Artificial intelligence agents are moving from experimentation to production, and with this shift, the stakes are rising.
A coding agent at PocketOS recently deleted an entire production database. An agent at Meta exposed sensitive user data for two hours. An Instagram support chatbot allowed hackers to hijack thousands of accounts. And last month, researchers tricked a GitHub agent into leaking private repository data.
In each case, the agent did what it was built to do; what failed was everything around it. Intelligence is advancing faster than organizations can safely deploy it. Providing enough context and controls to ensure an agent produces accurate results and doesn’t overstep its bounds is the core quandary.
This difficulty helps to explain why model vendors have been investing in partnerships to help their customers make AI work, and why “forward-deployed engineer” has become the hottest job in tech. Models excel at pattern recognition, but safe deployment demands understanding thousands of disconnected systems, data structures, and compliance rules that power businesses’ operations.
Closing this gap doesn’t require an army of consultants. It requires an architectural framework with four characteristics, each one helping to convert probabilistic outputs from an AI system into verifiable decisions your business can trust.
Sense
An agent is only as reliable as the information it works with. If a policy changes, a system goes down, or a customer’s status shifts, and that update doesn’t reach the AI in time, every decision downstream is going to be made against facts that are out of date. Sense is the architectural layer that keeps that picture current.
Building this means connecting to data wherever it lives, across departments, systems, and clouds, rather than requiring everything to be centralized, which is why enterprise AI projects often stall before they start. It also means treating this data as a live signal, not a snapshot. The system needs to notice material changes and pass that forward in real time, not on the next scheduled sync.
Decide
Data shows what’s happening now. It doesn’t show what happened the last time someone made a similar decision, or why that outcome mattered. This difference separates an agent that can “see” your business from one that understands how it runs.
Building this judgment into AI means grounding it in an organization’s own decision history and policies, not just its live data. An agent handling a routine request should have access to how the last 20 similar requests were resolved, and what happened as a result. In the Meta incident, an internal agent gave an engineer flawed technical guidance that led to data being exposed. With better context, drawn from how similar historical changes played out, this outcome might have been avoided.
Act
An agent that makes recommendations still leaves the work to people. Maximizing the return on AI investments requires agents that can execute, not just advise.
Building one capable agent is manageable. Coordinating several into a workflow takes many layers. The system needs to pass context between steps, apply consistent policy at each one, and stay in sync as underlying systems change, all without losing the governance that keeps an agent from acting outside its lane. This orchestration layer enables agents to work in concert and reliably complete end-to-end tasks.
Secure
Autonomous tools need the same access discipline a company already applies to its employees: scoped identity, permissions limited to the specific task, and a clear audit trail.
In the Instagram incident, tighter scoping and a real-time check on what the bot was authorized to do might have caught the error. Every agent needs a permission set tied to its specific role and logging of every action it takes. They also require a kill switch — a way to cut off an agent’s access the moment something looks wrong. All the identity and access management best practices your company already knows, now need to be extended to non-human actors.
The upside is still real
None of those prerequisites detracts from how far models have come and what they can achieve. Models are advancing rapidly, and their capabilities are real. But intelligence was never the hard part. Connecting it safely to a business — its systems, its rules, its history of what’s worked and what hasn’t — is where a lot of AI investments lag. Agentic AI has real upside for the businesses that get there. Sense, decide, act, and secure are how you get there safely.
Amit Zavery is president, chief product officer and chief operating officer of ServiceNow Inc. He wrote this article for SiliconANGLE.