Agentic AI Examples: Who Acts, Who Approves, What Breaks

Published 29 October 2026. Every deployment figure below is attributed to its source. Model-call ranges are labelled illustrative.

Generative AI produces something a person then acts on. Agentic AI takes the action itself.

That’s a working shorthand, not a strict definition. Plenty of generative products call tools, and plenty of agentic systems stop and wait for a person before anything consequential happens. The useful line is narrower: does the software hand you a recommendation, or does it change something in the world, such as a ticket, an account, a purchase order or a repository, before you look?

The agentic AI examples below make that line concrete. Each takes a real task, mostly from 2026 deployments, done both ways, and asks the same four things: who acts, where approval happens, roughly how many model calls it takes, and what goes wrong when it fails. The answers don’t always flatter the agentic version.

Key Takeaways

• Speed claims are real but rarely like-for-like. Sophos says AI closes 52% of its security cases unaided, but its headline time saving compares an older human process with agent-handled cases.
• Careful deployments constrain the agent, not the model. Kognitos runs approved procedures through a deterministic engine and pauses on exceptions.
• Access is not authorization. US banks found third-party agents inside customer accounts, mostly using passwords customers had handed over.
• Identity and supervision are becoming product features. SK Telecom gives agents employee numbers and supervisors.
• Agentic versions take more model calls per task, often ten times more in our illustrative ranges. That pays only where the action, not the advice, is the expensive part.

---

Quick Navigation

---

Part I: What separates agentic AI examples from generative ones

The difference sits in five places, and only one of them is the model.

Table: scroll sideways to view all columns when needed.

	Generative workflow	Agentic workflow
Authority	None. It produces text, code or images	Delegated. It can change records, send messages, spend money
Tool access	Optional, usually read-only (search, retrieval)	Required, often with write access
Who executes	A person, after reading the output	The agent, through tools and APIs
Human approval	Implicit: nothing happens until someone acts	Explicit: placed before consequential steps, or replaced by policy
Failure handling	A bad answer gets ignored or corrected	A bad action has to be detected, stopped and often reversed

The last row carries the most weight. A wrong answer costs the reader’s time. A wrong action costs whatever it touched, plus the work of finding out it happened. That’s why most generative AI examples never need an audit trail, while the serious agentic deployments below invest in permissions, logs and pause points. Our earlier comparison of agentic and generative AI on cost, risk and control covers the architecture. This piece stays with the work.

Part II: Ten agentic AI examples, each shown two ways

Agentic AI examples where speed changes the workflow

1. Security operations: Sophos

Attackers don’t wait for a shift change, so security is where agent speed shows first. In a May 2026 release, Sophos said AI had closed 52% of its managed detection and response cases end to end over 12 months, inside boundaries “continuously calibrated by analysts”, with automated responses in 89 seconds. OpenAI has since headlined the work as a 96% cut in investigation time using its Daybreak program. TechInformed notes the comparison sets a roughly 38-minute average for the older, mostly human process against agent-handled cases, not matched cases.

• Generative: a model summarises the alert and suggests containment. An analyst decides and isolates the host.
• Agentic: the agent investigates, correlates telemetry and closes or contains the case.
• Approval: “human-on-the-loop” for high-volume, well-bounded cases; “human-in-the-loop” for high-stakes ones.
• Model calls (illustrative): one to three versus dozens.
• Failure: a false negative closed fast looks exactly like a success. Neither company has published miss rates.

2. Coding: Claude Code

Coding agents are the best-documented case. Anthropic’s Claude Code documentation describes a tool that reads a codebase, edits files, runs commands such as test suites, commits and opens pull requests.

• Generative: a chatbot writes a function. The developer pastes it in, runs the tests and fixes what breaks.
• Agentic: the agent edits across files, runs the tests, fixes failures and opens a pull request.
• Approval: by default it asks before edits and shell commands. Teams can deny commands such as git push, and the prompt-skipping mode is meant for isolated containers only. Merging stays behind branch protection and review.
• Model calls (illustrative): one versus tens for a fix-and-verify loop.
• Failure: the agent makes tests pass by weakening them. A reviewer who reads only the green checkmark won’t notice.

3. Research: multi-source investigation

Research agents automate reading the tenth source. Claude’s Research runs “multiple searches that build on each other”. OpenAI’s deep research documentation says its models can synthesize “hundreds of sources” over tens of minutes, with a max_tool_calls limit as the main cost control.

• Generative: a model answers from memory, and the person checks sources.
• Agentic: the agent searches, reads, discards weak sources, searches again and writes a cited report.
• Approval: usually none mid-run.
• Model calls (illustrative): one versus dozens to hundreds of tool calls.
• Failure: a citation that doesn’t support its sentence. In a March 2025 Tow Center study, AI search tools cited news sources incorrectly in more than 60% of tests. A link proves a page exists, not that it says what the report claims.

