Skip to main content
K4M2 AI

Service

AI agent development

An agent is a system that takes a sequence of actions, some of them irreversible. That is a useful capability and a different engineering problem from answering a question. Reliable agents are mostly constraint work: what it may touch, when it must stop, how you would know it went wrong, and what happens when it does.

The business problem

Agents demonstrate well long before they are dependable, which makes them unusually easy to buy and unusually hard to operate. A demonstration shows the route that worked. Production contains the malformed record, the ambiguous instruction and the case that arrives twice.

The failure that matters is not an agent that gets stuck. It is an agent that proceeds confidently without the authority or the information to do so, and writes the result into a system of record.

So the engineering is in the boundaries rather than the intelligence. We treat autonomy as something granted deliberately, step by step, against the cost of being wrong.

When an agent is the right answer

And, as often, when it is not. We will tell you which.

Multi-step work with tool use

Tasks that genuinely require several actions across systems, not a single classification.

High volume, bounded decisions

Repeated work where the rules can be stated and the exceptions can be routed to a person.

Reconciliation and chasing

Following up, matching records and closing loops, where the value is in persistence rather than judgement.

Triage before a human

Preparing a case so the person deciding starts from an assembled position.

Not a good fit: one answer

If the task is a single decision, a simpler system is cheaper to build and far easier to evaluate.

Not a good fit: undefined success

If nobody can say what a correct outcome is, an agent will produce confident output and no way to check it.

What reliable agents require

Eight constraints. None of them is optional, and most of the engagement is spent here rather than on prompting.

  • Clear boundaries. An explicit task scope, and a defined stopping point. An agent with an open-ended objective cannot be evaluated.
  • Access controls. The agent operates within the permissions of the person or process it acts for, never above them.
  • Human oversight. Named review points, chosen by the damage profile of the action rather than by convenience.
  • Tool permissions. Least privilege per tool, with irreversible writes gated separately from reads.
  • Evaluation criteria. Scored on outcome, route taken, restraint at the boundary, and the cost of failures. Detail in how to evaluate an AI agent.
  • Failure handling. What it does when unsure: escalate, refuse, or roll back. Refusal is a correct answer and should be tested for.
  • Monitoring. Success rate, refusal rate, steps per task and cost per task as a time series, alerting on change rather than level.
  • Governance. An audit trail of what it did and why, mapped to the NIST AI Risk Management Framework and probed against the OWASP Top 10 for LLM applications.

What you will receive

  • A working agent with its scope, permissions and stopping conditions documented.
  • A held-out evaluation suite of real cases, including cases that must be refused, with a frozen slice.
  • A sandbox with deterministic replay, so a fixed bug can be told apart from a lucky sample.
  • Monitoring on success rate, refusal rate, steps and cost per task.
  • An audit trail sufficient for an internal or regulatory review.
  • Everything in your repository: prompts, tool definitions, evaluation sets and configuration.

Expected business outcomes

What a well-bounded agent is for.

Volume absorbed

Repeated multi-step work handled without adding people to it.

Consistent execution

The same steps every time, with the exceptions visibly routed rather than silently skipped.

Loops actually closed

Chasing and reconciliation completed, which is where persistence beats attention.

Contained failure

When it is wrong, it is wrong cheaply, because irreversible actions were gated.

Reviewable behaviour

A record of what it did and why, available before someone asks for it.

Known cost per task

Because cost and steps are measured per run from the start.

How the engagement runs

The sandbox and the suite come before autonomy is widened.

01

Scope and damage profile

What the agent may do, and which of those actions are irreversible. This drives every later decision.

02

Permissions design

Least privilege per tool, with reads and writes separated and confirmation gates placed deliberately.

03

Sandbox

Copies of the systems it touches, with realistic data volumes and latency, plus deterministic replay.

04

Evaluation suite

Real cases from production history, the unhappy path, and a tenth to a fifth that should be refused.

05

Narrow deployment

Live on a limited slice of volume with a human on the irreversible steps.

06

Widen on evidence

Autonomy extended only where the suite and the monitoring support it, never on the strength of a good week.

Frequently asked questions

Do we need agents at all?

Often not. If the task is a single decision or a single answer, a simpler system is cheaper and easier to evaluate. Agents earn their complexity when the work genuinely requires several steps and tool use.

How autonomous will it be?

As autonomous as the damage profile allows. Read-only steps can run unattended; irreversible writes usually should not. That boundary is a design decision, not a capability question.

How do you stop it doing something harmful?

Tool permissions scoped to the task, irreversible actions gated behind confirmation or a human, and evaluation cases specifically designed to provoke the failure.

What about prompt injection?

It is treated as a security surface, not an edge case. Untrusted content reaching a model that holds tool permissions is the main risk, and we test for it directly.

How do you know it works?

A held-out suite of real cases scored on outcome, route, restraint and the cost of being wrong. Success rate alone hides too much.

Can it run in our environment?

Yes. Agents in particular benefit from open protocols at the seams, so tools and data sources are not tied to one platform.

Relevant insights

How to evaluate an AI agent →Your agent is not confused. It was never told. →Model and system evaluation →Our Responsible AI Standard →How to move an AI pilot into production →

Start a conversation.

Tell us the multi-step task and which of its actions you would not want a machine to take unsupervised. That conversation is the design.

Start a conversationSee discovery