Enterprise AI Agents: From Pilot to Production

A successful pilot proves that a model can complete a task in a demo environment. Production is a different system: identity, change control, evaluation, cost, and an owner who gets paged. Most “agent” programs die in the gap between those two worlds.

This article is the path we use at EmerSoftware. EmerAgents is the orchestration layer — seven specialized roles, handoffs, and an audit trail — not a single chat session that remembers your SAP password.

Why pilots stall

• The demo used a human’s OAuth token; production needs a machine identity with least privilege.
• The agent had unrestricted tools (“browse the web, call any API”).
• There was no evaluation set — only a recorded happy path.
• Write actions hit production-like data without a rollback story.
• No one owned the runbook when the agent was confidently wrong.

The production checklist

1. Identity and tenancy

Treat the agent as a workload identity. Short-lived credentials, environment-scoped secrets, and a mapping from agent role → allowed systems. If SAP, Salesforce, and Oracle are in scope, the agent does not reuse a consultant’s login. That is a finding waiting to happen.

2. Tool policy before prompts

Prompts are not a control. Allowlists are. Separate read tools from write tools. Separate staging endpoints from production. Log every invocation with correlation IDs. EmerAgents encodes this as policy on the control plane so a developer cannot “just add a tool” in a system prompt.

type AgentRole = "pm" | "architect" | "developer" | "qa" | "devsecops";

type ToolPolicy = {
  role: AgentRole;
  env: "sandbox" | "staging" | "prod";
  allow: string[];
  deny: string[];
  requireHuman: string[];
};

const developerStaging: ToolPolicy = {
  role: "developer",
  env: "staging",
  allow: ["git.commit", "ci.trigger", "jira.comment"],
  deny: ["sap.bapi.write", "salesforce.composite.write"],
  requireHuman: ["github.mergeToMain"],
};

3. Evaluation is the promotion gate

Keep a golden set of traces: “given this incident, the agent must open a PR that does not touch billing tables.” Score format, tool-choice, and hallucination of system names. If the eval set is only marketing copy, you do not have a product.

4. Human-in-the-loop where irreversibility lives

PRD approval, architecture, production deploy, and any write to ERP/CRM of record. The rest can be automated. Autonomy without a gate is a liability, not a feature.

If your PoC already works in a lab, the next conversation is production design — not another model bake-off. That is the AI strategy call.