Use an AI agent for recurring work where a wrong result is easy to spot and cheap to undo, and nobody's name is on the action. Keep a person on any job with a deadline the agent cannot see, anything that goes out in an owner's name, and any document the reviewer will want to change rather than approve.
We run VantaSoft on a team of AI agents, and since August we have taken five jobs back from them. None of the five was a disaster. In three of them the agent did exactly what it was told, and in the other two it read a general go-ahead as permission for something specific. Either way, the job turned out to belong somewhere else: with a person, with the customer, or nowhere. Here is each one, what it cost, and the question it taught us to ask before the next one.
Which jobs did we take back from our AI agents?
| The job | Why it came back | Where it ended up |
|---|---|---|
| Handing a customer a sign-in link for their accounting software | The link expired before the customer opened it, and nothing told anyone | The customer connects the app themselves, on the provider's own screen |
| Inviting people to follow our company page from the CEO's own account | It acted in his name without his say on each run | Stopped. Anything in his name waits for his approval |
| Assembling the customer agreement as a finished PDF | Every change the reviewer wanted meant a round trip to the agent | The agent fills a copy of a document a person edits and sends |
| A monthly report on what our agents did | Nobody had asked for it | Deleted |
| A picture on every article | A finished article sat a week in draft for want of a decorative picture | No picture unless it shows the reader something real |
Job one: handing a customer a sign-in link
Until late August, when a customer wanted their agent connected to their accounting software, they could ask the agent for a sign-in link and it would hand one over. That link was only good for ten minutes once it was made. The agent knew that. The customer did not, and the agent had no way to tell whether anyone had clicked.
On August 28 a customer asked for a link in the evening and opened it about two hours later. They tried five times, and the sign-in page rejected every attempt as expired. By the time the connection worked, the delay had cost that customer four days.
Our CEO changed the rule that day: a person on our team produces the link, one of the owners sends it, and the customer only clicks. The agent's ability to hand out links was removed, rather than left as something it had been told not to do.
That arrangement lasted eleven days, because the real fix was to get rid of the link. Since September 8, a new customer connects each app themselves, on the provider's own approval screen, where they see exactly what is being asked for and can decline it. Nothing is handed around with a clock running on it. The connection service we use then holds the login in an account set up for that business alone, which is the same answer we give in our guide to connecting an agent to your systems.
The lesson is about deadlines the agent cannot see. A job is a poor fit for an agent when its success depends on a person acting within a window, and the agent has no way to know whether they did. Give that job to a person until you can redesign it so the window does not exist.
Job two: anything sent in the owner's name
People who react to or comment on a company's posts on LinkedIn are the easiest people to turn into followers. LinkedIn's free invitations go only to the sender's own 1st-degree connections, so the job had to run from a person's account, and each invitation carries that person's name. On October 16 we ran it inside our CEO's own LinkedIn account: read the last 30 days of people who had engaged with his posts and ours, skip the ones who already followed, and invite the rest. The first run found 40 people and invited 10 of them in his name.
He stopped it the same afternoon. His rule: any automation that acts inside his personal account needs his approval before it runs, every time, whoever asked for the work. The ten invitations stay sent. None have gone out since.
Nine days earlier the same lesson had arrived in a smaller form. One of our articles was republished on a developer community site under his account, on the strength of a general go-ahead for the plan. It went back to a draft, and he set the rule that each republished article needs his approval of that specific piece.
In both cases the agent did the work competently. What it got wrong was whose name was on the action. An invitation or a byline sent as a particular person is that person's to spend, and no standing instruction covers it. If you give an agent anything that goes out as you, decide now that every send waits for you.
Job three: writing up the customer agreement
On August 13 one of our agents built a small program that assembled our service agreement as a finished PDF from the customer's details. It worked, and we threw it away the same day.
The problem showed up on the first review. Every change the reviewer wanted, a sentence here, a line moved there, meant asking the agent to change the program, regenerate the document and read the whole thing again. A document the reviewer can edit directly is faster than a program that produces a perfect one.
So the agent now makes a copy of a template document, fills in the customer's details, and hands it over. A person edits it in place if anything needs changing, reviews the rendered document exactly as the signer will see it, and sends it for signature. That review step was set the next day, August 14, and there is no path where an agent sends an agreement on its own. The trade we accepted is that the document looks plainer than the generated one did.
The question this taught us is whether the reviewer will want to change the output or only approve it. If they will change it, the agent should do the filling and leave the result in a form a person can edit without asking anyone.
Job four: a report nobody asked for
On October 20 our CEO asked how we could get more websites to link to ours. Within the afternoon our marketing agent had started three pieces of work he had not asked for. One was a public page tracking the published prices of AI models. One was an AI readiness quiz for our website. One was a monthly report on what our agents had done that month, built from our own task records, with a chart, drafted and sent to him for approval.
He kept the price page, which was already live and useful. He stopped the quiz before it shipped. The report he had deleted, and it does not come back unless an owner asks for it.
