7 things to check before adopting AI agents for business

Give an AI agent a goal, and it works out the steps itself and gets the job done by operating a browser and your company’s systems. Trying one is now easy. The hard part comes next: can it keep working correctly every day at a set time, with nobody watching, in systems that need a login? That is where many adoptions stall.

Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, due to escalating costs, unclear business value, or inadequate risk controls. It notes that most projects today are early experiments or proofs of concept, in which the real cost and complexity of deploying at scale are hard to see, and that this keeps them from reaching production.

This article covers seven things to check before putting AI agents into daily business work, how to split the work among AI agents, RPA, and people, and how to roll out.

What an AI agent is

Japan’s AI Guidelines for Business, from the Ministry of Economy, Trade and Industry and the Ministry of Internal Affairs and Communications, added a definition in version 1.2 (March 2026): an AI agent is an AI system that perceives its environment and acts autonomously to achieve specific goals. This includes systems with only some degree of autonomy, not just highly autonomous ones.

Here is how AI agents differ from the two tools they are most often compared with in business automation: generative AI chat and RPA.

Aspect	Generative AI chat	AI agent	RPA
What it does	Answers questions and writes text	Works out steps toward a goal and operates browsers and systems	Repeats recorded operations exactly
Who operates	A person, who acts on the AI’s answer	The AI, which decides the next operation on every run	A robot, following steps a person built
Good at	Drafts, summaries, research	Work that differs every time, work that involves judgment	Repeating the same steps in volume
Weak at	Work that means looking at and using your systems	Producing the same result every time, getting through volume quickly	Screen changes, situations that need judgment

RPA problems also compares RPA, AI agents, and AI RPA.

Work AI agents suit, and work they don’t

Gartner, too, advises starting to use AI agents where decisions are needed.

Work that suits AI agents:

• Research that differs every time (checking public information on business partners, researching prospects)
• Reading and sorting documents that come in many formats (invoices, purchase orders, inquiry emails)
• First-pass judgment on exceptions, and drafting replies and reports
• Work done with a person nearby who can check the result on the spot

Work that causes trouble if handed over as is:

• Processing large volumes the same way every day
• Work that must be finished by a deadline (month-end billing, checking timesheets before payroll)
• Registering, sending, or paying, where a mistake goes straight outside the company

In real work, both kinds are mixed in one flow. Instead of handing a whole process to an AI agent, deciding who does each step makes failure much less likely. AI agents vs RPA: when to use which, step by step covers the criteria for splitting, with invoice processing as the example.

Seven things to check before you start

1. Can it process the work the same way every time?

An AI agent reads the screen and documents on every run and decides its next operation. The same instruction does not always lead to the same steps and the same result. The AI Guidelines for Business also point out that, because models are probabilistic, AI can reach different judgments in different situations even when run under the same criteria. Because it thinks every time, each item also costs time and AI usage fees.

What to check:

• How many items, and how many runs, per day? Can that volume be done by the deadline?
• Try the same input several times. Do the results match?
• Can you check the results outside the AI (item counts, totals, matching against the source data)?

2. Who checks before anything is registered or sent?

An AI agent that operates a browser can do much of what a person can do in one. The AI Guidelines for Business warn that an AI agent may, while acting autonomously, place orders or delete files that nobody intended. They add that users of AI can prevent unexpected accidents by keeping human judgment in the loop.

What to check:

• Which operations are hard to undo (registering, sending, paying, deleting)?
• Who approves before them, and what do they look at? What happens when the approver is away?
• Is it recorded when, by whom, and how each decision was made?

3. How do you hand over logins and passwords?

Asking an AI agent to do work that needs a login usually means either telling it the password in the conversation or handing it a browser that is already signed in. A password told in conversation is sent to the AI provider and stays in the conversation history. A signed-in browser puts every service signed in there within the AI’s reach. OpenAI also advises using a browser agent signed out when the task doesn’t need your logged-in sites.

What to check:

• Can passwords be entered without showing them to the AI?
• Is the browser the AI operates separate from the one signed in to your everyday email and admin consoles?
• Can you limit the sites it can open, and the permissions of the accounts it uses, to what the work needs?

4. Could what it reads contain instructions?

The emails, web pages, and attachments an AI agent reads may contain instructions aimed at the AI. An attack in which the AI mistakes them for its user’s instructions and follows them is called prompt injection. OWASP lists it first in its top risks for applications that use LLMs.

OpenAI has published an attack that its own testing found and that it then fixed: an agent asked to draft an out-of-office reply followed instructions hidden in an email in the inbox, and sent a resignation letter to the user’s CEO instead. It goes on to say that prompt injection, like scams and social engineering on the web, is unlikely ever to be fully solved. The AI Guidelines for Business likewise warn that an attack could manipulate an agent’s behavior and send internal data outside without anyone intending it.

The mitigations OWASP lists include restricting the AI’s privileges to the minimum necessary and requiring human approval before high-risk actions.

What to check:

• Does the agent read text written by people outside the company (emails, web pages, files from business partners)?
• If so, does that agent also hold strong permissions, such as sending, paying, or running commands?
• Is there a human approval before operations that are hard to undo (see 2)?

