What AI agents can and cannot do.

A fixed rule can route an order by its value. An agent can read a customer's free-text request, work out what it is about and pick the right queue, then leave a note explaining why.

The gain for a team is mostly time and consistency. People stop retyping details between systems, chasing missing fields or drafting the same reply, and spend that time on the cases that need them.

Anthropic's published guidance on building agents makes a related point: start with the simplest design that works, and add autonomy only where the task needs it. Many business jobs are better served by a plain workflow with one or two AI steps than by an agent that decides everything.

If the steps follow fixed rules and need no judgment, you probably need rule-based automation, not an agent. The comparison of rule-based automation and AI agents shows where the line falls.

Three of these tasks work on CRM records: lead qualification, follow-up drafts and record clean-up. Sales and customer operations covers how those sit alongside the rest of a customer record.

• Misinformation (LLM09:2025). An agent can produce a confident answer that is wrong, such as quoting a policy that does not exist or summarizing a record incorrectly. Checks against your own records and a person's review of anything customer-facing limit the damage.
• Prompt injection (LLM01:2025). Text the agent reads, such as an email, a web page or a form field, can contain instructions that steer it away from its job. Treat everything the agent reads as untrusted input, and never let that text change what the agent is allowed to do.
• Excessive agency (LLM06:2025). An agent with broad permissions turns a mistake into damage: a wrong deletion, a message to the wrong customer, a payment approved in error. Give each agent the narrowest access that lets it do its job.
• Unbounded consumption (LLM10:2025). An agent with no usage limit can run up model and system costs, for example by looping on a task it cannot finish. Set caps and alerts before launch.

Two further limits are not on that list. An agent depends on clean data: if your records are inconsistent, it will inherit the inconsistency, and sometimes spread it. It also depends on clear instructions: where a human colleague would ask what you meant, an agent usually guesses. Writing the instructions down, with examples of good and bad outcomes, is part of building the agent.

NIST's generative AI profile names related risks, among them confabulation and information security, and suggests actions for managing them.

• Approval before irreversible or customer-facing actions. Sending a message, changing a price, deleting a record or approving a payment waits for a named person.
• Thresholds. Define when the agent must stop and hand over: low confidence, an unusual amount, a customer who is upset, a field it cannot find. Uncertain cases go to a person rather than being guessed.
• An escalation path. Say who receives the case, how they see what the agent already did, and what happens if nobody responds.
• A log. Record every action: what the agent read, what it decided, what it changed and who approved it. Without a log, a mistake cannot be traced and a review has nothing to work from.

Foxefy builds agents that work within clear permissions, hand judgment calls to people, are tested before launch and are supported after it. NIST's AI Risk Management Framework includes defined processes for human oversight as part of managing AI risk.

• API access. The agent reads and writes through the same interfaces other systems use. A system with no API may need an integration built first. See which systems Foxefy connects.
• Clean records. Duplicate contacts, free-text fields used for three purposes and missing owners all lead to wrong actions. Clean the data the agent will read before it starts.
• Roles and permissions. Give the agent its own account with only the access its task needs, so its reach is visible and can be revoked.
• An audit trail. Every change the agent makes should be traceable to the agent, the time and the reason.
• Past cases. Examples from your own records, including the awkward ones, are the best test set. Run the agent against them and compare its choices with what your team did.

An agent that works across several systems needs those systems connected. Connecting accounting software, messaging and a CRM follows a small number of patterns, set out in connecting accounting, messaging and your CRM.

The worksheet matters because an agent with no agreed before-and-after measure, no cost limit and weak risk controls is hard to justify keeping. Build cost is a separate question, covered in the cost guide's AI agent section.

1. Pick one repeatable workflow with a clear owner, such as routing new leads or drafting follow-ups.
2. Write down today's steps and volumes: who does what, which systems are touched and how often the task occurs.
3. Define success in the worksheet's terms: time saved, errors, share escalated and cost a task.
4. Run the agent in suggest mode. It proposes each action and a person approves or corrects it.
5. Review the errors together: what the agent got wrong, why, and whether the fix is better instructions, cleaner data or a narrower task.
6. Widen permissions only when the measures hold, one action type at a time, and keep the approval step on anything customer-facing.

A written brief makes steps 2 and 3 faster. The software project brief template covers today's process and how success is judged, and its AI agents row asks which steps an agent could take.

Agents are tested before launch and supported after it. Every project is scoped and quoted after a discovery call. Foxefy builds agents as part of AI and automation, which also covers the rule-based workflows and integrations an agent often relies on, and as one of the options within custom software development.

Before a discovery call, write down the five tasks your team repeats most and who checks each result. That list is the start of a pilot for AI agents in your business operations. Book a discovery call to go through it.