The biggest change in AI during 2026 is not a smarter chatbot. It is the spread of agents that can accept delegated work, use tools, and complete deliverables. Unlike an assistant that only answers a question, an agent can read files, move across systems, decide a sequence of steps, and sometimes make real changes.
The opportunity is tangible. In a July 2026 customer case published by OpenAI, NTT DATA reported that a complex incident analysis that had required five engineers and three days was completed with Codex in 30 minutes. This is a vendor-published result from one organization, not a universal benchmark. The more transferable lesson is that NTT DATA paired the tool with a center of excellence, security guidance, training, usage monitoring, and explicit requirements for human review.
An AI agent is not a digital employee. It is closer to a probabilistic software operator with permissions. Sustainable performance therefore starts with an operating system, not a clever prompt.
Why agent operations matter now
OpenAI research published in 2026 describes a shift from short conversations to longer delegated tasks. Anthropic research on real-world agent use found that the longest Claude Code sessions nearly doubled in autonomous duration over three months, from under 25 minutes to more than 45 minutes. A longer work horizon increases the ceiling for productivity, but it also gives a mistaken assumption more steps in which to compound.
NIST analysis of public responses on AI agent security found broad agreement that established cybersecurity principles remain relevant but must be adapted for novel agent threats. The important question is no longer only which model is smartest. It is which job the agent may perform, with which permissions, under which evidence and controls.
1. Start with one job, not a universal assistant
If the first assignment is to help with everything in the company, success cannot be measured. Choose one job with clear inputs, completion criteria, exceptions, and an accountable owner.
- Good start: classify incoming support tickets and prepare response drafts.
- Poor start: automate customer support.
- Good start: assemble logs and change history into an incident hypothesis report.
- Poor start: operate IT on its own.
OpenAI Presence similarly frames production deployments around a specific job, such as resolving billing issues, supporting an insurance claim, or handling an internal IT request. A narrow scope does not make an agent less capable. It makes performance repeatable.
2. Write failure conditions beside success conditions
If an agent receives only a goal, it must invent its own interpretation of done. An operating specification should state at least four things:
- Which inputs are permitted
- Which deliverable must be produced
- Which data or systems must never be changed
- Which conditions require a stop and human escalation
For an invoice review agent, success can be expressed as field extraction coverage, policy violation detection, evidence-link coverage, and an acceptable false-positive range. A new supplier, conflicting amount, exposed personal data, or ambiguous policy should be a stop condition rather than an invitation to guess.
3. Make least privilege the default
More connected tools can make an agent look more useful, but they also increase its risk surface. This is why the NIST AI Agent Standards Initiative treats agent identity and authorization as a distinct area of work.
- Separate read permission from write permission.
- Restrict access to the folders, tables, and accounts required for the job.
- Give each agent a service identity instead of sharing a personal account.
- Prefer short-lived, narrowly scoped credentials over long-lived tokens.
- Treat content from external systems as untrusted input.
Begin with permission to read, analyze, and prepare drafts. Add narrowly constrained write access only after the evaluation record supports it.
4. Separate reversible from consequential actions
Treating every tool call as equally risky creates approval fatigue, while allowing every call to pass automatically hides consequential changes. Classify actions by impact.
- Low risk: search, read, summarize, create a temporary artifact
- Medium risk: save a draft, open an internal ticket, change a test environment
- High risk: send a customer message, move money, change a contract, deploy to production, delete data
Low-risk work can often run automatically with logging. Medium-risk work can use sampling or after-the-fact review. High-risk work should pause immediately before execution so a person can inspect both the proposed change and its impact. Human approval should show a meaningful diff, not just an OK button.
5. Build simulations and regression evaluations before launch
One successful demo is not evidence of production readiness. OpenAI Presence describes testing common requests, edge cases, and high-risk scenarios, then grading outcomes, policy compliance, tool use, and escalation behavior.
A useful evaluation set includes:
- Representative work that should finish normally
- Incomplete requests where the agent should ask a question
- Requests that policy requires it to refuse or stop
- Inputs containing malicious instructions or prompt injection
- External system failures, timeouts, and duplicate execution
- Regression cases that succeeded before a model, prompt, or tool change
Do not measure accuracy alone. Track completion, evidence quality, invalid tool calls, unnecessary permission requests, human intervention, and recovery time.
6. Observe the process, not only the final answer
A polished report may still have come from the wrong data or a lucky guess. Production records should include tool calls, data scope, important decisions, approvals, and reasons for stopping, as well as the initial request and final result.
This does not mean storing unlimited private reasoning. Design action-oriented audit records that are sufficient for reproduction and accountability, then define redaction, retention, and access controls.
After launch, convert failed sessions, human corrections, escalations, and user feedback into new evaluation cases. Agent operations are a continuous loop of observation and controlled improvement.
7. Define escalation rules and a human owner
Ask a human when needed is not an operating rule. Specify the threshold, the destination, and the context that must travel with the escalation.
- Financial or legal impact exceeds a defined threshold
- Policy sources conflict
- Personal data or a security incident may be involved
- Confidence is below the accepted level or evidence is missing
- The same task fails repeatedly or an external system is unstable
The escalation package should contain the original request, completed steps, evidence used, proposed changes, and available options. One named person or team must remain accountable for the quality, permissions, and incident response of the agent.
A 30-day adoption plan
Week 1: Define the job in one sentence
Choose a frequent task with low failure impact and measurable current effort. Collect 30 to 50 historical cases and document completion and stop conditions.
Week 2: Build a read-only pilot
Let the agent analyze and draft without making real changes. Review every run and classify the failures. Improve data boundaries and tool interfaces before expanding the prompt.
Week 3: Automate evaluation and approval gates
Add representative, edge, and adversarial inputs to a regression set. Apply risk-based approval rules and test duplicate prevention, timeouts, and recovery.
Week 4: Release to a limited group
Measure time saved, correction rate, escalation, incidents, and satisfaction with a small team. Expand only the jobs that demonstrate value, and add permissions one at a time.
The operating system lasts longer than the model ranking
Models and product rankings can change within months. A clear job, least privilege, an evaluation suite, approval boundaries, action logs, and accountable ownership remain useful with any provider.
The strongest agent project is not the one that removes people completely. It gives repetitive investigation and execution to the agent while people retain goal setting, exception judgment, and responsibility. Prove that structure on one job, then expand to the next.
Official sources
- OpenAI Presence and production controls
- OpenAI research on how agents are transforming work
- NTT DATA Group Codex customer case
- Anthropic research on agent autonomy in practice
- Anthropic principles for trustworthy agents
- NIST analysis of AI agent security responses
- NIST AI Agent Standards Initiative
Performance figures come from the institutions and vendors that published the cited cases. Outcomes will vary with data, workflow, and control quality. Verify current product policies, security requirements, and applicable law before deployment.