AI tools, shadow IT and your duty of care.

Five checks for every agent

Whether you buy an agent or have one built, these five points go with it. They are in line with the AP's view. The AP considers it important to weigh up at the design stage what an agent is given access to and which actions it can carry out. As good practice, the AP mentions limiting an agent to one specific task, because control and monitoring then become simpler.

• One task. An agent for order intake does not answer complaints or post invoices.
• Minimal permissions. The agents in Business Central work within the permissions and the profile that an administrator assigns. Set those permissions to what the task requires, not to what is switched on by default.
• Fixed approval points. Record the autonomy level for each step in the work instruction, and with it who gives approval.
• Visibility. You must be able to review the agent's steps, and to see which data the agent filled in and which data the business logic of your own system created. Microsoft offers that with its order agent. Ask every other vendor about it.
• A stop button and an owner. A named person is responsible for the agent and can switch it off. Pausing is not stopping: if the credits for Microsoft's order agent run out, it waits, and as soon as credits are available again it automatically processes all the emails that have piled up. Microsoft advises switching the agent off when you do not need it.

What questions should you ask your vendor?

A demo shows what an agent does when everything goes well. For your decision, what counts is what happens when things go wrong.

• Which data and which actions does the agent have access to, and can we restrict that for each task?
• What is recorded at each step, and can we see which fields the agent has filled in?
• What does the agent do when in doubt: does it stop and call in an employee, or does it carry on?
• Where is our data processed?
• How is usage billed, and what does that cost per processed order or invoice in a trial with our own data?

What does the AI Act ask for when you use an agent?

As a rule, an agent is an AI system within the meaning of the AI Act. The definition in Article 3 refers to a machine-based system that is designed to operate with varying levels of autonomy. For most agents in order intake, customer service and goods planning, four points follow from that, and no heavy new obligations.

• Transparency. The Article 50 transparency obligations have applied since 2 August 2026. Paragraph 1 places the obligation on the provider to design a system that communicates directly with people in such a way that those people know they are dealing with AI, unless that is obvious. If an agent answers customer questions independently, check that this notice is built in and switched on.
• Human oversight. Article 14 is legally binding only for high-risk systems, and an agent for order intake is not one. Even so, it is a good test for your own set-up. The article asks that the people exercising oversight remain aware of the tendency to rely automatically on the output, that they can disregard, override or reverse the output, and that they can interrupt the system with a stop button or a similar procedure.
• The tipping point: decisions about people. If an agent allocates tasks based on individual behaviour or personal characteristics, or evaluates performance, it falls under point 4(b) of Annex III and is high-risk. As a result of the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, the requirements for those systems apply from 2 December 2027. Article 22 GDPR already applies today.
• AI literacy. Article 4 has applied since 2 February 2025. Since 27 July 2026 it has asked you to take measures to support the development of AI literacy among your staff. According to the European Commission, the Regulation does not prescribe a specific or 'sufficient' level for this. For an agent, the practical question is simple: does the employee who gives approval know what the agent can and cannot do, and when to intervene?

How do you start with one process?

Start with the process, not with the agent. Five steps are enough.

• Choose one process with volume and clear rules, for example order intake by email. Do not choose the process with the most exceptions.
• Measure the current situation: how many orders per week, how much time per order, how many errors, and who does which check. Without that baseline measurement, no savings claim can be verified afterwards.
• Write out the work instruction, step by step, and note next to each step the autonomy level and who gives approval. Do that in the language of your own standard, whether that is HACCP, FSSC 22000, BRC, IFS, GMP+ or the GlobalG.A.P. standard. The agent then becomes part of your quality system and not a standalone experiment.
• Start at level 2 and track how often an employee corrects the draft, and why. If that number stays at zero for months, find out whether anyone is still really checking.
• Train the people who give approval. Only then go up a level, per step and not per process.

The human decides and signs, even alongside an agent

At AIBA, our starting point is that the human decides and signs. An agent does not change that. It only shifts the question to the step at which the human signs.

Our free Practice Scan helps you choose that first process and sharpen the baseline measurement. After that, you know for each step what an agent may prepare and where the human decides.