AI Agent Examples: Real Workflows That Read, Decide, and Act

Most lists of AI agent examples are lists of products.

They tell you a thermostat is an agent, a recommendation engine is an agent, a Mars rover is an agent. None of that helps you decide what to automate on Monday.

This post takes the other route. Every example below is a business workflow: what the agent reads, which tools it calls, where a human signs off, and what the published numbers actually say — with a link on each number and a label saying who produced it.

If you read nothing else:

• Deflection is not resolution. Almost every headline rate you will be quoted counts conversations the agent handled, not problems it solved.
• The threshold is the product. The credible deployments do not aim to be right every time. They aim to know when they are not, and to route the rest to a person.
• Start where being wrong is cheap and being slow is expensive. Refund-within-policy, not account deletion.

Who This Is For

• Founders and operations leads deciding which workflow gets an agent first
• Developers who have built a chatbot and want to know what changes when it can act
• Ecommerce and finance teams drowning in tickets, invoices, and returns
• Agencies that need to explain agents to clients without overselling them

If you already run classic automation and want to know where agents genuinely add something, this is the map.

What You Will Need

To read the examples usefully, keep five questions in mind for each one:

• what does the agent perceive (text, a PDF, a photo, a voice stream, a screenshot)
• which tools does it call, and with what permissions
• where is the human checkpoint, and what triggers it
• whose number is the result: the vendor’s, the customer’s, or an independent tester’s
• where does inference run — for Swiss, EU, and UAE clients, data residency is usually the first question procurement asks, and the answer decides whether the project happens at all

That fourth question matters more than it should. Vendor headline rates sit well above what independent tests of the same product find, so every figure below is linked and tagged (vendor), (customer), (third-party), or (independent). Read the tag before you quote the number.

The Pattern

An AI agent for workflow automation is software that takes a goal rather than a script. It reads inputs in whatever form they arrive, works out what needs to happen, calls tools and APIs to act in real systems, checks the result, and either finishes the job or hands it to a person.

The difference from a Zapier zap or an RPA bot is that the path through the work is chosen at run time, not hard-coded.

Gartner’s term for a chatbot rebranded as an agent is “agent washing”. Its June 2025 estimate was that only around 130 of the thousands of vendors claiming agents actually ship one (analyst).

Underneath the marketing, every production example below runs the same loop.

flowchart TD
  T[Trigger] --> P[Perceive input]
  P --> G[Ground in context]
  G --> L[Plan next step]
  L --> A[Act via tool]
  A --> V{Goal met?}
  V -->|No| L
  V -->|Yes| C[Close and log]
  V -->|Unsure or risky| H[Hand to human]

The guardrails sit around that loop, not inside the model: an allow-list of tools, scoped credentials, step and spend caps, and a confirmation gate before anything irreversible.

Which Workflow First

The criteria are volume, a written policy, and reversibility. The missing number in most posts like this one is what it costs you to find out, so here is a rough one. Treat these as first-useful-version, not production-hardened, and expect your own data quality to move them more than anything else on the table.

Customer Support: Read the Ticket, Fix the Problem

This is where most agents start, because the volume is high and the policies are written down.

Intercom Fin runs natural-language “Procedures” written by the support team. A customer says they do not recognise a charge; Fin matches the Procedure, verifies identity, calls the company’s own order API through a data connector, issues the refund or cancels the subscription, and confirms. It can also read a photo of a damaged order and refund against it, which is the simplest vision-in, action-out example in production.

The numbers are where this gets instructive. Intercom’s public headline is 76% average resolution across 12,000+ customers (vendor). Third-party reviews of Intercom’s own published customer stories put the realistic band closer to 42–53% (third-party), and an independent 500-ticket test at small businesses came in at 38% (independent). Plan on 40 to 50% in year one and treat anything above that as earned.

Sierra adds voice. Its outbound agent dials a business, classifies the audio in real time to tell a human from an IVR menu, decides between speech and keypad tones, tracks where it is in the phone tree, and retries when the system hangs. Sierra reports the pass rate rose from 57% to 85% (vendor) as that navigation memory matured, with deployed customers landing between 70% and 94% depending on the task. Healthcare customers use it to check prior-authorisation and claim status with insurers.

The cautionary example is Klarna. In February 2024 its assistant handled two-thirds of chats in its first month and was described as doing the work of 700 agents (vendor). By May 2025 the CEO was saying quality had suffered and the company was rehiring humans for a guaranteed human path (reported). The assistant still handles most volume. Both numbers were true; they measured different things.

flowchart TD
  M[Customer message] --> I[Classify intent]
  I --> K[Look up order and policy]
  K --> D{Within policy?}
  D -->|Yes| R[Refund via API]
  D -->|No or unclear| E[Escalate with context]
  R --> X[Confirm and tag ticket]

Build it yourself: the LangGraph customer-support tutorial is the best single walk-through of this shape. It starts zero-shot, then adds interrupt_before on sensitive tools so a human confirms every booking or cancellation, then splits safe from sensitive tools, then routes to specialist sub-agents. The OpenAI Agents SDK customer service example shows the same triage-and-handoff idea in one file.

Finance: Invoice In, Posted Bill Out

Accounts payable is the cleanest document-vision example because the success criterion is exact: the invoice either matches the purchase order or it does not.

