Vendors are pitching “AI agents” that can run your inbox, your quotes or your customer service. The term covers very different things, and the difference matters: it changes the cost, the risk and how much supervision you will need. This article separates three options with one concrete example, then gives you the questions to ask before you sign anything.
Three different options
Rule-based automation follows instructions written in advance: “when this happens, do that”. It doesn’t understand anything; it just applies the rule. Think of a programmable thermostat: at 6 a.m. it goes up to 20 degrees, every day, with no surprises.
An AI step inside a fixed workflow adds an AI model at one point in the process, usually to read free text, summarise it or sort it. The route stays the same every time. Think of a sorting centre where one worker reads badly written addresses: they interpret, but the parcel still travels down the same conveyor belt.
An AI agent is given a goal and some tools, then decides on the steps itself. Think of handing a new hire the company credit card and saying “plan the team trip”: they pick the flights, the hotel and the order of things. That is useful when the path can’t be predicted, and risky when its access is too broad.
Anthropic, the company behind the Claude models, draws the same line in its guide “Building effective agents”. Workflows follow predefined code paths, while agents direct their own process and decide which tools to use.
One request, three ways
A fictional renovation company receives this email: “Hi, we’d like to redo the basement bathroom. There was water damage in the spring. We’re mostly available in the evenings.” No address, no budget, no photos.
A rule can spot the word “bathroom”, add a row to the tracking sheet and send a standard acknowledgement. It won’t notice the missing address or the water damage, which could change the scope of the job. It works very well when requests come through a form with required fields, and much less well with free text.
An AI model pulls the type of work, availability, missing details and the water damage mention out of the email. A rule then checks the required fields and creates a record marked “to review”. A person reads it and sends a pre-written request for the missing details. Nothing goes to the client without that person.
The agent has access to the inbox, the calendar and the tracking sheet. It can decide to reply, ask for photos or offer a site visit. It can also book that visit on the estimator’s day off, or suggest that insurance will cover the work. That is a lot of autonomy for a path that is really quite repetitive.
Here, option 2 is enough: the only hard part is reading free text, and the rest of the route is known. If the company could get clients to use a form, option 1 might do the job on its own.
Comparing the three options
| Criterion | Rule | AI step | Agent |
|---|---|---|---|
| Predictability | Complete | High, except the AI step | Lower |
| Cost to run | Low | Moderate, per use | Higher |
| Ease of checking | Simple | One step to review | Every action to track |
| Risk of wrong action | Low, but errors repeat | Limited to one step | Errors can compound |
| Best fit | Structured data, stable rules | Free text, known route | Unpredictable path, limited access |
Anthropic’s guide sums up the trade-off: workflows offer predictability and consistency for well-defined tasks, while agents fit when flexibility is needed. It adds that agents’ autonomy means higher costs and the potential for compounding errors, and recommends extensive testing in sandboxed environments. Its starting advice is to find the simplest solution possible, which might mean not building an agent at all.
- Would a rule do the job? If so, stop there.
- If not, would a single AI step inside a fixed route handle the hard part?
- If not, is the path truly unpredictable, and can you limit access and require approval for important actions? Then an agent may be justified.
More autonomy, more oversight
With a rule, a mistake repeats the same way every time and is quick to spot. With an agent, a mistake can look different every time: a wrong email, a badly timed appointment, an edited file. The more a system acts on its own, the more human approval becomes the last safeguard before an error leaves the business.
The OWASP Gen AI Security Project lists this risk in its 2025 Top 10 for LLM applications as “Excessive Agency”. It names three root causes: excessive functionality, excessive permissions and excessive autonomy. Its recommendations include limiting an agent to the tools it strictly needs, keeping permissions to a minimum and requiring a person to approve high-impact actions before they happen.
- Read only: the tool looks things up and changes nothing.
- Draft: it prepares the work; a person approves and sends.
- Bounded action: it acts alone on low-impact cases, within set limits.
- Free action: only for things with no real consequence that are easy to undo.
When not to automate
Sometimes the right answer is neither a rule nor an agent. Not automating is a sound decision in these situations.
- Rare tasks: if it happens a few times a year, setting it up and watching it costs more than it saves.
- Judgment or relationships: telling an unhappy client about a delay, negotiating a price or handling a dispute needs a person.
- Unclear process: if your team doesn’t do the task the same way, a tool will lock in the confusion.
- Sensitive data with no framework: personal, financial or health information, with no clear rules on who can see it or where it goes.
- Low volume: a few minutes a week doesn’t justify one more tool to maintain.
On data, keep in mind that in Canada, PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, subject to substantially similar provincial laws. Before you give that kind of information to an AI tool, check your obligations and what the vendor does with the data.
Questions for any vendor
When someone pitches you an agent, these questions show what it will actually do. A vague answer tells you something too.
Ask before you sign
- Exactly which actions can the agent take, and which are off limits?
- Which tools and data can it access, and can it change them or only read them?
- Which actions need a person’s approval before they happen?
- What does it do when information is missing or it isn’t sure?
- What stops it, for example a maximum number of steps?
- Can we view a log of everything it did ourselves?
- Where is our data processed and stored, and is it used for anything else?
- Has it been tested on our own cases, in a safe environment, before going live?
- How does the cost change as volume grows?
- How do we switch it off and go back to doing it by hand overnight?
- Why wouldn’t a rule or a single AI step be enough here?
Limits and mistakes to avoid
- The cost and risk comparisons are general: they vary with the tool, the volume and how the system is built.
- The lines between the three options can blur: a product sold as an “agent” may just be a fixed workflow, and the reverse.
- This article is not legal advice on privacy law.
Sources consulted
- Anthropic, “Building effective agents” ↗The distinction between workflows and agents, the predictability versus flexibility trade-off, agents’ higher costs and compounding errors, sandboxed testing, stopping conditions and the advice to start with the simplest solution.checked on September 15, 2026
- OWASP Gen AI Security Project, “LLM06:2025 Excessive Agency” ↗The three root causes (excessive functionality, permissions and autonomy), minimum permissions and human approval of high-impact actions.checked on September 15, 2026
- Office of the Privacy Commissioner of Canada, “PIPEDA requirements in brief” ↗Who PIPEDA applies to and the exemption for substantially similar provincial laws.checked on September 15, 2026
Written with the help of AI tools, then checked and edited by Over U. Examples are fictional. This guide is not legal advice.