AI agents for business: what they can do, where they fail, and how to start

A message arrives at 23:40. A prospect wants a price, two possible dates and to know whether you deliver to Dammam. Nobody replies until 9:30 the next morning, and by then they have asked two of your competitors. That gap is what AI agents are sold to close.

Most companies already use AI in some form. In the Stanford AI Index 2025, 78% of organisations surveyed reported using AI in 2024, up from 55% the year before. Agents are the next step, and the word now covers everything from a FAQ widget to software that runs half a department. This guide gives a plain definition, the jobs agents do well, the four ways they fail in a business and the guardrail for each, how to choose and measure a first use case, when to build or buy, and how we applied all of it in Lina, the WhatsApp receptionist we built for dental clinics.

What is an AI agent, in plain terms?

An AI agent is software built around a large language model that works toward a goal in a loop. It reads the situation, decides the next step and uses a tool: it checks a calendar, looks up an order or updates a CRM record. Then it looks at the result and decides again, until the job is done or it hands over to a person. The tools are what turn a model that can advise you into a system that can act for you.

Anthropic's engineering guide to agents draws the line most practitioners now use. Workflows are “systems where LLMs and tools are orchestrated through predefined code paths”. Agents are “systems where LLMs dynamically direct their own processes and tool usage”. In a workflow you decide the steps in advance. In an agent, the model decides them as it goes.

Most useful systems mix the two. A fixed workflow can have one AI step in the middle, such as reading an email and pulling out the order details. An agent can be fenced inside a workflow that limits what it can touch. The same guide recommends the simplest solution that works, adding complexity only when it is needed, and notes that this sometimes means building no agent at all. If your process is predictable, start with AI automation for business processes.

Which business jobs do AI agents do well?

Agents earn their keep on work that is frequent, written in language, governed by clear rules and recorded in a system you already use. The best first jobs share one more trait: a mistake is cheap to spot and easy to undo.

• Answering and qualifying enquiries. Replying in seconds from your approved information, asking the questions a salesperson would ask (budget, timing, location) and logging the lead with a summary.
• Booking and rescheduling. Checking real availability, offering two or three slots, writing the booking into your calendar and sending the confirmation.
• Routing and triage. Reading an inbound email, ticket or message, deciding what it is and who should own it, and passing it on with a short summary.
• Document handling. Pulling fields from invoices, purchase orders or application forms, checking them against your rules and flagging the exceptions for a person.
• Follow-ups. Chasing an unanswered quote, sending reminders and checking in with customers who went quiet.
• Internal knowledge. Answering staff questions about policies, prices or procedures, with the source attached so they can check it.

The strongest field evidence so far is for AI that helps people do these jobs. In a study of 5,172 customer-support agents, access to an AI assistant that suggested replies raised the number of issues resolved per hour by 15% on average and by about 30% for less experienced and less skilled staff, with minimal gains for the most experienced. Customers were also less likely to ask to speak to a manager. The assistant suggested and people decided, which is often the safest way to start.

Full autonomy is harder. Researchers at Carnegie Mellon built TheAgentCompany, a simulated software company with realistic office tasks. The best agent they tested completed 30.3% of the tasks on its own. Administrative, finance and data-science tasks scored lowest, and the authors traced many failures to reading documents, communicating with colleagues and navigating complex software. Most people would call those tasks routine.

Length matters too. The AI Index reports that on RE-Bench, a 2024 set of open-ended machine-learning research tasks, top AI systems given a two-hour budget scored four times higher than human experts. Given 32 hours, the humans outscored them two to one. Give an agent short, well-defined tasks and keep the long, open-ended ones with your team.

What are the four ways AI agents fail, and how do you guard against each?

AI agents fail in a business in four recurring ways: hallucination, prompt injection, unclear ownership and no human hand-off. Each one has a guardrail you can design in from the first day.

1. Hallucination: confident answers that are wrong

Language models produce fluent text whether or not it is true. The OWASP Top 10 for LLM applications lists misinformation as a core risk and cites Air Canada, whose chatbot gave travellers wrong information; the airline was successfully sued. Connecting the model to your own documents, known as retrieval-augmented generation (RAG), helps without curing the problem. A preregistered Stanford study found that AI legal research tools built this way hallucinated less than general-purpose GPT-4, yet still hallucinated between 17% and 33% of the time.

Guardrail: let the agent answer only from a written, approved knowledge base that a named person keeps current. When the knowledge base does not cover a question, the agent says so and hands over. Keep prices, policies and promises in that source so the agent quotes them instead of guessing. Review a sample of conversations every week, and when you find an error, fix the source.

2. Prompt injection: instructions hidden in the input

Prompt injection is text the agent reads (a message, email or file) that contains instructions it then follows. Agents read a lot of outside text, from customer messages and emails to web pages and PDFs, and any of it can carry such instructions. OWASP puts prompt injection first in its 2025 list and separates direct attacks, typed by a user, from indirect ones hidden in content the model processes. A 2023 paper that demonstrated indirect prompt injection against real systems, including Bing's GPT-4-powered chat, named the root cause: LLM-integrated applications “blur the line between data and instructions”. OWASP adds that it is unclear whether any fool-proof prevention exists.

Guardrail: limit what a successful injection could do. Give the agent only the tools its job needs, with the narrowest permissions, and require a person's approval for anything costly or hard to reverse, such as refunds, payments, deletions or messages to many customers. Treat everything that arrives from outside as data to be checked. The approach holds up in testing. In AgentDojo, an ETH Zurich benchmark presented at NeurIPS 2024, letting GPT-4o choose only the tools a task needed, before it read any untrusted data, cut successful attacks from about half of the attacked tasks to under 10%. The authors also show its limit: it fails when the tools a task needs are enough to carry out the attack.

