What an Agent Is, and What It Is Not
The word has been stretched far enough that it is worth being blunt about the distinction, because the three things get sold under the same name and they behave very differently when a customer says something unexpected.
| Thing | What it does | What happens when the caller goes off script |
|---|---|---|
| A chatbot or IVR | Matches what it hears against a list of expected inputs and returns a prepared response or route. | It fails, loops, or sends the caller to a default. It cannot recover, because there was never anything behind the list. |
| An automation | Runs a fixed sequence when a trigger fires. Missed call sends an SMS. Form submission creates a task. | Nothing. It runs the same sequence regardless, which is fine when the trigger is unambiguous and useless when it is not. |
| An agent | Holds a goal, decides which steps to take, calls tools to look things up and change things, and judges when it is done or when it should stop. | It reasons about it. It can ask a clarifying question, look something up it was not told to look up, or decide this one belongs with a person and hand it over with the context intact. |
The practical test is whether the thing can do something it was not explicitly told to do, in service of a goal it was told to achieve. A caller who says "I rang yesterday about the leak at the Brunswick site and nobody has been out" is giving an agent three facts and an implicit request. A menu hears none of it. An automation was not triggered by it. An agent can look up the job, see the technician was booked for this morning, check whether that appointment was completed, and either tell the customer where the technician is or escalate to the person who can. That is the whole difference, and it is why the term caught on.
Autonomy is a dial, not a switch
The useful question is never "is it autonomous". It is "which decisions is it allowed to make on its own, and which ones does it have to bring to somebody". A well-scoped agent might be fully autonomous about looking up a booking, allowed to change one with confirmation, and forbidden from issuing a credit at all. Three different levels inside one job. Every agent that has caused a business a real problem was given a single level of autonomy for the whole job, usually the highest one.
Where This Actually Sits in 2026
The gap between the headline numbers and the deployment numbers is the single most useful thing to understand before you start, because it tells you which risk you are actually running.
| What the numbers say | What it means for you |
|---|---|
| Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027, citing escalating cost, unclear business value and inadequate risk controls. | The failure mode is commercial and operational, not technical. All three causes are fixed at scoping time, before anybody signs anything. |
| Around 17% of organisations have deployed agents, while over 60% expect to within two years. | You are not late. You are in the window where being deliberate still beats being first, and where the people who rushed are currently rebuilding. |
| Salesforce puts the average Australian organisation using AI at around eleven agents running at once. | The organisations getting value are running many small agents with narrow jobs, not one large one with a broad one. That is the shape to copy. |
| Voice AI is reported to handle roughly 19% of inbound contact centre volume in 2026, against about 6% in 2024. | Voice moved from experiment to production in about eighteen months. Customer tolerance for it has moved with it, provided it works. |
| A 2026 Gartner survey found 91% of service leaders under executive pressure to implement AI, and while around 88% of contact centres use AI in some form, only about a quarter have integrated it properly. | Most deployments are bolted on beside the systems rather than joined to them. That gap is where the disappointment comes from, and it is an integration problem. |
| Gartner's longer view has agentic AI autonomously resolving around 80% of common service issues by 2029, with roughly 30% lower operating cost. | A direction of travel, not a target for your first quarter. Businesses that aim at 80% in year one are the ones writing the cancellation notices in year two. |
Read those together and the conclusion is uncomfortable for the enthusiasts and reassuring for everybody else. The technology is ready enough that real volume is flowing through it. The implementations are not, and the difference between the two groups is almost entirely process. Nobody is cancelling these projects because the model could not understand an Australian accent.
The Six Parts of a Working Agent
When a deployment fails, it is nearly always because one to five of these were never built. The first one is easy and everybody does it, which is why it feels like the whole job.
The job
Written in one paragraph, in plain words, including what success looks like and what is out of scope. If it takes a page, the job is too big. "Answer calls after 5pm, identify the caller, answer questions about opening hours, services and job status, book an appointment if asked, and take a message for anything else."
The tools
The specific things it is allowed to call: look up a customer, read the calendar, create a booking, create a task, send an SMS. Each one named, each one with a defined input and output. An agent with no tools is a chatbot with good manners.
