Bots with real jobs. People who know what those jobs are. A smaller crew keeping an eye on the work.
Here is how I picture agentic AI becoming useful in the everyday running of an organization. We have bots with actual jobs to do, people who know what those jobs are, and a smaller human crew keeping an eye on how the work is going. A bot might help with threat hunting, detection engineering, service desk requests, or a repeatable business process. Much of the execution could move to the bots, while people spend more of their time supervising, handling exceptions, and making the decisions that still need their judgment.
For selected processes that are well understood and have dependable information to work with, I think it is worth aiming to automate 80 to 90 percent of the task work currently done by people. That is a target to test, not a result I am claiming we can deliver everywhere. We would have to measure it against the human effort those processes take today, including the checking and cleanup afterward. It could support a smaller team, but automating that share of the work does not automatically translate into the same percentage reduction in people.
Take a threat hunting bot as an example. It could gather approved security data, run the searches we have agreed on, and bring together evidence that deserves attention. A detection engineering bot could draft an alert rule and test it against examples before a person approves its release. Those are proposed jobs with recognizable results. The bot gets useful work done, and the person can spend time looking at the meaning of what was found rather than assembling every piece by hand.
The same thinking fits a service desk or a business office. Picture a bot collecting the information missing from a request, following an approved resolution procedure, or preparing a routine reconciliation for review. An agent can choose its next step and use tools to carry the work forward, while ordinary automation can handle the steps that follow a fixed path. We can use both. There is no prize for making a straightforward task more complicated than it needs to be.
Before anybody turns one of these bots loose, the company needs to decide where its job begins and ends. What information may it use? Which changes may it make? When does someone need to approve the next step? Those answers belong to the organization running the process. A vendor’s default settings can give us a place to start, but our people still have to decide whether those settings fit our business. The bot should have a named owner and a clear place to take work that falls outside its assignment.
We also need those decisions to show up in the tools. Give each bot its own identity and only the access its job requires. Have the system receiving an action check the permission before making the change. Put limits on volume and spending, and keep a tested way to remove access or stop execution. A written instruction to behave is useful, but the bot should not be able to talk its way around a rule the company has put in place.
The first assignment should give the team a fair chance to learn. Let the bot recommend actions before changing production systems. Try incomplete requests, misleading instructions, and situations where stopping is the right answer. Move into limited execution with work that has little impact, uses no sensitive information, and can be reversed. Broader authority should follow evidence from the actual workflow, including what happens when a tool fails or the request does not look like the examples used to build it.
When we review that evidence, the people doing the work need a voice. Count the time saved, the mistakes, the rework, and the time spent watching the bots. Include the human effort supplied by a service provider, too. Moving work outside the company does not make that effort disappear. The useful question is whether we have built a dependable way to get the work done with less total human effort, while keeping the quality and protection the business needs.
That is an ambition worth working toward. We can give bots meaningful responsibility without asking the people around them to trust a demonstration and hope for the best. The next conversation is about that smaller crew, the infrastructure it needs, and what it means to supervise a group of bots through an ordinary working shift.
Sources
- OWASP LLM06:2025 Excessive Agency: Background on limiting agent tools, permissions, and autonomy. The automation percentage in this post is a proposed ambition, not a finding from this source.
- ASD’s ACSC, Agentic AI harnesses: The layer above the model (September 2026): Why controls belong in the tools and surrounding systems, as well as in instructions to the model.
