Applied AI / Capability
AI agents.
Agents that work through a multi-step task with your tools, inside limits you set, with a person approving what matters.
Describe the task
When to bring us in
Sound familiar?
- Staff spend the first hour of every case gathering information from several systems.
- A simple automation keeps breaking because the task needs a few judgement calls along the way.
- We like the idea of agents, but not one that can act across our systems unchecked.
The cost of leaving it
Skilled staff keep spending the first hour of every case gathering information from several systems. The opposite risk is an agent switched on without limits, whose first serious mistake is found by a customer rather than a test.
Why us
What we bring to ai agents.
A person stays in charge
Models work on bounded tasks inside your systems, and anything that matters goes to a named person to confirm.
Tested on your examples first
We measure a model on real cases from your work before it reaches staff, so you see where it fails while the stakes are low.
We say when AI is the wrong tool
Not every task should be automated. When conventional software or a person is the better answer, we tell you.
What the work includes
Let the agent do the legwork. Keep the decisions.
An AI agent is a model that works through a task in steps: it reads the request, chooses a tool, checks the result and decides what to do next. We give agents only the tools and data the task needs, log every step, and make them stop for a person before anything is sent, paid or changed.
Task and boundary design
What the agent may do alone, what needs approval, and what it must never touch.
Narrow tool access
Permissioned connections to only the systems the task needs, usually read-only to start.
Approval points
The agent stops and asks a named person before acting on anything with consequences.
Logs and limits
A record of every step and tool call, caps on steps, spend and time, and a way to stop it.
Use cases
Projects we take on.
Preparing a repair before dispatch
The agent gathers the property history, open complaints and engineer availability for a request, then proposes a booking for a coordinator to confirm.
Assembling a client onboarding file
It checks which documents are missing, drafts the request to the client and fills in the review checklist for a compliance officer.
Investigating an exception
It pulls the records behind a failed payment or mismatched invoice and writes a short note on likely causes for a person to act on.
Our approach
How we build agents you can trust.
Agents fail differently from chatbots: they act. Our approach follows the UK National Cyber Security Centre’s 2026 guidance and the OWASP Top 10 for agentic applications, so the controls sit outside the model, where a clever prompt cannot talk its way past them.
| Aspect | Workflow automation | AI agent |
|---|---|---|
| Steps | Fixed in code, the same every time | Chosen by the model as the task unfolds |
| Best for | Repetitive steps with one clear output | Tasks that need several look-ups and judgement calls |
| Predictability | High: easy to test and explain | Lower: needs scenario tests and tighter limits |
| Cost and speed | One model call per step | Several calls per task, so slower and dearer |
| Our default | Yes, when the steps are always the same | Only when a workflow cannot do the job |
Start with the simplest thing that works and add autonomy only when testing shows it is needed. Most tasks that sound like agent work are better as a workflow.
By sector: what the agent does, what stays with a person
- Health & social care ↗
Agent: Gathers visit notes, medication records and rota changes into a handover summary for the coordinator.
Person: Care plans, medication decisions and safeguarding judgements.
- Medical education ↗
Agent: Drafts scenario variations and session paperwork from an educator’s brief, for the educator to review.
Person: Clinical values, algorithm steps and whether a learner passes.
- Property & field services ↗
Agent: Assembles the property history, open complaints and engineer availability, then proposes a booking.
Person: Whether a hazard is an emergency, safety sign-off and complaint outcomes.
- Fintech & professional services ↗
Agent: Checks an onboarding file for missing documents and drafts the request to the client.
Person: Accepting a client, clearing a sanctions match and giving advice.
Least privilege
- Each agent has its own identity, never a shared staff login.
- Only the tools the task needs, read-only until tests justify more.
- Short-lived credentials that expire when the task ends.
- Connections through the Model Context Protocol use OAuth with scoped, audience-bound tokens.
People in charge
- A named owner for every agent and an approval chain agreed before launch.
- The agent stops for approval before it sends, pays, deletes or changes a record.
- Red lines, actions it must never take, enforced in code outside the model.
- An off switch that halts every agent run immediately.
Containing untrusted content
- Instructions hidden in emails, web pages or documents are treated as data, not orders.
- No single run combines private data, untrusted content and a way to send data out.
- Code an agent writes runs in an isolated sandbox with no access to production.
- Limits on steps, time and spend, so a loop cannot run away.
Visible and tested
- Every model call, tool use and approval is traced and kept for review.
