The Agent Stack Owners Actually Need (Not the Demo Deck)

Most "enterprise agent" pitches are Silicon Valley cosplay. Fancy diagrams. Vague autonomy. A slide that says "orchestrate." You need something duller: tools that behave like employees with job descriptions, not magicians with keys to the building.

Start with contracts, not vibes

A tool without a contract is a volunteer with admin rights. For every agent or workflow, write down:

– What it can read – What it can draft – What it can change – What it must never touch

Keep that list short. If "update CRM" means rewrite closed-won dates, you have a problem. If it means create a task and attach a note for a human, you have a job.

Contracts also cover failure. What happens when the tool is unsure? Escalate. What happens when the source system is down? Stop. Silence is not success.

Memory tiers: working vs durable

Working memory is the scratchpad for this task. Durable memory is company fact.

Owners mix these constantly. A chat remembers last week's margin chat and treats it like the forecast. Then someone acts. Then you spend Friday untangling fiction from finance.

Split it on purpose:

• Working memory: temporary context for the current job. Expires. Not cited in board packs.
• Durable facts: CURRENT packs, HubSpot fields with owners, signed contracts, bank exports. Dated. Labeled. Recoverable.

If a number is not durable, the agent may discuss it. It may not commit it.

Guardrails and human-in-the-loop

Irreversible actions need a person. Full stop.

Irreversible means money movement, customer-facing commitments, permission changes, deletes, and anything that would force a Monday apology if wrong. Draft emails are fine. Send is gated. Draft journal entries are fine. Post is gated. Suggest a discount is fine. Apply it in the system of record needs approval.

Build the gate in the workflow, not in a policy PDF nobody opens. The tool should block. Slack should notify. A named owner should click.

Autonomy theater is when the deck says "human oversight" and the product never asks.

Observability or it did not happen

You cannot manage what you cannot replay. Logs should answer:

– What did the agent attempt? – Which data did it use? – Who approved the irreversible step? – What was the outcome?

If your stack cannot produce that trail, you do not have an enterprise pattern. You have a clever demo that will embarrass you in diligence.

This matters in M&A too. Buyers ask how work gets done. "A black box sometimes emails customers" is not a confidence builder.

How Icon thinks about ops

We keep the stack boring on purpose.

HubSpot is the task book. Work lives there as tasks, owners, and dates. OneDrive CURRENT packs are the numbers source of truth. Not a chat. Not a side spreadsheet named "final_v7_REAL." No shadow systems that "everyone knows about" until the one person who knew leaves.

Agents (or any software helpers) draft against those sources. People approve. The CURRENT pack rule exists so models and humans pull from the same labeled facts. When something is wrong, you fix the pack or the HubSpot field, not twelve copies.

That is operator architecture: clear inputs, limited tools, human gates, readable logs. Capability is secondary until those pieces exist.

A build order that survives contact with Tuesday

• Pick one workflow with clear inputs and a reversible middle step.
• Point it at labeled sources only.
• Give it a narrow tool contract.
• Put human approval on the irreversible exit.
• Log everything.
• Run for two weeks. Count errors and escalations. Then decide whether to widen.

Skip the "autonomous org chart" fantasy until the first workflow is boringly reliable.

You do not need lab-grade autonomy. You need a system your controller would not hate.

Which workflow would you automate first if every irreversible step required a named human click?