The context
What it can see when the call starts. The caller's number matched to a customer record, their last three interactions, their open jobs, their account status. Context is what makes it feel like the business rather than like a stranger.
The guardrails
The things it may never do, stated as prohibitions rather than as guidance. No pricing outside the published list. No commitments about timeframes. No account changes without verification. No discussing another customer.
The escalation
Where it goes when it should stop, what it hands over, and what the customer hears while that happens. This is the part that decides whether people trust it, and it gets about a tenth of the attention it deserves.
The log
Every call, every tool it called, every decision point, every escalation, kept where you can read it. Without this you cannot improve it, cannot defend it, and cannot answer the first complaint, which will arrive in week two.
If you only take one thing from this article: the six parts are not optional extras that mature deployments add later. A project that builds part one and skips parts four, five and six is not an early version of a good deployment. It is the thing Gartner is counting when it says forty per cent get cancelled. Guardrails and escalation are cheaper to build before launch than after the first bad call, and the log is the only reason you will ever know which calls were bad.
Choosing the First Job
Three variables decide whether a job is a good first candidate, and you want the same answer on all three. High volume, low variance, low consequence.
| Variable | What you want | Why |
|---|---|---|
| Volume | High. At least a few dozen a week. | Low volume jobs cannot repay the setup, and worse, they never generate enough examples for you to tell whether it is working. You need repetition to learn anything. |
| Variance | Low. The same handful of shapes over and over. | High variance work is where agents are impressive in demos and inconsistent in production. Start where the ground is flat and expand into the rough later. |
| Consequence | Low. A mistake is recoverable within a day. | Not because agents make more mistakes than people, but because your process for catching and fixing mistakes does not exist yet. Build that muscle somewhere forgiving. |
Run your own candidate list through those three and you usually find that the job everybody wants to automate first, the complicated one that eats a senior person's week, is exactly the wrong one to start with: low volume, high variance, high consequence. It is also the one that will be automatable in about a year, once you have the plumbing, the guardrails and the institutional habit of supervising an agent. Start with the boring one that happens two hundred times a week.
The success test has to be written before you build
One sentence, with a number in it, agreed by the person who owns the outcome. "By day sixty, at least half of calls arriving after 5pm are fully dealt with without a callback the next morning." If you cannot write that sentence, you do not yet have a project, you have an interest. And if the sentence is written after launch, it will be written to describe whatever happened, which is how projects survive for a year without anybody being able to say whether they worked.
Five Jobs That Pay Back Inside a Quarter
These are the ones we see returning their cost fastest in Australian businesses between roughly five and two hundred staff. They are unglamorous on purpose.
| Job | What the agent does | What it replaces |
|---|---|---|
| 1. After hours answering | Answers, identifies the caller, deals with the common questions, books or takes details, and flags anything genuinely urgent to the on-call person with context. | A mailbox nobody opens until morning, or an unbounded ring that records nothing at all. This is the single largest quick win for most businesses. |
| 2. Booking and rescheduling | Reads the calendar, offers real times, books, confirms by SMS, and handles the reschedule when the customer rings back. | Phone tag. Roughly half of booking calls in most businesses are a reschedule, and reschedules are the most mechanical conversation in the business. |
| 3. Job and order status | Matches the caller, finds their job or order, tells them where it is, and offers to notify them when it changes. | "Let me find out and call you back", which almost always costs two calls and a note that never gets written. |
| 4. Call notes and CRM updates | Summarises the call, extracts the actions, writes them to the right record, and creates the follow up task. | The note that nobody wrote. This one is quietly the highest value of the five, because it fixes data quality everywhere downstream. |
| 5. Overflow at peak | Takes the calls that would otherwise queue past a threshold, handles what it can, and offers a callback that keeps the caller's place. | Abandoned calls, which are invisible in most reporting and are the most expensive thing a busy business does all day. |
Notice that four of the five are about calls that are currently not being handled at all rather than calls currently handled by a person. That is deliberate, and it is the shortcut past the hardest internal conversation. An agent that picks up work nobody is doing does not need anybody to give anything up, which means it gets a fair trial. An agent introduced as a replacement for a person's work gets audited by that person, and they will find the three calls it got wrong before they find the ninety it got right.