- Alerts on unusual behaviour across the systems the agent touches.
- Recorded past cases are replayed before launch and after every change.
- Attack scenarios, such as injected instructions, are part of the test set.
| Risk | How we design against it |
|---|---|
| 01Agent goal hijack | Untrusted content kept apart from instructions; red lines enforced outside the model. |
| 02Tool misuse and exploitation | Narrow tools with strict input schemas, and approval before consequential actions. |
| 03Identity and privilege abuse | A separate identity per agent, least privilege and short-lived credentials. |
| 04Agentic supply chain vulnerabilities | Vetted, pinned tools and connectors, with no unreviewed third-party servers. |
| 05Unexpected code execution | Generated code runs only in an isolated sandbox. |
| 06Memory and context poisoning | Memory scoped per task, with sources recorded and checked before reuse. |
| 07Insecure inter-agent communication | Authenticated channels and the same permission checks between agents. |
| 08Cascading failures | Step, time and spend limits, timeouts and a manual fallback. |
| 09Human-agent trust exploitation | Review screens show sources and reasoning, not just a confident answer. |
| 10Rogue agents | Monitoring, alerts and an off switch that stops every run. |
Guidance we build on
- NCSC: Thinking carefully before adopting agentic AI (May 2026)
- NCSC: Managing the cyber risk of agentic AI (August 2026)
- OWASP GenAI Security Project: Top 10 for Agentic Applications
- ICO tech futures: Agentic AI (January 2026)
- Model Context Protocol: Security best practices
- Anthropic: Building effective agents
We follow this guidance in how we design and test. It is not a certification. Our approach to responsible AI.
What you get
Outputs you can review.
- Task map with agent and human steps marked
- Permission list for every tool the agent can use
- Scenario test set built from real past cases
- Agent integrated with approval screens
- Step log, limits and stop procedure
Technologies we use for this
Where it matters
- Health & social care Staff can look up care policies and procedures with the source shown; decisions about a person’s care stay with people.
- Property & field services New repair requests, with their descriptions and photos, can be sorted by trade and urgency before an operator confirms dispatch.
- Fintech & professional services Statements and application forms can be read into your systems field by field, and any value below a set confidence goes to a reviewer.
What’s changing
Shifts to plan for.
July 2026
EU high-risk rules move to 2027
The AI Omnibus entered into force on 27 July 2026, moving obligations for Annex III high-risk systems, such as those used in employment, credit scoring and education, to 2 December 2027.
August 2026
EU AI transparency duties apply
Article 50 obligations, such as telling people when they are dealing with an AI system, apply from 2 August 2026.
February 2026
New UK rules on automated decisions
The Data (Use and Access) Act 2025 widened when significant decisions can be automated, provided people are told, can contest the outcome and can ask for a human review.
Process
How the work runs.
Map the task as people do it
We record the steps, systems and decisions involved, and mark the ones that carry risk.
Start read-only
The first version can look things up and draft, but cannot change anything.
Test on recorded scenarios
Past cases, including messy ones, are replayed to check the agent reaches the right outcome and stays inside its limits.
Add actions one at a time
Each new permission goes live only after it passes testing, with an approval point in front of it.
Cost
What shapes the estimate.
Number of systems
Every tool the agent uses needs a safe connection, its own permissions and its own tests.
Cost of a wrong action
Riskier actions need tighter limits, fuller approval screens and more test scenarios.
Running volume
Agents call a model several times per task, so volume and model choice drive running costs.
Ways to work together
A first, fixed stage
Discovery, a prototype or a technical review with agreed outputs, so the next decision is made with something concrete in hand.
Delivery in phases
The build split into releases, each with a scope you review and approve before it starts.
Ongoing engineering
An agreed scope for support and improvements after launch, with response expectations written down.
Common questions
Before you get in touch.
What is the difference between an AI agent and workflow automation?
Workflow automation uses a model for one fixed step. An agent decides which steps to take, and in what order, using the tools it is given. When the steps are always the same, we recommend the simpler option.
Can an agent act without anyone approving it?
Only for low-risk, reversible actions you choose, such as looking up records or drafting a note, and only after it passes testing on recorded scenarios. Sending, paying or changing records keeps a person in the loop.
Which models and frameworks do you use?
We choose per task and keep the agent’s logic in your own code, so you can change model provider later. Where data rules require it, models can run inside your own cloud account.