You don’t need another agent — you need a governed operating layer

Most "AI agent" demos work because the demo is forgiving. The agent reads a document, drafts a reply, ticks a box. Nothing it touches has consequences, and no one asks what happened afterwards.

Production is not forgiving. The moment an AI action sends a message, changes a record, or moves money, the interesting questions are no longer about the model. They are about everything around it.

The model is one component

A capable model is necessary but nowhere near sufficient. Before an action happens, an organisation needs answers to ordinary operational questions:

• Who is acting, and with what authority? Identity and permissions, not a shared API key.
• Is this action allowed here? Policy, evaluated in context.
• Is it reversible? A draft is not a payment. The controls should differ.
• Does a human need to approve it? For high-impact actions, often yes.
• What evidence remains? Enough to reconstruct the decision later.

None of that lives inside the model. It lives in the layer around it.

Read, reversible, irreversible

A simple classification carries most of the weight. Read-only actions — search, retrieve, summarise — need the lightest controls. Reversible writes — a draft, a tentative label — can be reviewed before they matter. Irreversible or high-impact actions — sending, approving, deleting — are where policy, human approval and evidence earn their place.

"AI proposes. Humans decide." The required human role depends on context and risk; it is not a universal rule, and it is not a compliance claim.

What a governed operating layer adds

An operating layer sits between capable models and real systems, and enforces the boundaries: identity and authority, policy evaluation, tool access, sensitive-data controls, approval, governed execution, and evidence captured along the way. That is the difference between a convincing demo and a system an organisation can actually run — and stand behind.