The year of the agent demo is behind us. Every vendor deck now features software that plans, calls tools, writes code and books the meeting, and an executive audience nodding at the implication: imagine this loose in our business. The gap between that demo and a deployment you would defend to a board is wide, and it is not a technology gap. It is a discipline gap.
An agent is software that takes actions. That single property changes everything about how it must be engineered, because a wrong action is not a wrong paragraph: it sends the email, moves the record, spends the money. Treating agent output like content, reviewed casually if at all, imports a failure mode businesses have spent decades engineering out of every other system that acts.
A demo earns applause. A gate earns production. They are different rooms.
The factory pattern
We build agents through Stagecell, our agent factory, and the word factory is doing deliberate work: not artisanal, one-off constructions but a production line with stations every agent passes. Scope, declared: what the agent may see and do, written as configuration, not vibes. Context, engineered: the documents and constraints it reasons over, versioned like code. Then the gates: behavioural tests against known cases, adversarial prompts that try to bend it, boundary checks proving it cannot exceed its permissions, and human sign-off with a name attached. An agent that fails a gate does not ship. There is no meeting where charisma overrides the gate.
Determinism where it counts
Inside our platforms, agents follow the same wall we build everywhere: they orchestrate, summarise and draft, while consequential facts and figures come from deterministic tools the agent must call. The agent that analyses a deal room in Recursys does not remember the revenue figure, it retrieves it from the extraction layer, with a citation. This is what makes agent output auditable: you can always ask where a claim came from, and there is always an answer that is not "the model said so".
Run this way, agents are less magical and far more useful. Ours read data rooms, draft findings, chase document gaps and reconcile registers, at a scale no team could staff, and every action they take sits inside a boundary a human drew and a log a human can read.
What to do about it
- Write each agent's permissions as explicit configuration before it runs anywhere real.
- Test behaviour against known answers and adversarial inputs, and make passing non-negotiable.
- Log every action with enough context to reconstruct it, because someone eventually will ask.
- Route consequential facts through deterministic tools. Narration is the agent's job; arithmetic is not.
The incoming Australian rules will ask who is accountable for automated systems and how they are controlled. For agents built through gates, the answer already exists in writing. For agents shipped on vibes, the answer is a scramble. Choose the boring path; it is the one that scales.