Juan Piaggio · 2026-08-10 · 7 min read · ai · agents · product-development
For two years the default AI feature was a box you typed into. It summarized, it drafted, it explained. Useful, occasionally delightful, and fundamentally passive: the output was text, and a human did the actual work.
That phase is ending. The systems teams are shipping now plan a sequence of steps, call real tools, and change real state. The noun is still "AI feature." The verb changed from suggests to does. That single word is the whole engineering problem.
A chatbot is forgiving in ways that are easy to miss until you lose them. If it hallucinates, a human reads the nonsense and ignores it. If it is slow, someone waits. If it misunderstands the request, nothing breaks, because nothing happened. The human is the error handler, the rate limiter, and the audit log, all at once, and they perform those jobs for free.
The moment the model can move a ticket, email a customer, or update a field, every one of those free services becomes something you have to build. Not because agents are less reliable than chatbots — they are the same models — but because the consequences of being wrong stopped being a paragraph you scroll past.
When we crossed this line in Meshworq, three concerns went from theoretical to load-bearing almost immediately.
Scope. A chatbot can be asked anything, because it can do nothing. An agent needs an explicit list of what it is permitted to attempt. We settled on an allowlist: a small set of enabled actions, and everything outside that set is not a low-confidence proposal, it is simply not an option the agent can reach. The failure mode you are designing against is not a bad decision, it is a decision in a category nobody sanctioned.
Confidence as a gate, not a garnish. Displaying a confidence score next to a suggestion is decoration. Using it to decide whether the agent may proceed is architecture. A confidence floor means the agent declines to act when it is unsure, and an uncertain agent that stops is worth more than a certain agent that is occasionally wrong.
A record that survives the moment. Chat output is ephemeral by nature and nobody minds. An action is a fact about your system that somebody will eventually need to explain. Every AI decision in Meshworq carries a correlation ID through the audit ledger, so months later you can answer what the agent did, on what evidence, and who approved it. Retrofitting that is painful; adding it before you need it costs almost nothing.
A passive assistant can be wrong quietly. An agent is wrong in your database.
The framing that trips teams up is treating autonomy as a property of the system: either the agent runs the workflow or it does not. In practice autonomy is per-action, per-confidence-band, and it moves over time.
The pattern that works is governed autonomy. The agent plans and executes the multi-step work — read the ticket, classify it, check the duplicates, pick the owner, draft the transition — and then, at the point where state actually changes, its proposal lands in a human approval queue. Risk scoring decides how loudly it lands. In Meshworq the score combines the age of the pending decision with the agent's own confidence:
riskScore = ageFactor + confidenceFactor
ageFactor = min(ageMinutes / 480, 1) x 0.2
confidenceFactor = (1 - confidenceScore) x 0.5
HIGH >= 0.67
MEDIUM >= 0.34
LOW < 0.34
Two properties matter more than the exact coefficients. A low-confidence decision is high-risk immediately, and a decision nobody has looked at gets riskier as it sits. Neglect is a failure mode, so the model treats it as one, and SLA timers escalate the ones that stall.
The reviewer is not doing the work again. They are reacting to a completed proposal, which is a much cheaper cognitive act than starting from a blank ticket. That is where the time savings actually come from — not from removing the human, but from moving them to the end of the workflow instead of the middle of it.
If you are moving an existing AI feature from suggestion to execution, the sequence that keeps you out of trouble is unglamorous:
Every step here is earned by the previous one. Teams that skip to step five ship something impressive and then spend a quarter rebuilding trust they never had to lose.
Agentic workflows are not chatbots with more ambition. When AI moves from producing text to changing state, the human stops being your invisible safety layer and you have to build that layer on purpose: bounded scope through an action allowlist, confidence used as a gate, risk scoring that routes attention to what deserves it, an audit trail with a correlation ID, and a kill switch you trust. Do that, and autonomy becomes a dial you turn up on evidence. Skip it, and you find out where the guardrails should have been by discovering the gaps.