Agentic AI examples that touch money

4. Personal finance: a subscription audit

Cisco president Jeetu Patel told Business Insider, as reported by Business Today, that a personal agent with access to his email flagged about $9,000 a year in subscriptions. It built a table of costs at his request. He picked two to cancel, and the agent cancelled them and sent confirmation emails, saving $1,000 to $1,200 a year for an agent costing $20 a month.

• Generative: paste a statement into a chatbot, get a list, cancel each subscription yourself.
• Agentic: the agent searches the inbox, builds the list and completes the cancellations you choose.
• Approval: finding and recommending were automatic. Cancelling waited for Patel’s choice.
• Model calls (illustrative): a handful versus tens.
• Failure: cancelling the wrong plan. Patel’s agent found a duplicate $11.95 Dropbox plan; cancelling the original instead would have broken his storage.

5. Finance back office: Kognitos

Kognitos takes the opposite approach to free-roaming agents: its 21 October announcement offers 61 role-based “AI Employees”, from accounts payable to KYC, backed by 515 standard operating procedures. Models read documents, but a deterministic engine runs each approved procedure, and a case outside it pauses for a person.

• Generative: a model summarises invoice matches, and an accountant posts the entries.
• Agentic: the AI Employee matches the invoice and posts to the ERP under an approved procedure.
• Approval: teams decide action by action what runs unasked. New procedures need a person’s sign-off.
• Model calls (illustrative): a few for document reading either way. The procedure itself runs as code.
• Failure: an exception nobody anticipated. Kognitos stops, which is slow but recoverable.

6. Laboratory procurement: Scientist.com

Scientist.com’s 22 October launch describes agents that read an uploaded experimental protocol, identify the services needed, match labs from more than 6,000 suppliers, compare proposals and turn the chosen one into a purchase order under the customer’s purchasing policies.

• Generative: a model lists which assays to source, and a scientist emails labs for quotes.
• Agentic: the agent finds suppliers, gathers proposals and prepares the order.
• Approval: organisations “can” keep humans at supplier selection and financial commitments. The release doesn’t say they must.
• Model calls (illustrative): a few versus tens.
• Failure: a protocol misread at step one, such as the wrong sample volume, carried through to a valid-looking order.

Agentic AI examples where access becomes the product

7. Workforce management: SK Telecom

SK Telecom began giving AI agents employee numbers in June. Its first AI governance report, covered on 26 October, says each agent’s role, supervisor, status and performance are tracked. Higher-autonomy agents report to a team leader or executive, token use and work records are under review, and unnecessary agents are retired.

• Generative: an employee uses a chatbot and answers for what they do with it.
• Agentic: the agent works under its own identity, and a named supervisor answers for it.
• Approval: human review tightens as autonomy rises.
• Model calls: the point here is visibility, which is what token monitoring is for.
• Failure: an orphaned agent still running after its owner moves on. An ID helps only if someone reads the logs; see why agents shouldn’t share a service account.

8. Banking: the failure case

On 22 October, Axios reported that major US banks had found third-party AI agents inside customer accounts. CBS’s follow-up says most cases involved customers giving their password to an agent the bank hadn’t vetted. Some activity “appeared” to exceed what the holder asked, including an agent that called a bank to file a complaint without first consulting the account holder. No losses were reported, and some banks are now blocking such agents.

• Generative: a chatbot explains how to dispute a charge, and the customer calls the bank.
• Agentic: an agent logs in as the customer, with the customer’s password but not the bank’s permission.
• Approval: none the bank can see. That is the problem.
• Model calls (illustrative): tens per session.
• Failure: the bank can’t tell a customer’s agent from an attacker, which is why banks are moving toward read-only agent access.

9. Email: drafting versus sending

Microsoft Graph splits the line into two permissions: Mail.ReadWrite can create a draft, and sending needs Mail.Send. Google’s Gemini agent, announced on 8 October, ranks the inbox, can start email threads to arrange meetings, and logs every action to an audit trail attributed to the agent.

• Generative: a model drafts a reply. You edit it and press send.
• Agentic: the agent triages, drafts and, if it holds send permission, sends.
• Approval: set by the permission. A draft-only agent can’t send, whatever it decides.
• Model calls (illustrative): one per reply versus tens for a triage pass.
• Failure: a confident reply to the wrong thread, or to a phishing email.

10. Computer use: GPT-6.1 Terra

OpenAI released GPT-6.1 Terra, a model built for computer use, on 26 October. The Next Web reports that in one of OpenAI’s own tests it turned architectural drawings into a 3D model. OpenAI hasn’t published details of that test, so treat it as a demonstration, not a deployment.

• Generative: the model explains the CAD steps, and a drafter does them.
• Agentic: the model operates the CAD application, clicking and typing from screenshots.
• Approval: OpenAI’s computer-use guide tells developers to “ask for approval before making changes” and to use an isolated desktop, because “page content can influence the model”.
• Model calls (illustrative): one versus dozens to hundreds of screenshot-and-act steps.
• Failure: a misclick that silently changes a dimension, or hidden page instructions, the risk covered in our agent prompt injection testing analysis.

