AI Agents at Work: What They Do Reliably, Where They Fail and the Controls They Need
An AI agent is an AI system that takes actions towards a goal — searching, reading, filling forms, writing into your systems — without a person approving every step. Today agents reliably handle short, well-defined tasks whose results can be checked, using a small set of tools. They become less reliable as tasks get longer and more ambiguous, need judgement, or touch messy real-world systems.
So the practical rule is to give agents narrow jobs, put a person’s approval in front of every step that commits the business to something, and log everything they do. Expand their autonomy only when the evidence from your own use supports it.
If you are still deciding between a chatbot that answers and an agent that acts, start with AI chatbots vs AI agents. This article is about what happens once you have chosen to let AI act.
The short answer
- Agents are good at bounded, checkable work: gathering and summarising information, moving data between systems with validation, drafting within templates, sorting and routing.
- Reliability falls as tasks lengthen. Research measuring agents on software tasks expresses capability as the task length at which they succeed half the time.
- The International AI Safety Report 2026 warns that agents “pose heightened risks because they act autonomously, making it harder for humans to intervene before failures cause harm.”
- Decide the level of autonomy before deployment. For most mid-sized businesses, “act with approval at consequential steps” is the right starting point.
- Every agent needs scoped permissions, approval gates, spending and time limits, logs, a way to undo, and a named human owner.
What the evidence says about reliability
The research organisation METR has published widely cited work on measuring what agents can do. It measures a model’s time horizon: the length of task, judged by how long a skilled person takes, that the model completes successfully with a given probability. In March 2025 it reported that the 50% time horizon of leading agents had been doubling roughly every seven months for six years, on multi-step software and reasoning tasks. METR notes that later updates revised the numbers and that the results depend on its task set.
Two points from that work matter more to a business than the headline trend.
“50% reliability” means half the attempts fail at that length. A model whose time horizon is two hours fails about half the time on two-hour tasks. It succeeds much more often on shorter ones. For business use you care about tasks well inside the horizon, where reliability is high, not at its edge.
These are software tasks, measured carefully. Real business work is often messier: ambiguous instructions, missing data, interfaces that change, exceptions nobody wrote down. METR reports that similar trends hold when it narrows the analysis to “messier” tasks, albeit more noisily. Your own tasks are the only reliable test.
The International AI Safety Report 2026 adds two cautions:
- Agents “pose heightened risks because they act autonomously, making it harder for humans to intervene before failures cause harm.”
- “It has become more common for models to distinguish between test settings and real-world deployment.” A good result in a trial is evidence, not a guarantee.
Where agents work well today
Five patterns share three properties: the output can be checked, the tools are few and well-defined, and mistakes can be caught and reversed.
1. Research and summary with sources. “Find the last three years of tender notices for this category, summarise the requirements, and link each source.” The agent saves hours of searching. A person checks the links before relying on any of it.
2. Moving data between systems, with validation. Reading an emailed purchase order, matching it to customer and product records, and creating a draft order in the ERP for approval. The value is the removed retyping. The safety is in the validation rules and the draft status.
3. Drafting inside a template. A quotation, a standard letter or a weekly report produced from structured data and an approved template. The template constrains the agent, and the reviewer knows exactly what to check.
4. Triage and routing. Reading incoming emails or tickets, classifying them, extracting key fields, and sending them to the right person with a suggested reply. Errors are visible and cheap, because a person handles the case next.
5. Monitoring and alerting. Watching inventory levels, overdue invoices or failed payments, and raising a summary each morning. The agent observes and reports. People act.
Where they still fail
- Long chains without checkpoints. Each step has some chance of going wrong, and errors compound. A twenty-step process run end to end without review will eventually go wrong in a way nobody sees until later.
- Ambiguous goals. “Clean up our customer list” can mean many things. An agent will pick one, confidently.
- Judgement and exceptions. Whether to extend credit to a long-standing customer who is late this month is a business decision. Agents apply rules; they do not carry responsibility.
- Unfamiliar or changing interfaces. Agents that operate websites or screens can break when a layout changes, sometimes without noticing.
- Silent errors. The most dangerous failures look like success: a total that is slightly wrong, a record updated in the wrong customer’s file.
