What you should never hand an agent, and why

Do not hand an agent anything that is expensive to undo. That is the whole rule: judge every automation candidate on reversibility and blast radius, not on whether the agent is capable of doing it.

Almost every piece of agentic advice answers a different question. It lists what agents are good at: qualifying a lead, drafting a sequence, summarising a call, flagging a stale deal. That list is useful and it is also the easy half of the decision. The harder half, and the one that actually protects a revenue engine, is the negative space: what you deliberately keep out of an agent's hands, and why.

Why capability is the wrong test

The instinct is to ask whether an agent can do a task well. That is the wrong question, because most agents can now draft a passable email, propose a discount, or update a CRM field. Competence is no longer the constraint. We defined the underlying shift in what agentic revenue actually means, and the same shift is what makes this question urgent: agents that used to need supervision for every step now clear that bar by default.

The right question is what happens when the agent is wrong, and who absorbs it. A drafted email that is wrong costs a rewrite. A sent email that is wrong costs a relationship. Both are within an agent's technical reach. Only one belongs there without a human in front of it.

The two variables that actually matter

Two variables decide whether a task is safe to hand over: reversibility and blast radius. Reversibility is whether the action can be undone before anyone outside the system notices. Blast radius is how many people, records or pounds are touched if it cannot.

A task with high reversibility and a small blast radius is a default yes. A task that is hard to reverse and touches a named account, a signed number or a compliance boundary is a default no, whatever the agent's measured accuracy on that task happens to be.

Five things to keep out of an agent's hands

In practice, five categories fail the test consistently enough that we treat them as a standing rule rather than a case by case judgement.

• Pricing and discount commitments. A quoted number is a promise. Once a prospect has it, walking it back costs more trust than holding the line would have.
• Anything that touches a signed contract. Terms, renewal dates and cancellation clauses are legal facts, not draft text an agent can iterate on after the fact.
• Deleting or merging CRM records. A bad merge silently destroys history that nobody notices is gone until the forecast stops adding up.
• The first outbound touch to a named, senior contact at a strategic account. The blast radius of a wrong tone or a wrong fact here is the relationship itself, not a single email.
• Anything that needs a legal, security or compliance sign-off. If a human would need to check a policy before acting, an agent skipping that step is not saving time, it is hiding the step.

Every one of these is a task an agent can technically perform. None of them are reversible in the way that matters, and all of them have a blast radius bigger than the task itself.

What agents are genuinely good at

The other side of this rule deserves equal billing, because a framework that only says no is not useful. Agents are very good at anything with high reversibility and a contained blast radius: drafting the first version of an email a human sends, enriching and scoring a lead against a defined rule set, flagging a deal that has gone quiet, summarising a call into structured notes, or updating a field with a value a human can spot check in seconds.

These are also the tasks that make up most of the volume in a revenue engine. The rule is not a brake on automation. It is a filter that puts the volume where it belongs and keeps the handful of high stakes moments in front of a person.

We have set this up before as a practical staffing question rather than a technology one in how an agent fits inside a real team. The teams that get this right treat the rule above as a job description: an agent owns the reversible, contained half of a role, and a person owns the rest.

Build the gate into the system, not the prompt

The rule only holds if it lives somewhere the agent cannot reason its way around. An instruction inside a prompt, telling the agent to ask before doing something risky, is a suggestion the model can talk itself out of under the right framing. A gate enforced by the workflow around the model, one that structurally withholds the send button, the delete permission or the contract field until a human clicks approve, cannot be argued with.

This is the same conclusion OWASP's GenAI Security Project reaches from the security side. Its 2026 Top 10 for Agentic Applications lists identity and privilege abuse and human-agent trust exploitation among the highest ranked risks in autonomous systems, which is another way of saying that a system which trusts the agent's own judgement about its limits has already lost the argument. Scope the credentials, not the prompt.

Why so many agentic pilots get cancelled anyway

Gartner said in a 25 June 2025 press release that over 40% of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls as the main causes. Inadequate risk controls is the relevant one here.

A pilot that hands over an irreversible, high blast radius task and gets burned once rarely gets a second chance internally, whatever the underlying model was capable of. The projects that survive are usually the ones that scoped the agent's authority narrowly from the start, not the ones with the most capable model.

We have written before about the control room problem this creates once agents are running inside the team, and about why CRMs become graveyards when nobody owns what gets written to them. Both are downstream of the same mistake: authority handed out by capability rather than by consequence, and both make it harder to produce a forecast you can actually defend once the underlying records cannot be trusted.

None of this requires knowing how good the model is. That is what makes it a durable rule rather than a moving target every time a new model ships.

The question that matters is never whether an agent can do it. It is what you are willing to lose if it does it wrong.