What an agent can do today, and what it still gets wrong
Where agents are reliable, where they fail, and how to tell before it costs you.
Today an agent is reliable on bounded tasks whose output can be checked by a rule or a sample: reading and classifying text, calling tools in order, drafting from a brief, filling a structured file. It is unreliable in four places: facts it supplies from memory, its own assessment of its work, long chains of steps nobody watches, and inputs that are wrong without looking wrong. The last one is the most expensive, because the agent works confidently on top of it.
Everything below comes from the agents I run for Derrick’s marketing (I co-founded Derrick) and from the systems I build for clients. The dated incidents are real.
Where agents are reliable today
| Task | Why it works | Condition |
|---|---|---|
| Classifying text (a homepage, a reply, a job title) | The answer is in the input | Force an unknown option and a quoted piece of evidence |
| Extracting fields into a schema | The format can be checked mechanically | Validate the schema, reject rows that fail |
| Calling tools in a known order | Each call returns something checkable | Log every call and its result |
| Drafting from a brief and examples | Style can be calibrated on real writing | A separate check before anything goes out |
| Summarising a large file | Less to read for the next step | Give it a digest, with secrets and personal data removed |
| Writing small scripts and queries | The code runs or fails | Run it on a known input first |
The common thread is that something outside the model can say whether the output is right. When nothing can, you are trusting the model’s word.
Where they fail, with real cases
The instrument is wrong and nobody notices
On 5 November 2026, the Head of SEO agent that runs Derrick’s SEO found that one of its own measurement exports counted only about a third of the real clicks, and a production stop had been decided on a false zero; chapter 12 tells how it was caught and what it changed.
A check that passes while the real thing fails
On 9 November 2026, a data service passed its health check while every real query failed, because the check never touched the database; the routines chapter has the details.
A rule declared, never read
A routine update modified pages declared as under an SEO test and spoiled the test, because the routine never read the declaration. Writing a rule down does nothing if the agent that should obey it does not load it.
A claim that sounds right about your own product
On 10 November 2026, a LinkedIn post said “filter, then enrich” while the product also enriched, and billed, hidden rows: the writing was fine, the fact was wrong, and no style check could have caught it (chapter 10).
Grading its own work
Ask an agent whether its draft meets the brief and it will usually say yes. That is why, at Derrick, an agent never grades its own output: a judge runs in a blank context, with only the text and the criteria.
Invented facts and hidden instructions
Two more failures are well known, and worth planning for everywhere. A model asked for a fact it does not have will produce a plausible one, so emails, company IDs and prices must come from a tool, never from memory. And text the agent reads (a web page, an email, a document) can contain instructions; it has to be treated as data, with no tools available at the step that reads it.
How to see a failure before it costs you
Each of the cases above had an early signal. The trick is to put a test on it before you scale.
| Failure | Early signal | Test to put in place |
|---|---|---|
| Wrong instrument | Two sources disagree on a total | Before combining two exports, check their totals match; confirm with an independent tool |
| Health check lies | Green status, no real output | The check runs the real path: one real query, one real write |
| Rule not applied | A protected item changed | Each routine loads the rule file at step 0, and a test tries to touch a protected item |
| False product claim | A claim describes a gesture in the product | Reproduce the gesture in the product before publishing |
| Self-grading | Every output passes | An independent judge in a blank context, plus a mechanical lint |
| Regression after an edit | Quality drifts after you change instructions | Rerun a set of frozen briefs after every change |
| Silent partial work | “Done” with fewer rows than expected | Compare rows in and rows out at every step |
| Routine that never runs | A frozen routine looks like a resting one | Run each new routine once by hand, and check it actually ran on schedule |
Two lessons I took from November 2026 shape most of this table. A second, independent instrument is worth more than a third check of the first one. And a health check has to exercise the real path, or it measures nothing.
A grid to decide how much autonomy a task gets
Before handing a task to an agent, score it. Here is a simple version; adjust the thresholds to your own tolerance.
| Criterion | 0 | 1 | 2 |
|---|---|---|---|
| Can the output be checked by a rule? | No | Partly | Yes |
| Is the action reversible? | No (sent, paid, deleted) | With effort | Yes |
| Cost of one error | A customer or money lost | Time lost | Negligible |
| Where facts come from | Model memory | Mixed | Tools and sources only |
| Volume per run | Thousands, unattended | Hundreds | Tens |
- 8 to 10: the agent can run on its own, with logs and a weekly sample.
- 5 to 7: the agent proposes, a person approves each batch.
- Below 5: keep it manual, or give the agent only the preparation.
Sending outbound emails usually scores low on reversibility and cost of error, which is why a person stays on the send button even when everything upstream is automated. Classifying a list of homepages usually scores high. The TAM guide shows that case worked through in building a TAM with AI agents.
What this means for your first agent
Start where the grid scores high, and build the checks at the same time as the agent rather than after the first incident. In practice that means three things written before the first run: what done looks like, how the output will be checked by something other than the agent, and what makes the agent stop. Chapters 10 and 12 go into the detail of quality checks and measuring the outcome.
Your next step: score the task you picked in chapter 1 with the grid above. If it lands below 5, pick another one, or cut it so that the agent only does the part that scores high.