AI agents vs chatbots: what governed AI looks like in regulated operations

Most organisations have met a chatbot: a window that answers questions, sometimes well. AI agents for business are different in one respect that changes everything else. An agent does not only answer; it acts. It looks up a reservation, opens a ticket, routes a call, raises a purchase request or reads a supplier's email into the ERP.

Once software acts, the question is no longer whether its answers sound right. It is what it is allowed to do, who can see what it did, and what happens when it reaches the edge of its authority. That boundary is what governed AI agents have and most chatbots do not. In regulated operations it is the whole difference between a demonstration and a system that can stay in production.

Scoped tools, not open access

A governed agent does not reach into systems directly. It acts through tools: defined operations such as "look up a booking" or "open a service ticket", each of which does one thing. The agent can use only the tools it has been given.

Each tool is scoped to the agent's role and to the site or property it serves, authenticated on every call and rate limited. An agent answering guest messages for one hotel cannot look up another hotel's reservations, and it cannot call a tool that was never given to it, however the request is phrased. This is the layer Opsian's AI Agents act through, and our note on governed tools for agents explains why the tool layer, rather than the model, is where control belongs.

Permissions that follow the person

An agent should never see more than the person it is working for. When Opsian built Gap Inc.'s first internal GPT, the permissions of the person asking were carried through from the systems the documents live in, so a question from one business unit was answered only from what that unit may see.

The same principle applies to sensitive values. Guest-facing hotel agents receive masked values for data such as door codes. They can confirm a code has been sent without ever holding it.

Every action on the record

A log line says something happened. A record lets someone who was not there reconstruct it: the inputs, the decision, the rule that allowed it and the result.

In the voice agent on live regulated calls for Capital One, every decision is on record, so a call can be reconstructed and the reasoning for a routing or an action can be shown to an examiner. In hotel operations, every tool call an agent makes is logged. When a regulator, an auditor or an operations director asks what the agent did on a given day, the answer is a query, not a reconstruction from memory.

Exceptions routed to people

Governed AI is not AI that does everything. It is AI that knows where its authority ends and hands over cleanly when it gets there.

The operator decides in advance which topics always go to staff and how far an agent may go alone. A hotel agent can acknowledge a complaint and open a ticket straight away, but offers compensation only up to the property's limit, and replies to negative reviews wait for approval. At Capital One, actions outside policy are not available to the agent at all, and a call that needs a person is escalated with the full context of what has been said and done, so the caller does not start again.

The same pattern appears outside customer service. In ENTRIX, an expired passport is never filed for immigration registration without a staff acknowledgement. In the NavCare staffing prototype built for Navavej International Hospital, the fatigue and rest-rule engine allows a supervised override rather than a silent one. The system stops and asks rather than deciding quietly in either direction.

Evaluation before launch and after every change

An agent that worked last month can fail next month because a model version, a prompt, a document or a tool changed. The only reliable defence is an evaluation set built from real questions and expected answers, run before launch and again after every change.

Opsian's agents are tested in a test mode before they go live, so the team can call or message them first. For Gap Inc., the internal GPT was measured against such a harness before it reached users, and the same harness runs after every change, so a change that makes answers worse is caught before anyone sees it. In production, Managed AI Operations re-runs evaluation sets on a schedule so drift is caught by a test rather than reported by a customer.

Examples across sectors

The structure is the same whichever operation the agent serves:

• Banking: intent recognition and routing on regulated calls, with actions limited to what policy allows.
• Hospitality: one agent replying across web chat, LINE and WhatsApp, with named topics passed to staff, as described in our guide to AI for hotels in Thailand.
• Manufacturing and distribution: supplier emails read straight into the ERP, and purchase requests raised from a photograph of stock, in the AI-enabled ERP with K.C. Metalsheet.
• Healthcare: outputs drafted behind human approval before anything touches core records, in the phased path proposed for Navavej.
• Logistics: digital agents for customer support beside an AI-assisted transportation management system for On The Rock Logistics.

Where to start

Write the boundary before choosing the agent. List what it may do, to what limit, under which conditions, and what it must hand to a person. Most organisations have never written this down for their human staff either, which is why the exercise is valuable on its own.

Then check that your systems can support it: can the agent reach the data it needs in real time, and can every action be recorded where it happens? Those are the questions an Opsian audit answers first. The anonymised sample audits show the finished document, and you can book an audit for your own operation.