AI agents in operations
An assistant that answers questions saves people time. An agent that does the work saves more, and can do more damage. This lesson shows how to move an operations assistant from chat to suggested tasks to automated tasks with approvals: how to set its autonomy per task, which tools and permissions to give it, how approvals and audit trails work, how to roll it out in stages, and how to measure whether it pays for itself.
By the end you can
- Tell a workflow from an agent, and set an autonomy level for each task type
- Specify an agent's tools, permissions and limits using least privilege
- Design approvals people really read, and an audit trail that answers "who did this?"
- Plan a staged rollout with gates for raising autonomy and triggers for lowering it
- Measure an agent's ROI per task type, with every cost included and a comparison group
The everyday picture
When a store hires an assistant manager, she doesn't get the keys to the safe on day one. In her first week she shadows: she says what she would do, and the manager does it. In her first month she can mark down damaged stock, but the manager signs off each one. After three months she can approve small refunds on her own, while bigger ones still need the manager. Every action she takes is in the till journal with her name, the time and the reason, and most can be reversed.
Her authority grows task by task, because her record earns it, and it can be taken back after one serious mistake. Nobody gives her "full autonomy". They give her the right to do particular things, up to particular limits, with a record. An AI agent in operations should be trusted the same way.
From chat to tasks: autonomy per task type
An agent is a model that uses tools in a loop and decides its own next step. Anthropic's 2024 guide Building effective agents draws a useful line: in a workflow, models and tools follow steps fixed in code; in an agent, the model directs its own process. The guide's advice is to find the simplest solution that works and add complexity only when needed. Many good operations "agents" are workflows with a model inside, and that is a feature: fixed steps are easier to test, explain and audit.
Ask Ops moves in three phases:
- Phase 1, chat (pm-46 to pm-49): it answers rule and status questions from procedures and live data, with read-only tools.
- Phase 2, suggested tasks: it prepares the fix and a person approves it. For a GRN stuck because the supplier's invoice says 24 cartons and the count says 22, it drafts the correction to the supplier with the evidence attached, and the manager approves in one tap.
- Phase 3, automated tasks with approvals: routine, low-risk tasks run on their own inside hard limits, and everything above the limits goes to an approval queue. A stock difference under $100 gets a recount task automatically; one over $100 is drafted for the area manager, as ST-4 requires.
Set autonomy per task type, never for "the agent" as a whole. Mangrove uses five levels:
| Level | The agent… | The person… | At Mangrove |
|---|---|---|---|
| 0 Answer | says what the procedure and data say | decides and acts | all Phase 1 questions |
| 1 Suggest | proposes a task or drafts a message | does it themselves | new task types, in shadow mode |
| 2 Act with approval | prepares the action | approves each one; the system carries it out | supplier corrections for stuck GRNs |
| 3 Act within limits | acts alone inside hard limits; every action can be undone | reviews samples after | recount tasks for differences under $100 |
| 4 Act alone | acts with no review | sees the log | not used for any task |
A 2025 paper by Kevin Feng, David McDonald and Amy Zhang describes autonomy the same way, by the role the user plays: operator, collaborator, consultant, approver and, at the top, observer, with only an emergency off-switch. Whatever names you use, the point is that each step up is earned with evidence.
Quick check
Which is the best first autonomy level for a brand-new task type, "chase a supplier when an invoice is missing 48 hours after delivery"?
A new task type has no record yet. Shadow mode builds one without risk: you learn how often the drafts match what people send. A message to a supplier is not free to get wrong, so acting alone is premature, and ruling it out forever ignores evidence you haven't collected.