Guardrails: What It May Never Do
Write these as flat prohibitions, in a list, with no conditions attached. Guidance gets interpreted. Prohibitions get enforced.
| Guardrail | Why it matters |
|---|---|
| No pricing beyond the published list | A quoted price on a recorded call is a representation. Under Australian Consumer Law it is yours, whoever said it. The agent may read the published rate card and must refuse to estimate anything else. |
| No commitments about time | "Someone will be there this afternoon" is the most common promise an over-eager agent makes and the one that generates complaints. It may state a booked appointment. It may not predict one. |
| No account changes without verification | Define the verification, define what a failed verification does, and make sure the failure path is not simply a second attempt with an easier question. |
| No discussion of any other customer or job | Agents with broad data access can be talked sideways into adjacent records. Constrain the tool, not just the instruction: the lookup should only return records tied to the identified caller. |
| No claim to be human | It should not lie if asked, and it is better that it says what it is at the start. Businesses that disclose it get fewer complaints than businesses whose customers work it out on their own. |
| No handling of a caller in distress | Define the trigger words and route straight to a person. This is not a place for containment metrics, and no business has ever regretted escalating one of these too early. |
| No unbounded retries | Two attempts to understand, then escalate. A third loop is how an agent turns a mild frustration into a complaint about the business. |
Enforce guardrails in the tools, not only the instructions
An instruction that says "do not issue refunds" is a preference. Not giving the agent a refund tool is a control. Where the consequence is real, remove the capability rather than asking for restraint, and reserve instruction-level guardrails for things you cannot express structurally. This one architectural habit prevents most of the incidents that make the news.
Escalation Is the Hard Part
Everybody builds the happy path. Escalation is where deployments are actually judged, because the calls that get escalated are disproportionately the calls that matter, and a bad handover is worse than no agent at all.
It needs four triggers, at minimum. The customer asks for a person, and the answer is always yes, immediately, without a negotiation. The agent is not confident, on its own assessment. The caller has repeated themselves, which is a reliable signal of a conversation going badly. And the topic is on the never list, such as a complaint, a dispute, or distress.
It needs to carry the context across. The person who picks up should see who the caller is, what they have said so far, what the agent did, and why it escalated. An escalation that makes the customer start again is the moment they decide the whole thing was a waste of their time, and they are not wrong.
It needs a defined destination at every hour of the day. Escalating at 2am to a ring group that is empty is not an escalation, it is a hang up with extra steps. If there is genuinely nobody, the honest version is a commitment with a time attached and an SMS confirming it.
And the customer needs to hear what is happening. "I will put you through to someone who can sort that out, it will take about thirty seconds" costs nothing and changes the entire experience of being handed over.
The Ninety Day Sequence
Four phases, each with an exit test. The point of the sequence is that you are never betting more than you can recover from in a day, and that by the time it is on the front line it has already handled thousands of real conversations under supervision.
| Phase | What happens | Exit test |
|---|---|---|
| Days 1 to 14: shadow | The agent runs against real calls and produces what it would have said and done, but nothing reaches a customer and no tool it calls changes anything. A person reads a sample every day. | You have read at least a hundred transcripts and you can predict what it will do. Every surprise has become either a guardrail or a fix. |
| Days 15 to 35: after hours only | Live, but only on calls that would currently reach a mailbox. The downside is bounded because the alternative was nothing. | Escalation works at 2am. Notes are landing in the right records. Nobody in the team has found a call that embarrassed the business. |
| Days 36 to 60: supervised overflow | Daytime, but only calls that would otherwise queue past a threshold. Somebody owns the review, half an hour a day, and the team can flag a call in one click. | Containment is stable across three weeks and repeat contact is flat or down. Not rising containment. Stable, with repeat contact behaving. |
| Days 61 to 90: front line, narrow | It answers first on the defined job and hands over everything else. Autonomy widens one decision at a time, each with its own review. | The success sentence you wrote in week one is either met or honestly not met. Both are useful. Only ambiguity is a failure. |
Three things run alongside all four phases. The team is told before it goes live, what it does, and how to flag a bad call, because staff who discover an agent by accident become its most motivated critics. A named person owns the daily review, and it is in their workload rather than on top of it. And every change is logged with a date, so when something shifts in week nine you can find out what you changed in week eight.
