The Boring Truth About Agentic AI

Every few weeks someone posts a video of an AI agent booking a flight, ordering lunch, and filing an expense report in ninety seconds. The video is real. What the video hides is the forty retries, the two credit cards it almost maxed, and the human sitting off-camera with a kill switch.

I have spent the better part of this year shipping things I would call agentic — not because it is a trendy word, but because at some point the loop stopped needing me to press enter after every step. And the honest summary is this: production agents are boring. They succeed by being narrow, observable, and slightly paranoid. Everything else is a demo.

What "agentic" actually means

Strip away the marketing and an agent is a model in a loop with tools:

1
while not done:
2
    think about the goal
3
    pick a tool and arguments
4
    run the tool
5
    read the result
6
    decide: continue, or stop and report

That is the whole architecture. No hidden consciousness, no autonomous ambition. The interesting engineering is not in the loop — it is in everything wrapped around the loop. What counts as "done"? What happens when a tool fails three times? Who sees the transcript? What can the agent touch, and what is behind a wall?

A chatbot answers. An agent acts, and acting means the failure modes stop being "wrong text in a window" and become "wrong state in the world." That is the entire reason agentic systems need a different discipline from chat products.

The gap between demo and production

Demos run once, on a path the builder walked a hundred times. Production runs a thousand times, on paths nobody imagined. The gap shows up in four places.

Reliability compounds in the wrong direction. If each step of a ten-step task succeeds 95% of the time, the whole task succeeds about 60% of the time. People intuitively forgive a typo in an answer; they do not forgive an agent that booked the wrong flight. Long chains are reliability chains, and every link multiplies.

Failures are quiet. A model that cannot find the data will often invent a plausible version of it and keep going. In chat this is embarrassing. In an agent that writes to a database, it is a data corruption event. The fix is unglamorous: force the agent to cite what it actually observed, make tools return explicit errors, and have a verifier pass that checks outcomes rather than vibes.

State is a nightmare. Real tasks span minutes or days. Sessions expire, rate limits hit, the user closes the laptop. Agents need durable state — a place to record what was attempted, what succeeded, and what is safe to resume. The teams that ship agents treat this like they would treat an order pipeline in an e-commerce backend, because that is exactly what it is.

Permissions are the product. An agent with your admin credentials is a very fast way to have a very bad Tuesday. The mature pattern is boring on purpose: scoped credentials per task, human approval for irreversible actions, and an audit log you can actually read. Every serious deployment I have seen converges on some version of "the agent proposes, a human disposes" for anything that spends money or deletes things.

Where agents genuinely work today

Not everywhere. But some shapes of work have turned out to be a remarkably good fit:

• Code. The environment is verifiable — tests, type checks, the compiler all act as ground truth. An agent that can run its own checks can catch most of its own mistakes. This is why coding agents were the first to cross from demo into daily use.
• Deep research and synthesis. Read forty documents, cross-reference, produce a memo with citations. Slow, read-heavy, output-is-text tasks suit the loop perfectly.
• Triage and enrichment. Classify the ticket, draft the reply, flag the anomaly, prep the summary. High volume, low blast radius, easy to review in bulk.
• Migration and cleanup work. The kind of task a team has postponed for two years because it is tedious. An agent does not get bored, and diffs are reviewable.

The common thread: the work is checkable. Where ground truth exists, agents thrive. Where judgment is the whole job — strategy, taste, negotiation — agents are decent first drafts and unreliable finishes.

A field guide to not getting burned

If you are about to build or buy something agentic, the questions that matter are not "which model" but:

1. What is the blast radius? If the agent hallucinates on step seven, what breaks? Start with tasks where the answer is "someone reads a draft."
2. Can you see what it did? Full transcripts, tool calls, and diffs — or nothing. An agent you cannot audit is an agent you cannot trust, no matter the benchmark score.
3. What is the loop's exit? Hard limits on steps, time, and spend. Agents get stuck. A stuck agent without limits is a burning meter.
4. Who confirms the irreversible? There should be a short list of actions — payments, deletions, sends, deployments — that always route through a human. Forever, probably.
5. Does it get cheaper or more expensive as it gets competent? Counterintuitively, better agents often need more evaluation, because people trust them with more.

The part nobody demos

Here is the actual secret of agentic AI: the model is the easy part. The hard part is a decade-old discipline wearing a new name — designing systems that fail loudly, degrade gracefully, and stay auditable. The teams winning with agents are not the ones with the cleverest prompts. They are the ones who treat the agent like a promising but literal-minded new hire: give it a narrow job, clear acceptance criteria, good tooling, and supervision proportional to the damage it could do.

Do that, and agents stop being magic and start being useful. Which, honestly, is the better trade.

The demo reel will keep being spectacular. The production log is where the interesting engineering lives — and it reads a lot less like science fiction and a lot more like a really good runbook.