Agentic AI in the enterprise is a decision about how single steps of a process get executed, made one step at a time. The measurements argue for caution. In the 2024 τ-bench study, gpt-4o as a function-calling agent succeeded on fewer than 50% of tasks, and the share it passed eight times in a row (pass^8) fell below 25% in retail. Newer models do better, but repeatability is still the number to watch. Anthropic measured on its own system that agents use about 4 times more tokens than chat, and multi-agent systems about 15 times more.
Our reading for enterprise agentic AI: an agent costs more and varies more than fixed code, so it has to earn every step it gets. An agent earns a step when the path is unknown but the outcome is checkable, and when a mistake can be reversed. The rest of the process stays plain code, a workflow or a single model call.
What Agentic AI in the Enterprise Means Inside an AI Factory
Agentic AI in the enterprise is the use of software that lets a language model choose its own next step and tools to finish a task, applied only to the steps of a process where fixed code cannot enumerate the path in advance.
OpenAI's practical guide to building agents says: "Agents are systems that independently accomplish tasks on your behalf." The LangGraph documentation draws the line: "Workflows have predetermined code paths and are designed to operate in a certain order," while "Agents are dynamic and define their own processes and tool usage." Vendors also sell the "agentic enterprise," a whole organization run by agents. We stay with one step.
This article is about placement: which steps in an AI factory should be run by an agent, how to tell, what an agent adds to the platform you already run, and in what order to let it act. It does not cover what an agent engagement costs, how to staff one, or the reference architecture of the agent itself.
The Autonomy Ladder: Model Call, Workflow, Single Agent, Multi-Agent
Microsoft's guide to AI agent orchestration patterns sets the rule: "Use the lowest level of complexity that reliably meets your requirements." Google's guide to agentic AI design patterns adds that if a workload "can be executed with a single call to an AI model, it can be more cost effective to explore non-agentic solutions for your task." Both describe the same ladder:
- Direct model call. Microsoft: "If prompt engineering can solve the problem, you don't need an agent."
- Workflow: the engineer writes the path, and the model decides inside nodes, as in LangGraph's routing or prompt chaining.
- Single agent with tools, which Microsoft calls "Often the right default for enterprise use cases."
- Multi-agent, which "Adds coordination overhead, latency, and failure modes."
For agentic AI in the enterprise, each rung up buys flexibility with latency, tokens and predictability. Climb only when the rung below fails a real test case. That settles the AI agent vs workflow question per step.
A Placement Test: Five Questions Before a Step Gets an Agent
Business teams arrive with a list of places where they want an agent. Our placement test filters it and answers when to use AI agents.
- Is the input unstructured or ambiguous? OpenAI points to "Heavy reliance on unstructured data."
- Can the path be written down in advance? OpenAI names "Complex decision-making" and "Difficult-to-maintain rules"; otherwise "a deterministic solution may suffice."
- Can a wrong action be undone or stopped first? OpenAI rates tools by "read-only vs. write access, reversibility, required account permissions, and financial impact."
- Can the outcome be checked automatically, many times? Without that, repeatability cannot be measured.
- Does the step's value cover several times the tokens? A low-value step cannot carry the bill.
Our test, not a standard; questions 1 and 2 follow OpenAI's criteria.
The rule we apply: five yes answers mean an agent. A no on question 1 or 2 means a workflow or a single call. A no on question 3 means a read-only agent whose writes wait for approval. A no on question 4 means the step waits for an evaluation harness.
Vendor security review, OpenAI's own example, passes: the evidence varies, and a reviewer can check the findings. Ticket classification fails question 2, since the categories are known, so one model call does it. A refund above a threshold fails question 3: the agent prepares the case, a person approves the payment. Seen this way, agentic AI in the enterprise is a property of individual steps.
Agents Consume the Platform, Then Add Three Things of Their Own
An agent does not need a new platform. It reuses the gateway, prompt registry and evaluation harness from the shared components your platform already runs, then adds three things.
First, tool contracts. The Model Context Protocol specification (2026-07-28), built on JSON-RPC 2.0, warns that "Tools represent arbitrary code execution and must be treated with appropriate caution" and that "MCP itself cannot enforce these security principles at the protocol level." Authorization is your job, so treat each tool server as a production API with an owner and a version. The A2A specification (1.0.0) matters only once agents from different teams talk to each other.
