An AI agent in practice: its work, and where it stops

“So what does an agent actually do?” The question comes up in every conversation, and it deserves better than an abstract answer. For architecture decisions I use this practical split: an assistant mainly answers questions; an agent carries out a bounded task with tools (it reads a statement, queries the ERP, searches a corpus) and it stops before it commits the organisation. Vendors use the terms differently. But you can recognise a good first agent by four traits: the task repeats, the input is a document, the result can be checked, and a human approves.

The loop stays the same; the business process changes. Here are four examples: an accounting practice, a municipality, an SME and a research institute.

The accounting practice: the reconciliation agent

Swiss payment rails are heavily structured: the QR-bill replaced payment slips in 2022, and bank statements can arrive in ISO 20022 formats such as camt.053. The source invoices, the attachments and the exceptions may still arrive incomplete or unstructured. That mix of structured records and exceptions you can verify suits an agent well.

• The trigger: the daily camt.053 statement, and the invoices received
• What the agent does: it extracts the data from each invoice (QR reference included), matches the payments in the statement against the open items, prepares the entries in the accounting software, and lists the doubtful cases separately: partial amounts, duplicates, missing references
• Where it stops: no entry gets posted without approval; the accountant reviews the list and confirms in one go

The calendar gives you another reason to clean the data. Structured addresses have been mandatory on QR-bills since 22 November 2025. According to SIX Swiss Payments, structured or hybrid addresses become mandatory across Swiss payment types on 14 November 2026. So address quality pays twice: in the payments and in the automation.

The municipality: the incoming-mail agent

• The trigger: the day’s mail, scanned post and electronic
• What the agent does: it routes each item to the right department, finds the regulations and the earlier decisions that apply, and prepares a draft reply with its sources cited
• Where it stops: nothing goes out without review and signature; the agent prepares, the clerk’s office decides

The same mechanism works for meetings: local transcription, then a structured draft of the minutes. For a municipality, where the data sits isn’t a detail: the files hold residents’ data, and what happened in Rolle showed what dispersal costs. A municipal agent runs on a machine in the network cabinet (see the three configurations) or in an approved hosted environment, depending on the risks and the controls that apply.

The SME: the quotation agent

• The trigger: a price request arriving by email, often incomplete and in free form
• What the agent does: it extracts what the customer is asking for, finds the items and the prices in the catalogue or the ERP, points out what’s missing, and prepares the quotation in the house format
• Where it stops: the quotation goes out after review; discounts and terms stay a human decision

A useful variant for public-sector bidders is a monitoring agent that watches the tenders published on simap.ch, filters out the irrelevant notices and produces a weekly summary of the opportunities that match the company’s work and deadlines.

The institute: the research monitoring agent

• The trigger: new publications on defined topics, and the research group’s internal corpus
• What the agent does: it reviews the new work, prepares a weekly summary with exact references, maintains a structured bibliography, and answers questions on the corpus while citing its sources
• Where it stops: it doesn’t write in place of the researchers; it prepares the material, including for reports to funding bodies

The same pattern can serve foundations and NGOs: it watches the calls for proposals and supplies the evidence for the impact reports funders ask for.

The guardrails that make these agents controllable

The same guardrails come back in all four cases:

1. Limited tools: the agent reaches only what its task requires
2. Versioned prompts: tested and tracked like code, not like scraps of text
3. Untrusted input isolation: an email, an invoice or a publication is data, not an instruction that can expand the agent’s permissions
4. Idempotent, capped actions: a retry can’t create two entries, and no amount or volume can pass an authorised limit
5. Monitored logs: reads, proposals, tool calls, approvals, errors and retention get recorded, with no more personal data than the log needs
6. Human approval: at the steps that commit (an entry, a reply, a dispatch), a human decides
7. A recovery path: the team can stop the agent, revoke its access, correct an action and handle an incident

Hosting follows the threat model: controlled hardware, or a service you approve after reviewing the operator, the jurisdiction, the administrative access, the subprocessors, the keys, the logs and the exit plan. A Zurich region and a private network are useful safeguards. They aren’t conclusions on their own.

Those controls describe how an agent operates. A separate review decides whether the EU AI Act reaches the use, which legal role the company occupies and whether the output affects people. I set out that review in four questions for a Swiss company.

References behind the four examples

• SIX: QR-bill standards
• SIX: Swiss Payments timetable

I reviewed the four architectures on 14 August 2026. They serve as a reference, not as a template. The permissions, the limits, the approval points and the retention periods have to be defined for each process before production use.