Five Numbers, and Why One of Them Is Repeat Contact
Containment on its own is the number that makes projects look successful right up until somebody checks the callback volume.
| Number | Definition | What a healthy answer looks like |
|---|---|---|
| Containment | Share of conversations finished by the agent without a person. | Rising, then settling. A first job in the right range lands somewhere between 40% and 70%. Anything near 100% means the scope is trivially narrow or the escalation is broken. |
| Resolution | Share of contained conversations where the customer's actual purpose was achieved. | This is the honest sibling of containment and it needs sampling, not just logs. Read fifty calls a month and score them. |
| Repeat contact in 72 hours | Share of contained conversations where the same customer makes contact again about the same thing. | Flat or falling. If this rises while containment rises, the agent is not resolving anything, it is deferring. This is the single most important number here. |
| Escalation quality | Of escalated calls, the share where the person who took over had the context and did not have to start again. | Above 90%, and it is a configuration problem rather than an AI problem if it is not. |
| Cost per resolved contact | All-in cost divided by resolved contacts, including the review time. | Compared against your loaded cost of a staffed contact. Include the supervision, or the comparison is dishonest and you will be caught out at the first budget review. |
Containment that pushes work into tomorrow is not containment, it is a queue with a delay. A caller who was told something unhelpful at 7pm and rings back at 9am has been counted as a success by most vendor dashboards and has cost you two contacts instead of one, plus the goodwill. Pair every containment figure with repeat contact for the same period, always, and treat a divergence between the two as the first thing to investigate rather than the last.
Connecting It to Everything Else
The finding that 88% of contact centres use AI while only about a quarter have integrated it properly is the whole story of wasted spend in this category. An agent that cannot see your systems is doing an impression of your business from the outside.
What it needs to read. Customer records, open jobs or orders, the calendar, the knowledge the team uses, and the history of previous contact. Most of the perceived intelligence of a good agent is actually context. An agent that knows the caller has an open job and a technician booked for tomorrow sounds vastly cleverer than one that does not, using the same model.
What it needs to write. Notes on the record, tasks for people, bookings in the calendar, and updates to job status. Write access is where the value lives, because reading saves the customer time and writing saves your team's.
How it should connect. Through documented APIs and webhooks in both directions, so the agent is not locked to one vendor's marketplace. The Model Context Protocol has become the common way for agents to reach tools and data since it emerged, and it is now under independent stewardship with the major AI ecosystems supporting it. You do not need to care about the specification. You do need to ask a vendor whether their platform can expose your systems to an agent through an open standard, or whether every connection is a bespoke build they charge for.
This is also the argument for putting the communications platform at the centre rather than at the edge. The conversation is where intent shows up first, and a platform that already handles the call, the SMS and the messaging channels is the natural place for the agent to sit, with the systems of record around it. The case for one connected platform covers that in more detail.
The Australian Rules as They Stand
The regulatory position changed direction in the last eighteen months and a lot of advice written in 2024 and 2025 is now wrong in a way that matters commercially.
