What is an AI agent?
An AI agent is a language model system that decides for itself which step to take towards a goal and carries out those steps through tools. A classic chatbot only writes answers; an agent looks up a record, reads a document, calls an API, evaluates the result and keeps looping until the task is done. The approach of combining reasoning and acting in one loop was popularised by the ReAct paper, and most enterprise agents today build on it.
What makes an agent valuable is not the model itself but the tools it connects to and the controls around it. If you do not design up front which system it can reach with which permissions, which actions wait for human approval, when it must stop and how every step is logged, the agent will not be reliable in production. From Ankara, Hatson Tech provides AI agent development with these layers built in for companies across Türkiye and abroad. We cover the fundamentals in our article on AI agents.
Agent or fixed workflow?
Not every automation needs an agent. A process whose steps are known in advance runs cheaper, faster and more predictably with rules or a fixed workflow. Anthropic's guide to building agents makes the same distinction: start with the simplest solution and use an agent only where real flexibility is needed. We decide with these criteria:
| Situation | Suitable approach |
|---|---|
| The steps are the same every time and the input is structured | Rule-based automation or a fixed workflow |
| The steps are fixed but one step needs to understand text (classification, field extraction) | Workflow plus a single LLM step |
| Answers must cite documents and no action is taken | RAG assistant |
| The next step depends on the situation and several systems are involved | AI agent |
| The task has irreversible effects (payments, deletions, messages to customers) | Agent plus mandatory human approval |
We walk through the decision step by step in agent or fixed workflow, and discuss when several cooperating agents are justified in our article on multi-agent systems.
Enterprise AI agent use cases
Agents add the most value to repetitive tasks that move between several systems, where the decision depends on context and where an employee does the work by hand today:
- Email and ticket triage: reads the incoming request, classifies it, finds the related record, drafts a reply and routes it to the right team; sending happens after human approval.
- Document processing: extracts fields from invoices, orders and contracts, compares them with ERP records and flags mismatches.
- Customer support agent: goes beyond answering from documents and, within its permissions, checks order status, books appointments or starts returns.
- Data and reporting agent: turns a question in plain language into a query against authorised data sources, explains the result and shows the query.
- Internal operations and engineering agents: summarise incident logs, prepare recurring maintenance work and submit it for approval.
When the agent must ground its work in knowledge, we build RAG and semantic search as one of its tools (agentic RAG). When it needs domain-specific behaviour, LLM fine-tuning comes in.
How we build AI agents
- Discovery: we define the task with real examples. Who does this work today, with which systems and how long does it take? Which mistakes are expensive?
- Tool catalogue and permissions: we define the agent's tools narrowly and explicitly; each tool runs with only the permissions it needs. More in our article on choosing agent tools. Where it fits, we connect tools through the Model Context Protocol (MCP).
- Evaluation set: before writing code we build a test set from real cases. The agent's success is measured on it, and every change is re-tested against the same set.
- Prototype and safety layer: human approval steps, cost and step limits, action logs and rollback paths are built with the prototype, not added later.
- Pilot: the agent first runs with a small group of users and low-risk tasks, often in a suggest-only mode.
- Production and monitoring: success rate, human intervention rate, cost per task and error types are tracked on a dashboard, and the agent takes on more work gradually.
Security, control and data protection
The biggest risk with agents is that they carry out the wrong action with more permissions than they need. OWASP's risk list for LLM applications calls this "excessive agency". We build our agents on these principles:
- Least privilege: each tool can reach only the data and operations its task requires, and permission checks run on the server, not in the model.
- Human approval: actions involving money, customer communication or permanent changes do not run without approval. We describe how we design approval screens in human approval before agent actions.
- Prompt injection defence: text that arrives from documents, emails or web pages is treated as data, not as instructions. See our article on prompt injection.
- Audit trail: every step of the agent, the tool it called, its input and its result are logged, so any error can be traced afterwards.
- Data residency: if needed, the agent runs entirely on your own servers with open-weight models; see on-premise enterprise AI. If a cloud model is used, which data goes where is decided up front under KVKK and GDPR.
How we measure success
"The agent works well" is not enough. In every project we agree on the metrics and target values before the pilot:
| Metric | What it shows |
|---|---|
| Task success rate | How often the agent completes tasks correctly on the evaluation set and on real work |
| Human intervention rate | How many tasks had their approval rejected or needed correction |
| Cost per task | Model, tool and infrastructure cost, and staying within the budget limit |
| Completion time | How much faster the task is than the manual process |
| Error types | The spread of failures such as wrong tool choice, missing information or loops |
Why Hatson Tech?
Most of an agent project is software engineering rather than model work: integrations, permissions, queues, logging and monitoring. Our team combines data analysis, AI engineering and full-stack development, so the people who design the model also deliver the product around it. We share practical lessons in our article on AI agents in production.