Second, identity per agent. In our designs every agent gets its own least-privilege credentials, not a team key, or nobody can say which agent made a write.
Third, state with interrupt points. LangGraph interrupts "allow you to pause graph execution at specific points and wait for external input before continuing." Human approval becomes an auditable, resumable point in the agent's state.
Single Agent First: When Multi-Agent Earns Its Overhead
OpenAI advises: "Our general recommendation is to maximize a single agent's capabilities first." It observes that "Some implementations successfully manage more than 15 well-defined, distinct tools while others struggle with fewer than 10 overlapping tools." Microsoft reserves several agents for cases where one struggles "due to prompt complexity, tool overload, or security requirements."
The payoff can be large. Anthropic's research system "outperformed single-agent Claude Opus 4 by 90.2%" on an internal research evaluation, at about 15 times the tokens of chat, and Anthropic notes that "most coding tasks involve fewer truly parallelizable tasks than research." The MAST taxonomy (Cemri et al.) found 14 failure modes in 3 categories across 1600+ traces from 7 multi-agent frameworks, with kappa 0.88.
Our rule: split an agent when its tool list or its security boundary stops fitting in one head, not when the org chart has more boxes. That is single-agent overload, and a split fixes it.
What Changes When Software Chooses Its Own Steps
Three risks change once a model picks its own path. In agentic AI in the enterprise, they set how much permission an agent gets.
Repeatability. τ-bench measures pass^k, whether an agent completes the same task k times in a row; in the 2024 study, gpt-4o reached pass^8 below 25% in simulated retail. TheAgentCompany (v3, 2025) found the best agent completed 30% of tasks autonomously in a simulated software company. Measure pass^k before granting write access.
Hijacking. NIST CAISI defines agent hijacking as "a type of indirect prompt injection in which an attacker inserts malicious instructions into data that may be ingested by an AI agent." In January 2025 tests on AgentDojo with an upgraded Claude 3.5 Sonnet, new attacks lifted success from 11% for the strongest baseline attack to 81%, and 25 attempts instead of one lifted the average from 57% to 80%. The attacks were tuned to that model, so read this as a lesson in testing with repeated attempts.
Human oversight. For high-risk systems, Article 14 of the EU AI Act requires that an overseer can "disregard, override or reverse the output" and stop the system "through a 'stop' button or a similar procedure." The 2025 AI Agent Index, covering 30 agents, found that "most developers share little information about safety, evaluations, and societal impacts," so test this yourself.
Rolling Out Enterprise Agentic AI: Order of Moves, Not a Calendar
The order we use:
- Pick a step that passes the placement test.
- Run it first as a workflow or a single call, as a baseline.
- Let the agent in with read-only tools.
- Measure pass^k on the same tasks.
- Allow writes behind an interrupt point.
- Widen permissions only while the numbers hold.
Repeat the test every quarter. METR measured that the 50% time horizon of frontier models on software tasks, around 50 minutes for Claude 3.7 Sonnet, has doubled roughly every seven months since 2019. The trend comes from programming tasks, so treat it as a reason to retest: a step that fails question 4 today may pass next year.
At DS Stream we run the placement test on a client's process and build the agent on the platform the client already has. See how we design agents for production systems and the AI factory those agents plug into, or run the placement test on one of your processes with our engineers.
Frequently Asked Questions
What is agentic AI in the enterprise?
Agentic AI in the enterprise is software in which a language model chooses its own next steps and tools, used only where the path cannot be written down in advance. It is a decision about single process steps, not the whole organization.
When should an enterprise use an AI agent instead of a workflow?
When the input is unstructured, the path cannot be written in advance, actions are reversible, the outcome is checkable and the value covers the tokens. Otherwise, per OpenAI, "a deterministic solution may suffice." Most candidate steps for agentic AI in the enterprise end up as workflows.
Is a multi-agent system better than a single agent?
Not by default. OpenAI and Microsoft advise starting with one agent. Anthropic measured better results on internal research tasks at about 15 times the tokens of chat, and MAST describes 14 failure modes of such systems.
How reliable are AI agents in production today?
Public data comes from benchmarks, not any company's production. In the 2024 τ-bench study, gpt-4o succeeded on fewer than 50% of tasks, with pass^8 below 25% in retail; in TheAgentCompany (2025), the best agent completed 30% of tasks. Measure repeatability before widening permissions.
