What counts as an AI agent here
An AI agent, for this article, is a model that does work inside a system — reads, calls tools, writes — rather than only answering a person. That is a wide definition on purpose, because the three examples sit at different points along it, and where an example sits is the most useful thing to know about it.
The difference is who decides the next step. In the draft writer, code decides almost everything — what to write about, in what order, where the links go — and the model words it. In the document agent, a decision flow decides, value by value, against a confidence threshold. The search and content agents decide the most: which of the board’s tools to call and which query to run. Each example below says what the agent does, what it may do alone, what a person confirms, and one figure published with the system it comes from. Where exactly the person stays in each is covered in human-in-the-loop AI agents; this article is about the work.
A document agent on a logistics platform
A mid-market logistics company running cross-border operations in Europe had invoices, customs paperwork, shipment documents, email attachments and internal exports arriving from 14 disconnected sources, in 5 languages — about 2,500 documents, roughly 15,000 pages, reindexed every day. It did not need a chatbot. It needed values its analysts could trust, in the ERP it already ran. The build is the enterprise AI analytics platform case study.
- What it does. Takes in PDFs, scans, structured exports and inbox attachments, classifies them, extracts values, grounds each value against client-approved reference material and routing rules through a retrieval layer, validates it, and writes validated values into the client’s ERP.
- What it may do alone. Pass on the values above its confidence threshold. Every value carries a confidence score, a source highlight and an audit trail.
- What a person confirms. The values below the threshold — about 4% of fields — in an analyst review workspace with the source highlighted, and the edge cases and exceptions before anything reaches the ERP.
- The figure. 87% less manual processing, at 99.2% field-level extraction accuracy, with a production rollout in 10 weeks. The 99.2% is what the system scores, not an improvement on the people before it: nobody measured the manual process, so no before figure exists.
- Built from. OCR, Python and FastAPI for ingestion; retrieval with embeddings and validation rules; a React review workspace with role-based access and an audit trail. One retrieval-backed answer takes 1.9 seconds on average to the last token and costs about $0.011.
- Where the same shape fits. Wherever documents arrive in many shapes and their values have to end up in a system of record. It is the system our AI document processing service is built from.
Search and content agents on a read-only board
Day-to-day search and content work for three small businesses of ours — an electronics buyback, a device repair service and a car tuning workshop, all owned by Yarvixo’s founder and left unnamed by choice — is done by AI agents. They work from one analytics board that pulls together leads without personal data, search performance, the search index, ad spend and the commit history of each site. The board is also an MCP server. The agents connect to it, never to the businesses’ CRMs.
- What they do. The jobs are four prompts the owner edits as Markdown files: a search review, an ad review, a change-impact review and a weekly digest. Within a job the agent picks its own tools — per-page search performance, search terms, the index, ad spend and cost per lead, the journal of changes — and writes its own read-only SQL when the fixed tools do not answer the question.
- What they may do alone. Read, compare two equal windows around a change, write a report and a proposal, and prepare an edit to a site as a diff in that site’s repository.
- What a person confirms. Committing, pushing and deploying, each with a separate yes. Every ad change: there is no write access to the ad accounts, so ad changes come back as ready-to-paste lists. Even the one write, a journal note, is made only after the owner agrees.
- The figure. Fourteen tools that read and one that writes. The SQL tool cannot write in four separate ways, and a query stops at five seconds and 2,000 rows.
- Built from. A hand-written MCP server on one endpoint; sign-in through OAuth 2.1 with PKCE, reachable only from the local network; a data dictionary the agents read first; and everything the board returns declared data, not instructions, because search queries, page titles and ad phrases are partly written by strangers.
- Where the same shape fits. Any business that already collects its data somewhere: a read-only server in front of it, personal data stripped before it arrives, and one write that records what changed.
The most instructive part was what agents got wrong on real data before the board went into daily use. One read a counter that started inside the comparison window as a rise of 115 against 0; another compared a partial day with full ones. Neither was malice or hallucination — an agent read a real number correctly and drew the wrong conclusion — and both were fixed in the tools. The full list is in a read-only MCP server for business data, and the same boundary as a threat model in AI agent security in practice.
A draft writer on a local model
Two of the same businesses’ blogs get their drafts from a writer that runs a small open-weights model on a mini PC on our own network. Of the three examples it decides the least for itself, and it is the closest to what an “agent” request usually turns out to need, as our AI agent development page puts it: a fixed sequence with model calls in it, cheaper than an agent and testable line by line.
- What it does. Reads the sites’ own repositories, mounted read-only, and writes a draft from the fact records code selects for the topic: a plan first, then each section in its own request.
- What it may do alone. Turn the section code chose into a topic, then write the plan and the sections. Code picks the section with the fewest articles, inserts the links and runs eleven checks that use no model; a draft that fails is saved aside and never shown to anyone. Without fact records for a topic, the writer refuses to start.
