Agentic AI

Agentic AI consulting: what is deliverable and what is still a demo

Digiton builds and governs agentic systems for enterprises in Europe. An agent that plans steps and calls your systems ships today. An agent trusted with an irreversible action does not.

By Brandon Da Costa, Founder, Digiton Dynamics. Reviewed 8 September 2026.

What an agent deployment actually contains

The model is the smallest part of it. An agent that survives contact with a real business is mostly the scaffolding around the model, and that scaffolding is where the work and the cost sit.

• Tools, with narrow contracts. Each action the agent can take, defined as a function with typed inputs, a validation step and a documented failure. An agent with broad database access has no tool layer, it has a security incident waiting for a busy week.
• State the agent can read and a memory it cannot silently rewrite. What it remembers between runs, where that lives, and how a person deletes a record from it.
• A plan the agent commits to before acting. Written down, reviewable, and comparable against what it then did.
• Evaluation cases, each with the agreed correct answer. Not sample outputs. Cases, with a score you can rerun after every change.
• The control layer. Permissions, approval gates, logging and a kill switch. That is the next section, because it is the half most proposals leave out.

The control layer

Four controls. Each one costs a day or two to build and saves the deployment.

1. Permissions, scoped per tool and per agent. The agent gets its own service account with its own least-privilege grants, never a human's credentials. When something goes wrong you want the audit trail to name the agent.
2. An approval gate on anything irreversible. Sending an external message, moving money, changing a customer record, deleting anything. The gate is a person, and the interface shows them the plan and the inputs rather than a yes or no button.
3. Logging that reconstructs a decision. Input, retrieved context, the plan, every tool call with its arguments and result, and the final action. Article 26(6) of Regulation (EU) 2024/1689 sets a six-month floor for deployers of high-risk systems. The real reason to build it is that without the tool arguments you cannot explain a bad action three weeks later.
4. A kill switch a duty manager can reach. One control that suspends the agent without a deployment, owned by operations rather than by engineering, tested before go-live rather than during the first incident.

Article 26(2) puts human oversight on deployers of high-risk systems, and requires that the people assigned to it have the competence, training and authority to exercise it. Authority is the word buyers skip. An oversight role that cannot stop the system is a review, not oversight.

Where agents beat workflow automation, and where they lose to it

This is the most expensive decision in the whole category, and it gets made on fashion rather than on shape.

The common mistake runs one way. A team builds an agent for a task that had five branches, then spends a quarter constraining it back into those five branches. Reach for the agent when the branching is the problem.

The failure modes that show up in month two

Month one goes well in almost every deployment. These are the four that arrive later, and each has a control that prevents it.

Silent drift after a model or prompt change. Quality moves and nobody notices because there is no evaluation set to rerun. The fix is the evaluation set, built before the first release rather than after the first complaint.

Cost that scales with retries. A failing tool call sends the agent into a loop, and the bill arrives a month later. Caps per run, per day and per agent, plus an alert on retry rate.

Scope creep by tool. Someone adds a tool because it was easy, and the agent now has a capability nobody classified. Tool additions belong in change control and trigger a reclassification.

Oversight fatigue. The approval gate works, the reviewer approves 200 of 200, and by week six the gate is a rubber stamp. Sample the approvals, measure the override rate, and if it stays at zero the gate is on the wrong action.

What to pilot first

Pick a task with four properties and the first deployment tends to land. High volume of unstructured input, an existing human reviewer, a reversible action, and an owner who wants it.

Inbound document triage fits all four in most businesses. So does first-pass supplier or contract review, and internal knowledge retrieval where every answer carries its citation. Each has a person already doing the work, which gives you both the evaluation set and the reviewer.

What to avoid first: anything customer-facing with an irreversible action, anything touching a decision that falls under Annex III of Regulation (EU) 2024/1689, and anything where the current process is undocumented. The third one looks like the easiest win on the slide and it is the one that stalls, because there is no agreed correct answer to build against.

Digiton builds the agent and the control layer in the same engagement, and average deployment is 45 days from signed scope to a system running in production with the oversight step in it.

Frequently asked questions

Related