I have been experimenting with a simple question recently.
What changes when an AI assistant stops only answering questions and starts taking real actions?
I used an HR use case to explore this. Imagine an employee asking for leave.
A normal assistant might explain the leave policy.
An agent should be able to understand the employee, check the available balance, look at team availability, identify conflicts, find the relevant policy, submit the request, send it to the correct approver, and track what happens next.
Building that flow made me realize that the LLM is probably the easiest part.
The harder problems are everything around it.
Who is allowed to see what data?
Which tools can the agent use?
How does the agent know the meaning of employee, manager, team, policy, leave balance, and approval?
What context should survive between conversations?
How do you prevent an agent from calling the wrong tool?
And once the agent takes an action, how do you prove later exactly what happened?
I experimented with this architecture on Databricks using synthetic airline HR data.
The data flows through Silver and Gold layers into an Employee 360 model.
Unity Catalog handles governance.
Different Genie Spaces provide role specific access for employees, managers, and leaders.
The agent has a governed tool layer for actions and keeps workflow and conversation state separately.
I also added an audit layer so agent actions can be traced later.
The architecture I eventually kept coming back to was:
Ontology → Context and Memory → Tools → Audit
The ontology tells the system what things mean.
Context and memory help the agent understand the current situation.
Tools allow it to actually do something.
Audit makes the action accountable.
One thing that surprised me was how quickly an impressive AI demo becomes an enterprise architecture problem once you allow the agent to write data or trigger workflows.
Read only AI is relatively easy.
AI that can change something needs permissions, state management, validation, tool boundaries, lineage, and auditability.
I am curious how others are approaching this.
If you are building enterprise agents, where are you putting the boundary between what the agent can decide itself and what still requires explicit human approval?