From Prompting to Agentic Work

Know what's running.

3 SIGNALS · 1 LESSON · 1 ACTION · ABOUT 5 MINUTES

SIGNAL 01

What happened. Microsoft has formalized an AI shared-responsibility model that separates an AI system into three layers: the platform, the application, and how the organization uses it. The division changes depending on whether the organization buys software, builds on a platform, or manages the infrastructure itself. Responsibility generally sits with the party performing the work, even when the provider supplies the controls.

Why it matters. A secure platform can provide identity controls, logging, content filters, data protections, and administrative settings. It cannot decide which business decisions your agent should influence, whether its permissions are appropriate, when a person must intervene, or whether the resulting workflow satisfies your obligations. Those are implementation decisions, and the organization adopting the system owns them.

Microsoft now distinguishes between interactive agents acting on behalf of a signed-in user and autonomous agents operating through their own identities. Technical controls can govern both, but the operating policy for each is still yours to write.

What to do. For each AI system, write down what the provider controls, what your technology team configures, and what the business must decide. Give every item in the last two columns a named owner. “The vendor handles it” should never be the default answer.

Sources: Microsoft, “Artificial intelligence shared responsibility model” · Microsoft, “Security for AI overview” · Microsoft Service Assurance, “Artificial Intelligence overview”

SIGNAL 02

What's changing. The business owners I have spoken with already find value in prompting because the interaction is easy to understand: ask for something, inspect the answer, and decide what to do with it. Agentic AI builds on that familiar starting point. An agent works in a loop. It plans, acts, observes the result, adjusts, and continues until it finishes the task or needs a person. The whole workflow is what you design and review.

Consider the difference between asking AI to draft a customer follow-up and assigning an agent to handle follow-ups. The first produces text for someone to review. The second may read a CRM record, inspect prior messages, decide which customers need attention, draft the messages, schedule them, update the CRM, and flag exceptions.

Why it matters. Treating an agent as a chatbot with a longer prompt keeps it from doing the multi-step, multi-system work in that example. Organizations need to decide which tools the agent may use, which data it may retrieve, which records it may change, what it should do when information conflicts, and when the work returns to a person.

That workflow is also what security and governance teams need to review. Give them the map of the workflow's data, tools, permissions, decisions, handoffs, and failure paths. The model name alone tells them little about operational risk.

What to do. Draw one agentic workflow from request to completion. Include every system the agent touches, the identity it uses, the information it reads, the actions it takes, the records it creates, its stopping conditions, and each point where a person reviews or approves the work.

Sources: Anthropic, “Trustworthy agents in practice” · NIST, AI Risk Management Framework Core

SIGNAL 03

The framework. Before building an AI workflow, five questions expose most of the decisions that matter: What minimum accuracy does the task require? How often will the system run? Can a cache, conventional software, or a smaller model handle part of the work? Must it happen in real time? How much information does the system need to remember?

Each question has three answers. There is a business answer about value and cost, a security answer about exposure, and a governance answer about oversight and accountability.

Why it matters. Accuracy determines whether a person must check every result or only unusual cases. Usage volume changes both the economics and the blast radius of an error. Caching can cut costs, but it also creates another store of potentially sensitive data. Real-time action improves speed while reducing the opportunity for review. Memory may make an agent more useful, but every additional document, message, and customer record expands what must be protected.

The businesses I talk with usually answer the business version first, then send the finished design to security and compliance. By then, the design already determines much of the risk. Answering all three versions puts value, protection, and accountability into the same conversation.

What to do. Put three columns beside the five questions: business value, security exposure, and governance obligation. If one column is blank, the workflow is not ready to move from experiment to operation.

Sources: NIST, AI Risk Management Framework · Microsoft, “Responsible AI in Azure workloads”

THE LESSON

Moving from prompting to agents should not mean placing a person between every two steps. If a human has to approve every lookup, calculation, and routine update, the organization has rebuilt manual work with an expensive assistant attached.

The goal is meaningful human control. Let the agent handle the work machines are good at: collecting information, following a defined process, checking multiple systems, preparing routine outputs, and escalating exceptions. Put people at the points where judgment, accountability, or irreversible consequences enter the workflow.

A person might approve a payment, a customer commitment, a change to production, an employment decision, or the release of sensitive information. The agent can do the research and preparation leading to that decision. It can also execute low-risk, reversible actions within clear limits. Set the limit on what the agent may decide separately from the limit on what it can technically do.

DO THIS WEEK

Choose one prompt your team uses repeatedly. Map what happens before the prompt, what the person does with the output, and what happens afterward. Then identify which steps an agent could perform.

For each delegated step, record the agent's data access, tools, permission level, logging, stop condition, and human checkpoint. Start with actions that are reversible and easy to verify. Keep approval with a person wherever the action creates a financial, legal, safety, employment, customer, or security consequence.

IT'S NOT TOO LATE

On Wednesday, September 9 at 10:00 a.m. Pacific, I am hosting a small executive roundtable on Operational AI Leadership: how to lead when AI increasingly makes, recommends, or influences decisions once reserved for people.

I will share the framework I have been developing for deciding where AI should act, where people should remain involved, and how organizations can turn scattered experiments into a working operating model. Then we will open the conversation to the leaders in the room.