- What a person confirms. Publish or Reject, on every draft, from a card in a chat or on a private review page. The daily schedule only produces drafts.
- The figure. qwen3:4b through Ollama on an Intel N100 mini PC — four cores, about six watts, no GPU — reading at about 14 tokens a second and generating at about 2.3: about sixteen minutes an article.
- Built from. Ollama in its own container, reachable only from the writer’s internal network, and a grounding check that looks up every specification with a unit and every model designation in the allowed sources.
- Where the same shape fits. Product pages, help articles and listings: drafts grounded in your own facts, checks that count rather than judge, and a publish button in a person’s hand.
The failure worth knowing: the model would not write a single internal link in four attempts, because under our own voice rule against advertising it read a link to a service page as an ad. Code writes the links now. The whole pipeline is in a self-hosted LLM writes our blog drafts.
The three side by side
| Example | What it reads | Who picks the next step | What it changes without a person | Published figure |
|---|---|---|---|---|
| Draft writer | Fact records from the sites’ own repositories | Code: the section, the order of the plan, the links | Nothing anyone sees; it produces drafts | About sixteen minutes an article, on a 4B model |
| Document agent | Documents from 14 sources in 5 languages | A decision flow, value by value, against a confidence threshold | Values above the threshold, written into the ERP; edge cases and exceptions wait | 87% less manual processing, 99.2% field-level accuracy |
| Search and content agents | The whole board, through fourteen read tools and read-only SQL | The agent: which tool, which query | Nothing that changes a site, a lead or a campaign | Fourteen tools that read, one that writes |
Two things hold across all three. Each may read far more than it may write. And the only one that writes into a system of record by itself, the document agent, does so behind a threshold measured on a golden dataset of about 2,000 labelled documents, which is re-run on every change, and a drop below the accuracy threshold blocks the release. The other two change nothing that matters without a person’s yes. A write is the part of an agent that has to be earned, by a measurement or by a person.
AI agents for lead generation and qualification
The same three businesses run on leads: they arrive from a website, and managers answer them. That is where most of what is sold as AI lead generation and AI lead qualification would go, and the three businesses split it three ways.
Qualification stays with people, and no model sits in the lead loop. Every form posts to the site’s own endpoint, which writes the lead into the CRM before it tells the managers’ chat. Managers qualify every lead themselves — at the buyback with four buttons on the lead in the chat (in progress, bought, declined, ignore), at the repair service and the workshop in the CRM. Routing, statuses and fallbacks are plain code, so a manager can predict what a button does. When a model starts to earn a place in qualification is argued in AI automation for a small business: when leads arrive faster than people can read them, or the signal hides in long free text — and even then it should rank and summarise leads, not reject them.
Generation is where the agents work. The search and content agents read leads without personal data, how fast each was answered, cost per lead, and search terms by intent. What they bring back is a report and a proposal about the pages, queries and ads, and ad changes come back as ready-to-paste lists for a person. Nothing they can call changes a lead.
Some leads are filed by agents. The repair service publishes its lead format as an OpenAPI document, generated from the same schema that validates its form and listed in /.well-known/api-catalog, so an assistant acting for a customer can file a request without scraping a page. The workshop’s site registers a WebMCP tool, leave a lead, that agents in the browser can call. Requests that look agent-made are flagged for the repair service’s managers. Either way the lead lands in the same CRM and the same managers’ chat as a human one.
Why none of these is a chatbot
A chatbot’s work ends in a reply to a person. Each example here ends somewhere else: a value in an ERP, a report and a diff, a draft waiting for a button. None of the three talks to a customer.
That difference is what an agent costs. Once its output is an action, it needs what a chatbot can do without: tools with narrow permissions, an evaluation set, a confidence threshold with a person below it, an audit trail, writes that are safe to retry, and a cost and latency budget. Our AI agent development page lists the six, and they are most of the work.
What is not on this list
Models do other work in the same three businesses that we do not count as agents. A speech-to-text model, Whisper run locally, transcribes the workshop’s videos, and an image model draws illustrations of objects, never of people. Each produces one output for a person to use and takes no step of its own.
And we have not published a case study of an open-ended autonomous agent; nothing here implies one. All three examples are agents with a narrow tool set and a human checkpoint, which is the shape we think most production agents should start as.
Where to start, and what it costs
Usually with one workflow. One agent workflow added to a product you already run is quoted in our AI agent development work against the $15,000–$30,000 band over 2–4 weeks; a multi-agent system with evaluation tooling sits at the top of the AI product band, $40,000–$120,000 over 8–12 weeks. Running cost is per step: on the logistics platform one retrieval-backed call costs about $0.011 and takes 1.9 seconds, so an agent that makes five such calls per task starts near $0.055 and ten seconds before any optimisation. The arithmetic, and what moves a quote, is in how much AI agent development costs.