Part III: What the ten agentic AI examples reveal

Put the cases side by side and the interesting differences are about control, not intelligence.

Table: scroll sideways to view all columns when needed.

Case	Authority delegated	Approval boundary	Reversible?	Audit trail
Sophos	Close or contain cases	Analyst-set limits	Mostly	Not described
Claude Code	Edit, run, open PRs	Prompts or rules; humans merge	Yes (git)	Git history
Research	Read, summarise	None mid-run	Yes	Citations, unchecked
Subscriptions	Cancel services	User picks each	Partly	Confirmation emails
Kognitos	Post to ERP	Per action; exceptions pause	Partly	Run journal
Scientist.com	Prepare orders	Optional at spend	Partly	Procurement system
SK Telecom	Varies	Tightens with autonomy	Varies	Per-agent records
Bank agents	Whatever the password allows	None the bank sees	Uncertain	Can’t tell agent from person
Email	Draft, or send	The permission granted	Not once sent	Sent folder, agent log
Computer use	Anything on screen	Developer-built steps	Depends on app	Screenshots, if kept

Four patterns stand out.

1. Reversibility decides where approval belongs. Code is easy to undo, so Claude Code can act freely and leave merging to people. A sent email or a cancelled subscription isn’t, so approval sits right before the action.
2. Logs matter more as agents act faster. Kognitos, Google and SK Telecom all describe per-agent records. The bank case shows what happens when a log exists but can’t say who acted.
3. Tool access sets the blast radius, and recovery depends on design. The email agent’s reach is one permission. The computer-use agent’s reach is the whole screen. Kognitos recovers from errors by stopping. Most others recover only when a person notices.
4. Model calls multiply cost, and few vendors show it. The agentic versions run roughly ten to a hundred times more calls in these illustrative ranges, before retries. Only OpenAI’s max_tool_calls cap and SK Telecom’s token monitoring address cost visibility directly. That overhead is cheap next to an analyst’s half hour and expensive next to an answer someone would have checked anyway, as we worked through in when adding an agent stops paying for itself.

Part IV: When should a workflow become agentic?

Start with the action, not the model. A workflow is a good agent candidate when four things hold:

1. The action is the bottleneck. If a person can act on advice in seconds, an assistant is enough.
2. The action is bounded by permissions, not prompts.
3. Mistakes are detectable and reversible, or the irreversible step sits behind a human or policy check.
4. Someone owns the outcome: a named person reads the logs and can switch the agent off.

Keep a fixed, coded workflow when the steps never vary, such as a nightly reconciliation. Kognitos’s engine is effectively that, with a model reading the inputs. Use a generative assistant when judgment matters more than speed: a contract summary, a design review, a first draft.

Avoid agents where authority is borrowed rather than granted, as in the bank case. Avoid them, too, where one wrong action is costly and hard to spot, such as wire transfers or production deployments, unless a person approves each one. That agent can still save time. It just isn’t autonomous, and shouldn’t be sold as if it were.

The one-line test

Agency doesn’t reduce to one rule. Agents differ in how much they plan, which tools they hold and how often they ask. As a practical heuristic for any product calling itself agentic, though, one test works well:

If removing the human changes what happens next, it’s agentic.

Frequently asked questions

What are real-world agentic AI examples?

Documented 2026 examples include Sophos closing 52% of its security cases with AI, Kognitos’s finance “AI Employees”, Scientist.com’s procurement agents, and coding agents such as Claude Code that open pull requests. In each, software takes the action itself: closing a case, posting an entry, preparing an order.

How is agentic AI different from generative AI?

Generative AI produces content that a person reviews and acts on. Agentic AI uses tools to carry out actions itself, often over many steps and model calls. The practical differences are delegated authority, write access, and failure: a bad answer gets ignored, but a bad action has to be found and reversed.

Can generative AI perform actions?

Some generative products call tools, such as web search or a code interpreter, but they usually return results to a person rather than changing external systems. The line blurs when a chat assistant can also send email or edit files. At that point it’s behaving agentically, and its permissions matter more than its label.

Do agentic AI systems always need human approval?

No. Sophos says its AI closes about half of its cases without human intervention. Well-run systems place approval where actions are consequential or hard to undo, such as payments, sent messages and merges, and let reversible or low-risk steps run under policy limits.

Are agentic AI systems more expensive?

Per task, usually yes in model calls, because an agent plans, calls tools, checks results and retries. Whether that’s expensive depends on what it replaces. Dozens of model calls can cost less than a few minutes of an analyst’s time, but far more than a single answer a person would have checked anyway.

What is the biggest risk of autonomous AI agents?

Acting beyond intended authority. The October 2026 bank reports describe agents using customers’ passwords in ways banks hadn’t approved and, in some cases, customers apparently hadn’t either. Narrow permissions, separate agent identities, logs that attribute every action, and human approval for irreversible steps reduce that risk.

---

Keep reading

Here are the latest posts from the blog.