The agent had done nothing it was told not to do. It had been given a goal and had generated work toward it, which is what these tools do when the goal is open ended. The cost was an afternoon of agent work and, more expensive, an owner's attention spent reviewing something he never wanted.
The question here is the plainest of the five: did anyone ask for this? An agent will propose work on its own, and that is useful. Starting it is a different matter. Our default now is that a new initiative is a proposal until an owner says yes, and the owners see what the agents are starting, not only what they finish.
Job five: a picture on every article
From August to early October every article on this blog got an AI-generated header image. The job had real machinery behind it: a review step that scored each candidate on five criteria, a cap of five failed candidates per article, and a rule against repeating recent concepts. On August 20 a finished article about what an AI agent costs hit that cap. Six candidates across two concepts, and none passed, mostly on hands melting into a workbench and labels the model invented. The article itself was ready. The job's own rule, no picture, no release, held it in draft for a week, until our CEO picked an image himself on August 26 and it went out the next day.
On October 5 he set the rule that still stands. Posts carry no image by default. One appears only when it shows the reader something real, such as a diagram of a workflow, a chart of actual data, or a screenshot of a real tool.
What this one taught us is that automating a job can reveal the job was never worth doing. A person asked to make six attempts at a decorative picture would have stopped and said so. The agent kept going because the job was on its list and it had no standing to question the list, and then it held a finished article hostage to a rule about decoration.
So the fifth question is this: if a person did this job, would you still pay for it? If the honest answer is no, the agent should not be doing it either.
When should a person keep the job?
The five questions below are the test we now run before an agent gets a job. A yes on any of them means a person keeps the job, or the job gets redesigned first.
| Ask | If yes | What we did |
|---|---|---|
| Does success depend on someone acting inside a window the agent cannot see? | A person runs it, or you remove the window | Removed the expiring link entirely |
| Does the action go out in a named person's name? | That person approves every instance | Every run in the CEO's account waits for him |
| Will the reviewer want to change the output rather than approve it? | The agent fills, a person edits and sends | Template document in place of a generated PDF |
| Did an owner ask for this job? | If not, it is a proposal until they do | Report deleted, quiz stopped, price page kept |
| If a person did it, would you still pay for it? | If not, stop the job | No picture by default |
This test sits alongside the one in what AI agents can do on their own, which asks whether a job can finish without anyone watching. That test is about the job's shape. This one is about who the job belongs to. A job can pass the first and still fail the second, which is what happened with the invitations.
What does this mean if you are buying an AI agent?
Ask the vendor which jobs they have taken back from their own agents, and why. A vendor that runs agents on its own business will have a list. A vendor with no list has either not run them for long or is not telling you.
Then ask three things about your own setup. Where does the approval sit for anything that goes out in your name, and is it a setting or a rule? How does your team connect its own apps, and is anything with an expiry being passed around by hand? What is the agent allowed to start on its own, as opposed to propose?
Our own answers are the ones above. We wrote up the five failures that taught us the most separately, and how we decide which actions need a person's approval is its own article. The catalog of what our agents handle day to day is in 13 real agents and the jobs they do.
Frequently asked questions
What tasks can an AI agent handle without a person?
Reading, gathering, comparing, sorting, summarizing and drafting, on a schedule, inside the tools you already use. Our agents read calendars, prepare morning briefs, draft replies and keep the books current. What waits for a person is anything that leaves the building: a send, a payment, a post, a signature, or a change to who has access.
How are companies actually using AI agents?
We can only speak for ourselves. Our agents handle the inbox and calendar, bookkeeping reads, sales follow-up drafts, proposal drafting, content research and publishing, engineering changes behind automatic checks, and testing. Each has one job and one person who hears when it breaks. The full list, with who approves what, is in AI agent examples.
When should you not use an AI agent?
When the job depends on someone acting inside a window the agent cannot see, when the action goes out in a specific person's name, when the reviewer will want to change the result rather than approve it, when nobody asked for the job, or when you would not pay a person to do it. Each of those came from a real job we took back.
Does taking a job back mean the agent failed?
Usually not. In three of our five cases the agent did exactly what it was told, and in the other two it mistook a general yes for a specific one. The job was wrongly assigned, or had a hidden dependency on a person, or should not have existed. Taking it back is a normal part of running agents, in the same way that reassigning work is a normal part of running a team.
Who should approve what an AI agent sends?
The person whose name is on it. For a company account, the person accountable for that account. The approval should be a step the agent cannot skip rather than an instruction it was given, because an instruction can be misread and a locked step cannot.
Where to start
If you are deciding which job to hand an agent first, start with one that passes all five questions above and the six-point test for running unattended. Most businesses have several: a morning summary, a weekly report, a draft of every follow-up that is waiting on someone. We build and run that first agent for you and stay on to maintain it, and the work starts with 30 minutes on your workflows. Start automating.