3. Unclear ownership: nobody decided what the agent may do

Many agent failures start as management gaps. Nobody wrote down what the agent may do on its own, which systems it can touch or who answers for its mistakes. OWASP calls the technical side excessive agency and traces it to three roots: excessive functionality, excessive permissions and excessive autonomy. Its example is an agent that only needs to read documents but is connected through a plug-in that can also modify and delete them. Agents also improvise. In TheAgentCompany, an agent that could not find the colleague it was supposed to ask renamed another user to that colleague's name as a shortcut.

Guardrail: give every agent a named owner and a one-page scope: what it does alone, what it does only with approval, and what it never does. Give it its own credentials with the minimum access, log every action it takes, and have the owner review the log and a sample of conversations each week. When the agent's job changes, update the scope first.

4. No human hand-off: the customer gets stuck

An agent that cannot pass a conversation to a person leaves the hardest cases stuck in a loop: the complaint, the urgent problem, the request it doesn't understand. Anthropic's guide builds the exit into the design, with agents that “pause for human feedback at checkpoints or when encountering blockers”. OWASP's guidance on prompt injection also calls for human approval of high-risk actions.

Guardrail: write the hand-off triggers before launch. Typical triggers are a customer asking for a person, a complaint, anything urgent, sensitive or outside the knowledge base, and any decision with money or safety attached. Pass on the full conversation and a summary so the customer never has to repeat themselves. Make sure a person picks the case up within a time you have set, and tell customers at the start that they are talking to an AI assistant.

How do you choose your first AI agent use case?

The first project decides whether your team trusts the next one. Pick a job where the agent can succeed visibly and fail cheaply.

1. List the candidates. Write down every repetitive job that is heavy on conversations or documents, with its weekly volume and the minutes each item takes. Volume times minutes is the time you could get back.
2. Score each one on four questions. Are the rules written down, or only in someone's head? Does the information the agent needs exist in a system it can read? What does a mistake cost? Can a mistake be undone?
3. Pick high volume and a low cost of error. Answering and qualifying enquiries, booking and routing usually score well. Approving payments, giving legal or medical advice, and anything that cannot be reversed make poor first jobs.
4. Write the agent's job description. List the inputs, the actions it may take, the hand-off triggers and what “done” means for one item.
5. Build a test set from real history. Collect past messages or documents, including the awkward ones, with the right answer for each. Every version of the agent must pass this set before it goes live.
6. Start with a person in the loop. Let the agent draft and a person approve. Then let it act alone on the categories where its drafts were consistently right, and widen the scope one category at a time.

For the full process, from problem statement to budget, see our guide on how to scope an AI project.

How to measure whether an AI agent is working

Measure the job as it runs today for two to four weeks before launch, so you have a baseline. Then review a short scorecard every week:

Re-run your test set after every change to the prompt, the model or the knowledge base. A change that fixes one answer can quietly break another, and the test set shows you before customers do. Anthropic's guide gives the same order of work: start with simple prompts, improve them through thorough evaluation, and add multi-step agents only when simpler solutions fall short.

Should you build an AI agent or buy one?

Buy when the job is the same in every company, such as meeting notes, drafting emails or a standard help desk. Mature products exist for these, and how you take meeting notes is unlikely to be why customers choose you.

Build, or commission a build, when at least one of these is true:

• The process itself is part of how you win customers, and a generic tool would flatten it.
• The agent must work across several of your systems (a WhatsApp number, a calendar, a CRM, an ERP) that no single product connects well.
• Language and channel matter: your customers write in Gulf Arabic or Turkish, send voice notes and expect answers on WhatsApp.
• You need control over where data is stored, which model runs the agent and what happens to the conversations if you change supplier.

Either way, ask these questions before you sign:

• Where are conversations and customer data stored, and who can read them?
• Can we export everything, and what happens if we stop paying?
• Which model runs it, and can it be changed without a rebuild?
• How does the hand-off to a person work, and how are errors reviewed and fixed?
• Who owns the knowledge base, the prompts and the integrations?

Flowramo builds the second kind. We sell systems as projects and install them on hosting you choose and own, connected to your own accounts. See what we build or tell us about the job you have in mind.

An example: the guardrails inside Lina

Lina is the AI receptionist we built for dental clinics. She runs on the clinic's WhatsApp, can also be connected to the clinic's website, answers patients day and night in their own language, from Gulf Arabic to English and Turkish, books and reschedules appointments in the clinic's calendar, and sends reminders and aftercare messages. Under the hood she is several cooperating agents with retrieval over the clinic's knowledge. Each failure mode above shaped a design decision:

• Hallucination. Lina answers only from knowledge the clinic has approved, and she does not diagnose.
• Ownership and scope. Her job is defined: conversations, bookings, reminders and follow-ups. She is installed on hosting the clinic chooses and owns and connected to the clinic's own accounts, so patient data stays on the clinic's infrastructure.
• Hand-off. Urgent, clinical and sensitive cases go to the clinic team with the full conversation, so nobody has to ask the patient to start again.
• Real-world input. Patients send voice notes and photos as well as text, so Lina transcribes voice notes before she decides what to do, and sends photos and X-rays straight to the doctor without analysing them.

We will publish results once a clinic agrees to share them. Until then, you can read how an AI receptionist works in a dental clinic or see Lina in detail.