Why the guardrails are the expensive part of an AI agent

A demonstration of an AI agent is genuinely quick to produce. Point a capable model at a contract, ask for the special conditions and key dates, and you will have something impressive inside an afternoon. This is a real capability and it is worth being impressed by.

It is also the cheap half. Everything that decides whether that afternoon becomes something you can run unattended against real client work sits around the model rather than inside it, and that is where the budget goes.

What actually sits around the model

The gap between a good demo and a production agent is a specific list. None of it is glamorous and all of it has to exist.

• A confidence threshold, with a defensible basis for where it was set rather than a number someone liked.
• A routing rule for what happens below that threshold, and a queue that a real person actually watches.
• Enough context travelling with an escalated case that a person can resolve it in minutes rather than starting again.
• A decision log recording inputs and reasoning, in a form that satisfies an auditor rather than a colleague.
• An evaluation set of real cases with correct answers agreed by the people who know what correct looks like.
• Failure handling for the systems around it: an API that times out, a credential that rotates, a document format that changes.
• A correction loop, so that what a person fixes this month improves the system next month rather than being lost.

Read that list and the shape of the problem becomes obvious. Building it is not research. It is careful, unremarkable engineering, and there is a lot of it.

Why bespoke agents struggle to survive their own economics

Here is the awkward arithmetic. The list above costs roughly the same to build well whether the agent serves one client or fifty. The domain knowledge is what varies. The safety rails barely do.

So a bespoke agent built from first principles for a single organisation has to carry the full cost of guardrails, evaluation, audit logging and failure handling on a budget sized for one organisation's problem. In most cases that budget was never going to carry it.

What happens next is predictable, and it is not dishonesty. It is pressure. The evaluation set is descoped because it takes time and produces no visible feature. The audit log becomes an application log. The confidence threshold becomes a number somebody picked. The correction loop becomes a spreadsheet somebody promises to review. The demo still works, so the project still looks healthy, and the thing that was skipped only becomes visible the first time the agent is confidently wrong about something that matters.

Almost every agent is a variation on a small number of shapes

The way out of that arithmetic comes from an observation we did not expect to hold as strongly as it does. Across the industries we have mapped, nearly every agent worth building turns out to be a variation on a handful of shapes.

1. 01Document intelligence. Ingest, classify, extract and validate whatever actually arrives, with the exceptions flagged rather than buried.
2. 02Monitor, draft, approve. Watch a system of record for a trigger, draft what it warrants, and hold it in a queue until a person decides to send it.
3. 03Conversational enquiry. Answer the repetitive majority of inbound questions from a grounded knowledge base, then capture, book or escalate rather than improvise.
4. 04Compliance mapping. Read a regulatory corpus against an organisation's own documents and produce a cited gap analysis, traceable to the clause it came from.
5. 05Chase and checklist. Hold the outstanding-items list for a job, request what is missing, verify what arrives, follow up on a cadence and escalate anything threatening a date.

A contract review assistant for a conveyancer and a due diligence pack for a buyers agent look like different products to the people buying them. Structurally they are the same shape with different domain knowledge and different systems on either end.

Naming the shapes is not an abstraction exercise. It is the reason a modest engagement can still ship with evaluation, approval gates and audit logging attached, because that engineering was done once, properly, rather than being quoted again and then quietly cut.

The questions to ask before you buy one

Whoever is proposing an agent, including us, should be able to answer these without preparation. The answers separate a demonstration from a system.

1. 01What happens on the cases it gets wrong, and where do those cases go?
2. 02How was the confidence threshold set, and what does it cost us when it is crossed incorrectly in each direction?
3. 03What is in the evaluation set, who agreed the correct answers, and can we see the score?
4. 04What is recorded about each decision, and would it satisfy an external reviewer rather than an internal one?
5. 05When a person corrects the output, what happens to that correction?
6. 06What does it do when a system it depends on is down or a format changes?

Vague answers to those questions do not mean the technology will not work. They mean the expensive half has not been built yet, and you are being quoted for the afternoon.

The judgement stays with a person

One thing worth being explicit about, because it is where trust in these systems is won or lost. The point of the guardrails is not to make the agent autonomous. It is to make the boundary of its autonomy legible.

A practitioner reviewing a two-page structured brief instead of skim-reading a ninety-page bundle is doing the same professional job with better preparation. The legal, clinical or financial judgement stays entirely with them. What has been removed is the reading, the re-keying and the chasing, which is the part nobody was paying them for anyway.

The short version

The model is the easy half. Thresholds, routing, evaluation, audit logging, failure handling and the correction loop are the half that decides whether an agent survives contact with real work, and they cost roughly the same for one client as for fifty. Build the shape once, harden it properly, and spend the engagement money on integration and domain detail. Then ask anyone selling you an agent what happens on the cases it gets wrong.