- Manipulated inputs. An agent that reads emails or web pages can meet text designed to redirect it. The OWASP Top 10 for LLM applications lists this as its first risk, prompt injection. It also lists “excessive agency” — giving an agent more power than its job needs.
Decide the level of autonomy before you deploy
| Level | What the agent does | Suits |
|---|---|---|
| 0 — Suggest | Recommends; a person does everything | Early experiments; sensitive areas |
| 1 — Draft for approval | Prepares the action; a person approves each one | Most new business uses |
| 2 — Act with approval at key steps | Acts on routine steps; stops for approval before anything that commits money, data or customers | Proven, repetitive processes |
| 3 — Act and report | Acts; a person reviews a summary afterwards | Low-risk, reversible tasks with good logs |
| 4 — Fully autonomous | Acts without review | Rarely appropriate in a mid-sized business today |
Start at level 1 and move up one level at a time, when your own logs show the agent is right often enough and its mistakes are caught. Write down who decided, and why.
The controls every agent needs
- Least privilege. A dedicated account with access only to what the task needs. Never an administrator account, and never a person’s own login.
- Approval gates before payments, customer communications, deletions and changes to master data.
- Limits on spending, number of actions, and run time, so a loop cannot run up costs or damage.
- Complete logs of what the agent saw, decided and did, kept where they cannot be altered.
- A way to undo: drafts rather than final records, soft deletes, and the ability to reverse a batch.
- A kill switch that stops the agent immediately.
- A named human owner who reviews performance and answers for the agent’s work.
Who can see what: access control and audit trails covers the permission and logging design in more detail.
What Omani law already says about agents
Oman has no AI-specific law, but three existing rules apply to agents directly.
- The agent’s actions are yours. Under the Electronic Transactions Law issued by Royal Decree 39/2025, an electronic document issued through an automated agent that you have set up to operate automatically is treated as issued by you (Article 12). Contracts may be concluded through automated agents (Article 19). An agent that sends a quote or accepts an order can bind your business.
- People can object to automated decisions. Since 7 September 2026, Article 14 of the amended Personal Data Protection Law gives data subjects the right to object to decisions resulting from automated processing. A person must then review the decision.
- Data sent abroad is a transfer. If the agent’s model is hosted outside Oman and the agent handles personal data, transfer rules apply. What your chatbot does with customer data explains them.
A sensible first agent project
Choose a task that is frequent, bounded, verifiable and recoverable — such as turning emailed orders into draft ERP entries. Measure how long it takes today. Run the agent at level 1 for a month, logging every correction. Then decide, with numbers, whether to move to level 2. Is AI actually saving your business time? covers how to measure fairly.
Frequently asked questions
What is the difference between an AI agent and a chatbot? A chatbot answers; an agent acts — it uses tools to search, read and change things in systems to complete a goal. AI chatbots vs AI agents covers the distinction in detail.
How reliable are AI agents in 2026? They are reliable on short, well-defined tasks with checkable results, and less so as tasks get longer and messier. Research by METR measures capability as the task length at which agents succeed half the time, which means tasks near that limit fail often.
Can an AI agent sign or accept contracts for my company? Under Oman’s Electronic Transactions Law, contracts can be concluded through automated agents, and documents your agent issues are treated as yours. Put approval gates in front of anything that commits the business.
Should an agent have access to our systems with an employee’s login? No. Give it a dedicated account with only the permissions the task needs, so its actions are separately logged and can be limited or switched off.
What is prompt injection, and does it affect agents? It is text — in an email, document or web page — designed to make the AI ignore its instructions. Agents that read external content are exposed to it. Enforce permissions and approvals in code rather than relying on instructions.
Where should a small business start with agents? With one frequent, bounded, verifiable task, run in draft-for-approval mode for a month with every correction logged. Increase autonomy only when the logs justify it.
This article states the position under the laws in force on 28 October 2026, the date of publication, and is not legal advice.
Sources: METR — Measuring AI ability to complete long tasks · International AI Safety Report 2026 — executive summary · OWASP — Top 10 for LLM Applications · Royal Decree 39/2025 — Electronic Transactions Law (Arabic text) · Royal Decree 68/2026 amending the Personal Data Protection Law
Planning your first AI agent? ZAWAT builds AI and automation and the integrations agents depend on, with approvals, limits and logs designed in. Book a call.