Closing a multi-step back-office case with nobody in the loop

A request arrives — a refund, an address change, a duplicate invoice, a licence renewal — and the system reads the policy, plans the steps, calls whichever systems hold the records and closes the case without a person opening it. What gets checked afterwards is the state the records ended in, not the reasoning the system wrote on its way there.

Effort: More than a few weeks
Skill level: Engineering skill required
Organisation size: Enterprise
Value: Time saved, Cost saved

Tools named for this

A planning loop with a written policy document supplied as the rules it must follow
An end-state check that compares the records after the run against an expected result
A blast-radius limit — value ceilings, reversible operations only, and a queue for everything else

What to check before you ship it in India

India has no dedicated AI statute — governance runs through existing law — and the Act contains no provision distinguishing a decision taken by a system from one taken by staff. What applies is the ordinary duty: section 8(1) holds the fiduciary responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor, irrespective of any agreement to the contrary. Autonomy changes who notices a mistake, not who answers for it.
An unattended run holds credentials to several systems at once and leaves a trace of every record it touched. Section 8(5) puts the duty of reasonable security safeguards to prevent a personal data breach on the fiduciary, and the run log — often written for debugging, retained indefinitely, readable by the whole engineering team — is usually the copy nobody accounted for.

What this does not do

Average success is the wrong measure for work nobody watches. The benchmark built for this exact shape — an agent with domain tools and a written policy, scored on the database state at the end — introduced a separate metric for repeated attempts precisely because consistency falls away much faster than single-attempt accuracy, and unattended means no one can tell you which kind of run today was. Scoping by intuition fails too: the general-assistant benchmark whose questions are conceptually simple for a person reports them defeating a tool-equipped model, so this one looks easy is not a selection method. Weigh both against the cost of being wrong, because a bad suggestion costs a reader a few seconds while a bad refund, cancellation or notice costs whatever it costs, and nothing in the MODEL puts a ceiling on it — the ceiling has to be imposed outside it, which is what the blast-radius limit above is for.

Sources

Every claim on this page traces to one of these, on the date it was read.

The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) — most obligations commence 13 May 2027 under the DPDP Rules 2025 — s.8(5) · Ministry of Electronics and Information Technology · a rule · read 2026-09-01
The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) — most obligations commence 13 May 2027 under the DPDP Rules 2025 — s.8(5) · Ministry of Electronics and Information Technology · a rule · read 2026-09-01
GAIA: a benchmark for General AI Assistants · arXiv (Mialon, Fourrier, Swift, Wolf, LeCun, Scialom; Meta and Hugging Face) · how it is done · read 2026-09-01
tau-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains