Vertical AI agents that finish bounded B2B workflows

Build agents around a measurable job, approved business data, narrowly scoped tools, deterministic safeguards, and human escalation. The outcome is verified work inside existing systems—not another chat interface.

Test your workflow Discuss an agent

Should this workflow become an agent?

Start with the job and the risk boundary. Model choice comes later.

Strong candidate

Frequent work with a measurable current baseline
Variable documents, language, images, or context
Clear output schema and observable success condition
Accessible systems, data, and responsible process owner
Errors are detectable, correctable, and safely escalated
Enough representative cases exist for evaluation

Poor first candidate

Rare work with no stable definition of done
Process rules and ownership are still changing weekly
No trustworthy data or ground truth can be assembled
One unnoticed error can create irreversible harm
The only success metric is that output “looks good”
Automation cost exceeds the value of eligible work

Use ordinary software where rules are stable. A strong design lets the model interpret ambiguity, then hands structured data to deterministic validators and authorized APIs. Do not ask a language model to reproduce business rules that can be expressed and tested directly in code.

Three bounded vertical agent designs

These are reference scopes, not claims of universal automation. Each stops at a deliberate human or deterministic decision gate.

Dental administration

Job: Turn intake forms, referral documents, scheduling context, and practice rules into a reviewed pre-visit task pack.
Agent actions: Extract structured fields, flag missing information, suggest appointment type, draft patient follow-up, and create staff tasks.
Hard boundary: No diagnosis, treatment recommendation, clinical prioritization, or autonomous patient-record update.
Measure: Field accuracy, missing-item recall, staff correction time, false acceptance, and completed packs per hour.

Logistics invoice exceptions

Job: Compare invoices with purchase orders, rate cards, shipments, delivery evidence, and tax rules; route only unresolved exceptions.
Agent actions: Extract lines, link records, explain mismatches, request evidence, and draft an approval or dispute packet.
Hard boundary: Payment release remains behind deterministic tolerance rules and an authorized approver.
Measure: Line accuracy, match rate, false-clear rate, exception precision, handling time, and cost per invoice.

Automotive quality triage

Job: Combine inspection images, measurements, test logs, defect history, and work instructions into a traceable review case.
Agent actions: Identify suspected anomaly, retrieve relevant instructions, assemble evidence, and route to the correct quality owner.
Hard boundary: No autonomous safety release, conformity decision, or deletion of original quality evidence.
Measure: Defect recall, false-positive rate, evidence completeness, routing accuracy, review time, and escaped defects.

The model is one component, not the control plane

Production safety comes from the surrounding application: identity, state, schemas, policy, tool permissions, approvals, observability, and recovery.

Intake and identity

Authenticate the actor, classify the request, attach tenant and purpose, and reject unsupported inputs.

Trusted context

Retrieve only authorized records, preserve provenance, separate instructions from untrusted content, and minimize data.

Model reasoning

Produce structured proposals or tool requests within a bounded task—not free-form authority to act.

Policy and validation

Check schemas, business rules, authorization, thresholds, duplicate execution, and prohibited actions outside the model.

Tools and state

Expose narrow, typed, idempotent operations with least privilege, timeouts, rate limits, and complete mediation.

Approval and evidence

Route high-impact steps to a qualified person; retain inputs, versions, tool calls, outputs, decisions, and outcomes.

NIST's Generative AI Profile is voluntary guidance, not a law. It emphasizes governance, pre-deployment testing, documentation, and that some generative-AI systems warrant additional human review and oversight. NIST AI 600-1.

Evaluate the workflow, not a demo transcript

A production evaluation set represents normal cases, difficult exceptions, adversarial inputs, missing data, tool failures, and cases that must escalate. Version it alongside prompts, models, retrieval, policies, and tool schemas.

Layer	Measure	Release question
Task outcome	End-to-end completion, correct escalation, human correction, and downstream acceptance	Did the workflow produce the right verified business state?
Information quality	Field accuracy, grounded claims, citation or evidence coverage, missing-data behavior	Can a reviewer trace important output to permitted evidence?
Tool use	Correct tool, valid arguments, authorization, duplicate prevention, failure recovery	Can any model output bypass policy or create an unintended side effect?
Risk controls	Policy violations, sensitive-data exposure, prompt injection, unsafe action attempts	Do critical controls fail closed and produce actionable alerts?
Operations	Latency, availability, token and infrastructure cost, queue time, manual review load	Is the system economical and supportable at expected volume?
Change regression	Score movement across model, prompt, retrieval, policy, and integration versions	Can a release be blocked and rolled back before user harm?

Release gates

Offline evaluation, security testing, shadow traffic, limited production, and wider rollout each need explicit thresholds and rollback criteria. A global average cannot hide a critical failure class.

Current standards status

NIST's TEVV-Athlon material is an initial public draft as of this review date. It supports adaptable real-world evaluation, but should not be represented as a final standard. NIST draft overview.

Agent security starts with less agency

Treat model input and output as untrusted. Reduce what the agent can see, decide, and change before adding detection around it.

Narrow tools

Expose task-specific operations instead of shells, raw SQL, arbitrary URLs, or broad vendor SDKs.

Least privilege

Use per-user or per-tenant identity where possible; scope credentials, records, actions, time, and spend.

Independent authorization

Re-check every tool call in ordinary code and the downstream service. Never let the model grant permission.

Input separation

Mark trusted instructions, retrieved evidence, and untrusted user or document content as distinct data channels.

Output validation

Require schemas, parameter constraints, allowlists, business rules, escaping, and idempotency before execution.

Human control

Require clear review for high-impact actions and show the evidence, proposed change, uncertainty, and consequence.

Audit and response

Log model, prompt, context references, policy result, tool call, approval, outcome, and correlation ID.

Resource limits

Cap iterations, tokens, tool calls, duration, concurrency, and spend; fail safely when limits or dependencies break.

OWASP's current GenAI guidance covers risks such as prompt injection, improper output handling, sensitive-information disclosure, excessive agency, and unbounded consumption. It is community security guidance, not a compliance certification. OWASP GenAI LLM Top 10 2026.

Prove the unit economics before scaling

Count only eligible work and include the cost of review, corrections, operations, and errors. Model-token cost alone is not the cost of the system.

Monthly value model

Gross capacity valueeligible cases × minutes saved per accepted case × loaded labor cost per minute

Operating costmodel + infrastructure + retrieval + observability + human review + corrections + ongoing evaluation and maintenance

Expected monthly valuegross capacity value + measurable loss avoided − operating cost − expected error cost

Track cost per accepted task, not cost per model call. Report capacity released separately from cash savings unless staffing, outsourcing, delay, or revenue actually changes.

Delivery gates from workflow to production

Each gate produces evidence for the next investment decision. A pilot is successful when it resolves uncertainty—not when it produces an impressive scripted demo.

Frame
Define the job, baseline, eligible volume, boundary, owner, affected people, systems, risk tier, and stop conditions.
Assemble evidence
Build a representative, permissioned, versioned case set with expected outcomes and hard negative examples.
Vertical slice
Complete one end-to-end path through real interfaces with narrow tools, deterministic validation, and trace logging.
Evaluate
Measure workflow, information, tool, safety, security, latency, cost, and human-review outcomes against release thresholds.
Operate safely
Run shadow mode, then limited production with approvals, monitoring, incident ownership, rollback, and change records.
Scale deliberately
Expand cases or autonomy only when measured outcomes justify it; keep regression evaluation and unit economics current.

EU AI Act classification follows intended purpose

“Agent” is an architecture label, not a legal classification. Under the EU AI Act, classification depends on the concrete intended purpose, whether the system is a safety component or product under listed legislation, and whether it serves a use case listed in Annex III.

Document the intended purpose, provider/deployer roles, affected persons, inputs, outputs, human decision, and deployment context before deciding the obligations. Administrative assistance can differ materially from systems used for clinical, employment, credit, education, law-enforcement, or safety decisions. This is an implementation guide, not legal advice. EU AI Act Article 6 and Annex III.

Vertical AI agent FAQ

What is a vertical AI agent?

A vertical AI agent is an application designed to complete a bounded workflow in a particular industry or business function. It combines a model with approved data, narrowly scoped tools, deterministic rules, evaluation, and escalation. The useful unit is the completed and verified business task—not the conversation.

When should a workflow use an AI agent instead of conventional automation?

Use an agent when the workflow contains variable documents, language, or context that deterministic rules handle poorly, but the desired outcome and success criteria remain measurable. Prefer conventional code when inputs and rules are stable; combine both when the model interprets ambiguous inputs and deterministic services validate and execute actions.

How do you measure whether an AI agent is production-ready?

Evaluate complete tasks on a representative versioned dataset. Measure task success, field or decision accuracy, tool selection and argument validity, unsupported claims, policy violations, escalation quality, latency, cost, and human correction. Set release thresholds per risk tier and verify them again in shadow and limited-production operation.

Should an AI agent be allowed to update business systems automatically?

Only for explicitly approved, reversible, low-impact actions after independent authorization and validation. High-impact actions should require human approval or deterministic policy gates. The downstream system—not the language model—must enforce identity, permissions, limits, idempotency, and audit logging.

Does a vertical AI agent fall under the EU AI Act?

Potentially. Classification depends on intended purpose, the role of each organization, and how the system is used. Some use cases listed in Annex III or used as safety components can be high-risk under Article 6, while many administrative assistants are not. Perform the classification on the concrete deployment rather than the word agent.

Sources and status

Reviewed 2 September 2026. The EU regulation is binding law. NIST and OWASP materials are voluntary guidance; TEVV-Athlon is an initial public draft. Technical guidance and legal implementation status can change.