AI agents in production: what actually changes in software engineering
The difference between an AI agent that impresses in a demo and one that sustains a real operation lies almost entirely outside the model. It's in the guardrails: scope limits, reliable data, predictable cost, traceability, and a clear plan for when the answer is wrong, because it will be.
An agent is not a chatbot with a better prompt
A chatbot answers. An agent decides and acts: it queries a database, calls an API, writes to a table, opens a ticket. The moment a model's response becomes a side effect in the system, the problem stops being conversational and becomes one of distributed systems engineering, with all the consequences that entails.
In practice, this means treating every agent action as a transaction: with input validation, explicit authorization, idempotency and logging. The model proposes; the system decides whether to execute.
- Every action with a side effect goes through its own authorization layer, never through trust in the generated text.
- Tools exposed to the agent must have a typed contract and schema validation at the edge.
- Destructive operations require human confirmation or a rollback window.
Cost is an architecture decision, not a line on the invoice
An agent's cost grows with the context it carries, not with the number of users. Resending an entire history on every turn silently multiplies the bill. Selective retrieval strategies, incremental summarization and context caching cut spend without degrading perceived quality.
Equally important: choosing the model per task. Classification, routing and extraction rarely need the most expensive model in the catalog. Reserving the top tier for complex reasoning is what makes the product sustainable at scale.
Observability built for AI
Traditional logs don't explain why an agent answered what it answered. You need to record input, retrieved context, tools called, latency per step, cost per interaction and the evaluated outcome. Without that trail, any regression turns into a matter of opinion.
Continuous evaluation against a fixed set of real, not synthetic, cases is the only reliable way to know whether a prompt or model change improved or worsened the system.
Security: user text is untrusted input
Prompt injection is the modern equivalent of SQL injection, with one aggravating factor: the surface is natural language, so there's no universal escape. The defense is architectural: separate instructions from data, limit privileges per tool, filter outputs before any execution, and audit suspicious attempts.
We apply this principle to our own assistant: any attempt to gain improper access is classified, logged and blocked, with the conversation audited end to end.
In short
Agents in production are an exercise in discipline: narrow scope, minimal permissions, measured cost and continuous evaluation. Those who treat AI as a system component deliver value; those who treat it as a demo accumulate debt.
Frequently asked questions
- Is it worth putting an AI agent into operation today?
- It's worth it when there's a repetitive process, with accessible data and a clear success criterion. Without that, the agent amplifies existing disorganization instead of reducing it.
- What's the biggest technical risk?
- Giving the agent more privilege than the task requires. Excessive permission turns a model error into a security incident.