Microsoft's security agent for Defender incidents ingests a median of 3,456 raw telemetry rows per incident, compresses them to 887 timeline rows, and produces a structured alert: title, severity rating, MITRE attack-framework mappings, remediation guidance, implicated entities, and the evidence supporting each claim. Alerts that lack evidence or duplicate existing activity get suppressed before a human ever sees them. In a separate expert review of 1,764 alerts, Microsoft security analysts judged 83.7% to have recovered a missing attack stage.
The agent assembles the case. The analyst decides what to do about it.
If this were an isolated example, it would be an interesting product decision. It is not isolated. In a Microsoft study of coding agents deployed across tens of thousands of engineers in early 2026, the output artifact is a pull request: a reviewable diff that enters the organization's existing code-review pipeline. Adopters merged roughly 24% more PRs, though the authors are careful to note that a merged PR is not the same as the value it delivers. Senior developers described breaking work into chunks the agent could implement, then reviewing for correctness. The organizational accountability structure remains intact.
Visa's agentic commerce framework, published April 2026, applies the same logic to payments. An agent can execute a purchase on a cardholder's behalf, but only within cardholder-defined instructions, only after explicit consent and identity verification, and only if the agent retains order confirmation for at least 120 days. The cardholder remains responsible for the agent's actions as if they initiated the transaction themselves. Even here, the framework has undefined edges: when consumer intent and merchant processing both look correct but something goes wrong in the agent's selection, existing dispute categories may not cleanly cover the gap. The rules were written for a world where a human chose the product.
Three domains, one shared skeleton: scoped authority, artifact production, output designed for human review. The agent functions as a clerk. It gathers, organizes, and presents. The human remains the accountable party.
Anyone who has spent time inside a system under real operational load will recognize this as the conservative, survivable architecture. It is also a considerably more modest vision than the one that dominates conference keynotes. Organizations that have watched systems fail learn to preserve the point where a human can say no. And it appears to be the design that actual organizations, with actual liability exposure and actual customers, keep converging on.
But what happens when the interaction itself is the product?
A field experiment on Taobao's customer-service platform studied 680,676 chats. By containment metrics, the agentic system performed well: retrial rates were statistically unchanged, chat duration for eligible conversations dropped 16.8%. The clerk did the job faster. Customer ratings for those same conversations dropped 0.412 points on a five-point scale. When the system detected frustration and escalated to a human, the handoff often arrived after negative sentiment had already accumulated. Workers receiving emotionally escalated chats showed less information-seeking and less proactivity than in technical escalations. The escalation path existed on paper. In practice, it was a door that opened after the fire had already spread.
The clerk model assumes that producing the right artifact is the whole job. In domains with strong review infrastructure, that assumption holds reasonably well. Security alerts get evaluated by trained analysts. Pull requests enter established code-review processes. But in domains where the customer's experience of the process is inseparable from the outcome, the clerk can complete the task while degrading the relationship it was meant to serve. The system produces the correct output and the wrong result simultaneously. Knowing where that boundary runs matters more than celebrating the pattern.