| What people expect | Where it actually stands |
|---|---|
| Mandatory guardrails for high risk AI | Proposed in September 2024, then dropped. The National AI Plan of December 2025 confirmed Australia would rely on existing law and sector regulators supported by voluntary guidance, rather than a standalone AI Act. |
| An Australian AI Act | Not in force. In July 2026 the Government set out a direction including legislating Australian Standards for AI and established an Office of AI within the Department of the Prime Minister and Cabinet. Watch it, do not wait for it. |
| Nothing applies, then | Wrong, and this is the expensive misunderstanding. Privacy law, the Australian Consumer Law, record keeping obligations, industry codes and the telecommunications rules all apply to what your agent says and does, exactly as they apply to a staff member. |
| Government rules are the same as business rules | They are not. Mandatory requirements including AI impact assessments and Chief AI Officers began applying to Commonwealth agencies from 15 June 2026, with full compliance due 10 December 2026. Useful as a template, not binding on a private business. |
| Automated decisions are unaffected | From 10 December 2026, privacy policies must disclose the kinds of personal information used in substantially automated decisions and the kinds of decisions made. If your agent decides anything about a person, this reaches it. |
The practical reading for a business deploying an agent on the phone: your obligations come from the law you already had. Recording consent rules did not change. Consumer law did not change. Privacy did change, in a specific and disclosable way, with a date on it. We covered that in detail in the Privacy Act automated decisions guide, including the part most advisory pieces get wrong, which is that the obligation is disclosure rather than a prohibition or a right to human review.
Eight Ways This Goes Wrong
| Failure | The fix |
|---|---|
| 1. The first job was too big | Narrow it until it is almost embarrassing, then launch. The second agent takes a fortnight because the plumbing exists. |
| 2. No success sentence | Write it, with a number and a date, before you build. Agreed by the person who owns the outcome. |
| 3. Guardrails written as guidance | Convert to prohibitions, and enforce the serious ones by withholding the tool rather than asking nicely. |
| 4. Escalation goes nowhere at night | Define a destination for every hour. A commitment with a time beats a silent handover to an empty group. |
| 5. Nobody reads the transcripts | Half an hour a day, named owner, inside their workload. This is where every improvement in the first quarter comes from. |
| 6. It is not connected to anything | Give it read and write access to the customer record and the calendar. Context is most of what makes it work. |
| 7. The team found out when a customer told them | Tell them first, show them the transcripts, give them a one click way to flag a bad call, and act on the flags visibly. |
| 8. Containment celebrated in isolation | Pair it with repeat contact every single time it is reported. Make them one line on the report, not two. |
How to Tell a Real Agent From a Rebadged Menu
Gartner named the practice agent washing: rebranding assistants, robotic process automation and chatbots as agentic without the underlying capability, and its assessment is that only a small fraction of the vendors making the claim have it. You do not need to evaluate architecture to find out. You need five questions and one phone call.
| Ask | What a real answer sounds like |
|---|---|
| "Which tools can it call, and can I add my own?" | A named list, plus a documented way to add yours. Vagueness here means it cannot act, only speak. |
| "Show me a call where it did something you did not script." | They can pull one up, because they read transcripts too. If every demo is the same demo, there is a script under it. |
| "What does it do when it is not confident?" | A described behaviour, not a promise that it always is. Confidence handling is the single clearest signal of a real implementation. |
| "Where does my data go, and where is it processed?" | A straight answer about which components run where, which models are used, and what is retained. Vagueness here is the one that later becomes a privacy problem. |
| "What is your containment, and what is repeat contact alongside it?" | Both numbers, from real deployments. A vendor who has never been asked the second one is telling you something. |
Then ring the demo number yourself and go off script. Interrupt it mid sentence. Change your mind halfway through. Give it a suburb and a vague description instead of a reference number. Ask for a person. Say something with two requests in one sentence. Every one of those is ordinary customer behaviour and every one of them separates an agent from a menu wearing a better voice. Our related piece on what sits underneath an AI provider covers the infrastructure side of the same evaluation.
How We Do It
Uniden Voice over Cloud runs the agent inside the phone platform rather than beside it, which matters for three specific reasons. The agent answers on the actual call path, so there is no forwarding hop, no second provider in the audio, and no delay while a call is handed between systems. It has the call context from the first second, including the number, the matched customer record and the history, because the platform already holds them. And it escalates into the same ring groups, queues and on-call rotations the rest of your call flow uses, so escalation is a route rather than an integration.
We build the first one with you on the shape described above: one narrow job, written guardrails, a defined escalation, a fortnight of shadow running where nothing reaches a customer, then after hours, then overflow. You get the transcripts from day one, the five numbers weekly, and a named person on our side who reads them with you. The platform is Australian owned, hosted in Australia and supported from Australia, and the APIs are open, so what you build with us is yours to connect to whatever else you run.