I have spent the last few years at EDC designing agentic AI systems for banks, government entities and large enterprises. The thing I did not expect to learn is that the distance between a demo that works and a system running in production has almost nothing to do with the model.
Walk into most large organizations right now and you will find the same picture. Every department has an AI experiment running. Marketing has something drafting copy. Finance has something reading invoices. Someone in operations has quietly wired a public API into a process that touches customer records. The demos are genuinely good, and the enthusiasm is real.
Then a meeting happens, and someone from information security asks where exactly that customer record went.
Nobody can answer. Not because anything bad happened, but because nobody built the system that would let them answer. The initiative goes quiet, and few months later it is a slide in a lessons-learned deck.
We started at the unglamorous end
When we began this work, we could have started with capability. Everyone does. It is more fun to build, it demos beautifully, and it gets you in the room.
We started with the information security and compliance question instead. Before we built an agent that could draft a letter or reconcile an invoice, we built the layer that lets an enterprise trace where a piece of data went, who authorized it, what the agent did with it and why. Data lineage. Access control at the level of the individual record. An audit trail written to be read by a person who has to explain it to a regulator, rather than by an engineer debugging a job.
That was the harder engineering problem by a wide margin. It is also the reason our conversations with compliance teams tend to end differently.
Autonomy without observability is a liability. An agent that can act across your systems but cannot show why it made a decision, cannot be constrained by policy and cannot be stopped cleanly when it drifts is a risk you have installed on purpose.
Narrow permissions, by design
Our agents do not get broad system access. They get scoped permissions that map to the same roles a person in that job would hold, and every action they take is logged, reviewable and reversible.
I describe them to clients as extremely capable and extremely paranoid temporary staff. They handle ambiguity. They check in at decision points. They deal with exceptions on their own until an exception starts to look like it might touch policy, and then they stop and escalate with the full context attached.
This is a less impressive demo. It is the version a bank can actually turn on.
In this region, the question is sharper
Everything above applies anywhere. In the UAE it arrives earlier in the conversation and with more weight behind it.
A bank here operates under Central Bank oversight. A government entity operates under its emirate's data policy. For a lot of the organizations we work with, the answer to where the data sits has to be inside the country, and the answer to who can reach it has to hold up in an audit rather than in a vendor's marketing page.
That constraint is not a burden on the design. It is the design. Once you have committed to knowing where every piece of data went, hosting it in a defined jurisdiction is a configuration question rather than a re-architecture. The organizations that skipped that step are the ones now discovering their pilot cannot be deployed in the environment it was always meant for.
Enterprises are not greenfield
There is a version of this technology sold as though it plugs into a clean set of APIs. That is not what most environments look like, and the gap is not anyone's fault. It is what twenty years of building a working business produces.
You will find a core system nobody has upgraded because it has never once failed. A process that officially runs on an API and actually runs on a shared mailbox. And somewhere in finance, an Excel file that half the team treats as a system of record, because for their purposes it is one.
An agent that only works in the idealized version of your organization does not work in your organization. Meeting the environment where it actually is takes longer than anyone budgets for, and it is most of the job.
The part that takes the boring months
The enterprises I see getting this right treat agentic AI as infrastructure before they treat it as capability. They spend the unglamorous months first: mapping where data actually flows, writing down policy limits that until now lived in people's judgement, building the observability layer that tells them what the agent did while nobody was watching.
It looks slow. It is the only version that survives contact with a compliance review.
The ones who go the other way are not being careless. Most of them have been burned before by automation that was sold as set and forget, and they know that in a regulated environment the cost of getting it wrong is not a bug ticket. It is a phone call from the regulator, and then a headline.
Which is why I have stopped talking about how much freedom we can give these systems. The interesting question is how much supervision an agent can be trusted to work without, and what you had to build first to earn that answer.
Everything else is a demo.