5. What information goes where?

An AI agent that uses a cloud AI model sends what it reads on screens and in documents to the model provider. The AI Guidelines for Business ask users of AI to take care not to enter personal or confidential information inappropriately.

What to check:

• Do the screens and documents the agent reads contain personal or confidential information?
• Does the model provider use what you send for training, and how long does it keep it? (Check the contract and terms.)
• Can you switch just the parts that handle personal information to an in-house or local model?

Security summarizes how the main AI model providers handle your data.

6. Can you check afterward what it did?

When a wrong entry turns up, you can’t find the cause or prevent a repeat unless you know which screen the AI agent was on, what it entered, and who approved it. The AI Guidelines for Business say that, to keep AI decisions verifiable, inputs, outputs, and other logs should be recorded and kept, with how and how long to keep them considered in light of investigating accidents and preventing recurrence.

What to check:

• Does each run keep the screens operated, the values entered, and what was sent to the AI?
• Is the history of approvals and send-backs kept?
• Can you pull the records out for an audit or an internal review?

To keep the whole picture in view, list all running automation the way an RPA robot ledger does. See How to build a robot ledger for RPA, with a template.

7. When it stops, who notices and who fixes it?

AI agents stop too: the login screen changed, extra authentication was required, the other site was down. The AI Guidelines for Business note that complex AI systems such as AI agents can be harder to maintain and troubleshoot than ordinary AI systems.

What to check:

• When it fails, who is told, and how?
• What happens to the items already processed? Can it resume from where it stopped?
• If the person who built it moves on, can someone else understand and fix it?

For automation whose builder is gone, see Taking over an RPA bot whose builder has left.

How to roll out

1. Choose one process: start with one that runs daily or weekly, has volume, and involves a little judgment. Also check that the terms of use of the websites it operates allow automated access (Check the terms before you automate a website)
2. Decide who does each step: split it among AI, fixed steps, and people, and put an approval before operations that are hard to undo. Split this way, most of the seven checks are answered at the design stage
3. Set success criteria before you try: put them in numbers, such as “over 90% of items processed with no human correction” and “zero wrong entries”. Also measure how many items people checked, and how long that took
4. Settle operations before production: decide who is notified, who approves and who stands in for them, who responds when it stops, and how long records are kept
5. Expand from the first result: apply the split that worked to similar processes

How agents fall out of use after launch, and how to prevent it, is covered in AI agent failures: 5 reasons agents fall out of use. To move off the RPA you use now, see RPA migration steps.

Building it with Kitewell

Descarty’s Kitewell is AI RPA that AI builds and AI fixes. It answers the seven checks this way:

• The same way every time: clicks and entries that worked are remembered and repeated the same way on later runs. AI relearns only when a screen changes, and the run’s record shows what it relearned
• People approve: approval can be set on any step. The approver approves, sends back, or rejects, and when and how they decided is recorded. A workflow the AI builds is not saved until you review the diff and choose Apply
• Passwords stay out of AI’s hands: passwords are referenced by name, their values are never shown to the AI, and Kitewell types them in. The browser the AI operates is a workflow browser, separate from your everyday one, and you can limit the sites it opens
• Guarding against hidden instructions: when a workflow passes an email’s text to an AI agent that can run commands, the check before running warns you
• Choosing where data goes: you choose the AI model per step, including in-house and local models. Small local models, however, usually cannot operate a screen. Prompts sent to models are kept in the run history
• Everything recorded: each run keeps step-by-step logs, output files, and screenshots. You can also export a robot ledger to Excel
• Alerts, and resuming where it stopped: failures and pending approvals are sent to Slack, Microsoft Teams, email, and more. After a fix, the run resumes from the failed step

Fifteen AI agents, including Claude Code and Codex, also run as steps in a workflow. You can hand the steps that need judgment to an AI agent and have a person check the result before the next step. Send the work back and the agent tries again with your comments. With ChatGPT or Claude connected, you can approve or send back even from your phone.

You can start by choosing one manual process or one robot that keeps stopping, and verifying it with us as an early access partner. See Early access partners for details.

Summary

• AI agents are strong at work that needs judgment, but weak at producing the same result every time and at running unattended without fail
• Before you start, check seven things: repeatability, approvals, passwords, hidden instructions, where data goes, records, and what happens when it stops
• Don’t hand over a whole process. Decide step by step what AI, fixed steps, and people each do
• Try one process against success criteria you set in advance, settle how it will be run, then expand

Sources

• Gartner: Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027 (June 25, 2025)
• Ministry of Economy, Trade and Industry and Ministry of Internal Affairs and Communications: AI Guidelines for Business, version 1.2 (March 31, 2026; in Japanese, with a tentative English translation). The definition of AI agents is in Part 1 of the main text, logging in Part 2, what users of AI should do in Part 5, and the risks of AI agents in Appendix 1
• OpenAI: Continuously hardening ChatGPT Atlas against prompt injection attacks (December 22, 2025)
• OWASP: LLM01:2025 Prompt Injection