AI Agents Are Moving From Conversation to Business Operations

For most businesses, the first encounter with generative AI was a chat window. An employee typed a question and received an answer, a summary, or a draft. The technology was useful, but it was fundamentally advisory. A person still had to take the output, judge it, and carry it into the systems where work actually happens.

That boundary is now moving. The AI industry has spent the past two years building what it calls agents: software that uses an AI model not only to generate text but to decide on and execute a sequence of actions. An agent can read an invoice, look up the matching purchase order in an ERP system, flag a discrepancy, draft an exception note, and route it to a person for approval. The model is no longer the end of the workflow. It is a participant in it.

The claims surrounding this shift are expansive, and much of the coverage repeats them uncritically. The purpose of this analysis is narrower: to establish what agent technology actually does today, where the evidence of business value is real, where it is thin, and how a management team should think about evaluation.

What Happened

Three developments converged to move agents from demonstration to deployment.

First, the major AI vendors productized the concept. Salesforce built Agentforce directly into its CRM platform, with agents that act on customer records, cases, and workflows. Microsoft added autonomous agents to its Copilot line and gave businesses a low code tool, Copilot Studio, for building their own, with human approval steps available in the workflow. Anthropic, OpenAI, and Google shipped models designed for multi step tool use rather than single responses. Enterprise software vendors from SAP to ServiceNow followed with agents embedded in their own suites.

Second, the plumbing standardized. The Model Context Protocol, an open standard introduced by Anthropic in November 2024, defines how an AI model connects to external tools and data sources. In December 2025 the protocol was donated to the Agentic AI Foundation under the Linux Foundation, and it is now supported across the major AI providers, including Anthropic, OpenAI, Google, and Microsoft. For businesses, the practical significance is that connecting an AI system to a database, a document store, or an ERP module increasingly looks like configuration rather than custom software development.

Third, adoption crossed from experiment to early production. McKinsey's most recent State of AI research found that 88 percent of organizations now use AI in at least one business function, and 62 percent are at least experimenting with AI agents. KPMG's quarterly pulse survey of leaders at large US organizations found 54 percent actively deploying AI agents in early 2026, up from 11 percent a year earlier. Gartner forecasts that 40 percent of enterprise applications will include task specific agents by the end of 2026, up from under 5 percent in 2025.

What It Actually Does

Stripped of vendor language, a business agent is a loop. The AI model receives a goal and a set of permitted tools. It reads context, decides on an action, executes it through a tool connection, observes the result, and decides on the next action, repeating until the task is complete or a rule requires a person to intervene. The tools are the important part. An agent with access to an accounts payable inbox, an ERP purchase order table, and a workflow system can perform three way matching. The same model with no tools can only talk about it.

In practice, agents deployed in businesses today concentrate in a few categories:

• Document centered work. Reading invoices, contracts, purchase orders, and correspondence, extracting the relevant data, and entering or reconciling it in business systems. This is the most mature category.
• Customer and employee service. Answering questions grounded in company data, resolving routine cases, and routing exceptions. Service deflection is where vendors report the clearest cost results.
• Research and preparation. Assembling briefings, monitoring changes, and preparing drafts that a person reviews and finishes.
• Software and IT work. Coding agents that open pull requests and IT agents that handle routine tickets, an early category because the work is digital end to end.

What agents do not reliably do is carry out long, loosely defined processes without supervision. The dominant deployment pattern in serious organizations is the supervised agent: the system performs the work, and a person approves the consequential steps, particularly anything that moves money, changes a record of consequence, or reaches a customer.

Who Should Care

The technology is most relevant to organizations with high volumes of structured, repetitive, digital work. In practical terms that means finance and accounting departments, shared services operations, customer support organizations, IT service desks, and administrative functions in any company large enough to have dedicated staff performing document processing, reconciliation, or case handling.

Company size matters less than process shape. A 50 person distributor processing thousands of invoices a month has a stronger agent use case than a 500 person professional services firm whose work is mostly judgment and relationships.

