Give the AI Agent a Job Before You Give It Tools

Broad mandates such as 'use agents in finance' are too vague to manage. Tiny demonstrations are too narrow to reveal operational value. The useful middle unit is one recurring job: reconcile a defined exception queue, prepare one account review, assemble one onboarding path or test one integration against agreed criteria.

A job gives leaders something they can fund and withdraw. It has an accountable owner, a baseline and a boundary. It also lets teams change the model or supplier without rewriting the purpose of the work. The technical system may evolve quickly; the outcome, authority and acceptance test should remain legible to the people running the business.

Define the outcome and its baseline. Name the event that starts the work. List the context the agent may use, the tools it may call and the identity under which it acts. Set the authority it can exercise without review. Specify the evidence it must leave behind, the moments a person must decide, the executive who owns the result and the condition that stops the job.

This is not technical documentation for its own sake. Each element answers a management question. What result are we buying? Who can initiate it? Which information may travel? What can change in the real world? Who can explain the decision? Who carries the exception? When does continued operation become irresponsible or uneconomic?

NIST warns that people are already giving agents personal and enterprise credentials. That shortcut weakens accountability and exposes broad, long-lived access across systems. NIST's current direction is to treat agents as first-class entities with their own identifiers, credentials and entitlements, connected to the person or system on whose behalf they operate. ³

For an executive, the principle is simple: an agent should not inherit a person's entire working life. Give the job only the identity and authority it needs, for the time it needs them. Record which person or system delegated that authority. When the job ends, the access should end with it.

Microsoft's 2026 transparency report describes controls that evaluate agents against policy, place checks at critical points in a workflow and monitor behaviour while the system is running. The important shift is from a static review to an operating capability: see what the agent is doing, test it as conditions change and intervene before a failure becomes the accepted process. ²

Procurement should therefore ask more than whether a supplier has guardrails. Ask whether your organisation can define job-specific policy, observe important actions, pause the work, preserve a record, route an exception and restore service. A control that exists only in a sales presentation is not part of the job.

A Microsoft Research system designed for concurrent enterprise tasks reports why caution is warranted. Across three agent backends, baseline completion fell as the number of interdependent tasks increased. The researchers found that memory, isolation, planning and learning architecture mattered more than changing the base model alone. The environment was simulated, so the numbers are not a production forecast, but the failure pattern is useful. ⁴

The newest arXiv batch points in the same direction. Researchers are measuring agent working memory, reconciling process supervision with outcome credit and separating short- from long-horizon industrial tool use. These are preprints with different review status, not purchase recommendations. They show that the unresolved frontier is sustained work under changing conditions—not merely a better first response. ⁵⁶⁷

North American suppliers and standards bodies are rapidly building the platform, identity and control layers around agents. In Europe, current transparency and general-purpose model obligations now sit beside later high-risk duties, making role, disclosure, logging and supplier information part of deployment planning. ⁹ The United Kingdom applies existing consumer obligations to agentic services. Other markets may start with fragmented enterprise data, lower connectivity, different languages or fewer assurance resources.

Do not use a US supplier case as a global operating template. Keep the nine-part job specification, then adapt the authority, data path, worker consultation, customer disclosure, language quality, fallback and incident route for each jurisdiction and institution.

Choose one recurring workflow with a named owner, measurable stakes and enough volume to learn. Write the nine-part job before selecting more tools. Run it first with narrow authority and visible human review. Test normal work, exception work and recovery after interruption. Measure completed outcomes, quality, cycle time, review load and reversals—not messages, tokens or demonstrations.

Scale only when the job improves the business outcome without creating unmanageable checking or recovery work. Expand authority in explicit stages. If no executive owns the result, if the agent cannot leave a useful record, or if the organisation cannot stop it without losing the workflow, the job is not ready for more autonomy.