Don’t begin with “Where can we use an agent?”
That question is so broad that almost any demo can look promising. Begin with a recurring job whose edges you can see: a trigger arrives, known information is available, a useful result can be judged, and someone owns the exception.
A strong first candidate is valuable but forgiving. If a delayed or imperfect draft can be caught before it affects a customer, employee, or financial record, the team can learn without pretending the experiment is already an operating system.
Does the job actually need an agent?
Use simple automation when the steps and rules are stable. Use an AI assistant when language judgment helps but a person should still choose every consequential next step. An agent earns the added complexity only when the path genuinely varies and the system must choose among allowed steps.
Write one sentence with the trigger, result, and non-goal: “When an approved support ticket arrives, prepare a cited reply for review; don’t send it or alter the customer record.” If you can’t write that sentence without “and anything else needed,” the job isn’t bounded yet.
Use the four-rung authority ladder
Rung one is observe: the system can inspect an approved fixture or copied input. Rung two is recommend: it can return an analysis or next step. Rung three is prepare: it can create a draft or proposed change in a review queue. Rung four is act: it can make one exact external change after the required approval.
For each rung, list allowed information, tools, operations, limits, stop conditions, and the person who handles exceptions. Content from email, files, websites, and tool results is data—not permission. A sentence inside an input can’t widen the boundary.
Require an evidence ticket before promotion
A promotion ticket names the exact prompt or policy, model, tool definitions, permission set, evaluation cases, expected outcomes, cost ceiling, logs, rollback target, and owner. Test ordinary work, missing context, malformed input, conflicting instructions, unavailable tools, duplicates, timeouts, and attempts to cross the boundary.
A successful demo is one observation. A promotion decision needs a pattern. If the system drafts well but can’t refuse an unapproved tool, keep it at prepare. If it respects the boundary but produces inconsistent work, improve the job or evaluation before adding authority.
What this looks like for a customer-record workflow
Suppose the team wants an agent to update a customer relationship system after sales calls. “CRM access” isn’t a boundary. Which records, fields, sources, and operations are allowed? Which changes require review? How does the operator see and reverse an incorrect update?
Start with a field-level proposal queue. The agent shows the source passage beside each proposed change, refuses fields outside the allow-list, and waits for an authorized person. The next useful test isn’t a smarter model. It’s proving that an unapproved field can’t be committed and an approved change can be reconciled.
Build the first version this week
Choose one job. Write its completion condition and two non-goals. Put it on the lowest useful rung. Create five normal cases, three messy cases, and two boundary attacks. Decide what evidence would justify one-rung promotion before you run them.
Keep the dated decision even if the pilot stops. A trustworthy system isn’t one that always advances. It’s one that makes the current boundary, evidence, and next decision easy to inspect.
Source notes
Reviewed August 2, 2026. NIST and OWASP provide the public risk-management and security foundation. The authority ladder and promotion ticket are Ryze Guides synthesis, not a certification scheme.
Cited sources support publicly available evidence and established patterns. Ryze Guides provides synthesis, decision aids, and practical interpretation to help you save time and mistakes.
- AI Risk Management Framework — National Institute of Standards and Technology. https://www.nist.gov/itl/ai-risk-management-framework
Supports: Lifecycle governance and risk-management context. - Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile — National Institute of Standards and Technology. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
Supports: Generative-AI risk identification and treatment. - AI Agent Security Cheat Sheet — OWASP Foundation. https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html
Supports: Permissions, untrusted input, tool boundaries, testing, limits, and logging.