What the Business Value Looks Like

Where value is documented, it takes familiar forms: labor hours removed from routine processing, faster cycle times on tasks such as the financial close or case resolution, and error detection at a scale humans do not attempt, such as screening every transaction rather than sampling.

The honest caveat is that documented value remains the exception rather than the rule. McKinsey's research finds that while roughly two thirds of enterprises have experimented with agents, fewer than 10 percent have scaled them to the point of tangible value in any single function. ServiceNow's Enterprise AI Maturity Index similarly found a majority of enterprises reporting agentic AI use while under 10 percent showed meaningful progress on autonomous multi step workflows. Surveyed executives report real individual productivity gains that frequently fail to translate into measurable business results.

The pattern will be familiar to anyone who lived through earlier automation cycles: the technology works in the pilot, and the difficulty is everything around it, including data quality, process redesign, exception handling, and management attention.

What Implementation Involves

A realistic agent implementation has four parts, and the AI model is the smallest of them.

System access. The agent needs governed connections to the systems where the work lives: the ERP, the document store, the ticketing system. Standardized protocols have reduced this cost, but access control, authentication, and audit logging are the substance of the work.

Process definition. Agents perform well on processes that are explicitly defined, including the exceptions. Processes that exist mainly in the heads of experienced staff must be documented before they can be delegated, and this is frequently where projects stall.

Approval design. Deciding which actions the agent may take alone and which require human sign off. The sensible default is conservative: read and draft freely, act on low risk steps, and require approval for anything consequential. Approvals can be loosened later with evidence.

Measurement. Baseline the process before the agent arrives, or the value conversation afterward will be anecdotal. Cost per invoice processed, days to close, case resolution time, and exception rates are the kinds of measures that survive scrutiny.

Limitations and Risks

Four limitations deserve particular weight in any evaluation.

Reliability. AI models remain probabilistic. An agent that is highly accurate on routine cases will still produce confident errors, and in an operational setting an error is not a bad answer in a chat window but a wrong entry in a business system. This is why approval controls and reconciliation checks are design requirements rather than optional caution.

Security surface. An agent with system access is a new actor inside the business, and it can be manipulated in new ways, including through malicious instructions hidden in the documents and messages it reads. Security reviews of high profile incidents in 2026 have demonstrated that these attacks are practical rather than theoretical. Agent permissions deserve the same discipline as employee permissions, applied more strictly.

Definitional inflation. Vendors now attach the word agent to features ranging from a chatbot to genuine autonomous workflow execution. KPMG observed its own survey figures swing sharply as respondents adopted stricter definitions of what counts as an agent. A buyer should require any vendor to demonstrate, on the buyer's own process, exactly what the product does without a person in the loop.

Project mortality. Gartner has projected that a large share of agentic AI projects, potentially more than 40 percent, will be cancelled by the end of 2027 on weak return on investment and governance grounds. The forecast is contested, but the direction of the warning matches the scaling data above.

Alternatives

Agents are not the only way to automate. Conventional workflow automation and robotic process automation remain cheaper and more predictable for fully deterministic processes, and a well configured ERP module handles many matching and posting tasks without any AI. The agent case is strongest where the work requires reading unstructured documents, tolerating variation, or exercising limited judgment, which is precisely where deterministic automation has historically failed. Many organizations will sensibly combine the two, with deterministic automation carrying the standard path and agents handling the exceptions.

What This Means for Management

The transition from conversational AI to operational AI is real, and it is early. The vendor platforms exist, the connection standards have matured, and the adoption curve is steep. At the same time, the gap between experimentation and scaled value is wide and well documented, and the organizations crossing it share characteristics that have little to do with the AI itself: defined processes, clean data, conservative approval design, and honest measurement.

For most businesses the practical posture in 2026 is neither adoption at scale nor deferral. It is a bounded evaluation: one high volume process, a supervised agent, explicit approval controls, a measured baseline, and a decision date. That approach produces evidence instead of opinions, and evidence is what the next budget conversation will require. A companion framework piece, AI Agents for Business, places this technology on the three levels of business AI. For finance departments specifically, a companion analysis examines the best uses of AI agents in accounting.