Vic.ai and Ramp both run the same loop. An invoice arrives by email or upload. A vision model extracts the header and line items. General-ledger coding is predicted from history. A two- or three-way match is run against the PO and goods receipt. Each invoice gets a confidence score. Above the threshold it posts with no human touch; below it, it lands in an exception queue with the mismatch highlighted.

One Vic.ai customer case reports 78% of invoices processed entirely on autopilot at 95% coding accuracy (customer, vendor-published), and Vic.ai’s own ROI material puts cost per invoice falling from $3.30 to $0.53 (vendor). Ramp claims 99% line-item OCR accuracy (vendor). Note that even the good numbers are two-sided: 78% autonomous means 22% still queued, and 95% coding accuracy across thousands of bills is a real volume of corrections. The architecture is what matters: the threshold is the product. Nobody is asking the model to be right every time. They are asking it to know when it is not.

flowchart LR
  I[Invoice PDF] --> X[Extract fields]
  X --> M[Match PO and receipt]
  M --> S{Confidence}
  S -->|High| P[Post to ledger]
  S -->|Low| Q[Exception queue]
  Q --> H[Human resolves]
  H --> P

SAP’s Joule agents extend the same idea to disputes: match invoice against PO, diagnose the mismatch, communicate with the vendor, and resolve within a predefined threshold.

Build it yourself: Google’s ADK invoice-processing sample is the most complete open-source version: classify, extract, four-phase validation, transform to the target schema, audit log, and a learning mode where a human correction becomes a persisted rule. Its sibling ambient-expense-agent shows the right split: low-value items auto-approved by a code rule, high-value items sent to the model for risk analysis and then to a human. For a minimal schema-enforced extraction, the Gemini PDF structured-output notebook is a few dozen lines.

If your pipeline already does this kind of extraction without an agent, structured extraction pipelines covers the validation layer that stays the same either way.

Engineering: Issue In, Pull Request Out

Coding agents are the most mature category, partly because the verification step is free: the tests either pass or they do not.

GitHub Copilot’s coding agent is assigned an issue like a colleague. It boots an ephemeral Actions environment, explores the repository, makes changes, runs tests and linters, pushes to a branch it created, and opens a draft pull request with its session log. It responds to review comments with further commits. It can read a mockup image attached to the issue. The controls are the interesting part: it can only push to its own branches, required reviews still apply, the person who assigned it cannot approve its PR, and any CI workflow it triggers needs a human click before it runs.

Claude Code does the same from a CLI or a GitHub Action. Mention it on an issue and it reads the repository’s conventions file, implements the change, runs the tests, and opens the PR. The widely-quoted Rakuten result — a method implemented inside the 12.5-million-line vLLM codebase in about seven hours of unattended work — comes from Anthropic’s published customer case (vendor). Worth knowing before you quote it: the seven-hour figure originates in the Claude 4 launch announcement of May 2025, not from a recent benchmark, and it has been recycled through enough secondary coverage since that it now reads as newer than it is.

Devin at Nubank is the best-documented large case. Nubank needed to migrate around 100,000 data-class implementations in a six-million-line monolith. Engineers wrote migration examples, ran parallel Devin sessions per sub-task, and approved each step. Cognition reports a 12x efficiency gain and over 20x cost saving against the original 18-month plan (vendor). Note what made it work: narrow, repetitive, example-driven, with a human approving every step. Cognition’s own list of where Devin struggles is the inverse: ambiguous requirements and specs that change mid-task.

The IT equivalent is access provisioning. Moveworks reads a request in Teams, checks the employee’s entitlements against the identity provider, grants the access or opens the ServiceNow ticket, and confirms in chat. One automaker customer reports 70,000 requests resolved autonomously in the first year at a mean resolution time of 11.4 minutes (customer, vendor-published), against an industry norm measured in days.

Build it yourself: claude-code-action puts the permission model in workflow YAML. SWE-agent and OpenHands show how the loop works underneath, with the repository exposed as a small set of tools: view, search, edit, run.

Ecommerce: Store Operations by Instruction

The ecommerce examples split into three: running the store, handling customers, and closing the sale.

Shopify Sidekick is the admin-side agent. It creates products and posts, generates product images through Shopify Magic, writes copy, and answers analytics questions. Since the Spring ‘26 edition it can call partner apps through extensions, so “move every product in this collection to the summer sale and tell the fulfilment app” becomes one instruction.

Returns and refund agents from Gorgias and Zowie follow the support loop above against the Shopify Admin API: verify the order, check the return window and condition (optionally from a photo), issue the refund or the label, edit the order, tag the ticket. Gorgias markets “up to 60%” instant resolution (vendor); a review of its own published customer stories puts the real spread at 26% to 56% (third-party), which is the same vendor-versus-reality gap as support, in a narrower domain.

Agentic checkout is the newest piece. The Agentic Commerce Protocol, open-sourced by OpenAI and Stripe in September 2025, lets an agent complete a purchase from a merchant inside ChatGPT. Stripe merchants enable it with a small change to an existing integration. It is the clearest case of payments as an agent output.

Image generation deserves honesty. Product-image agents exist and they do cut photography cost, but marketplace rules such as Amazon’s pure-white background keep a human in review. Google’s image-scoring sample shows the pattern that reduces that review: generate, score against policy, regenerate, and only then show a person.

Build it yourself: Shopify’s official AI Toolkit gives Claude Code, Cursor, and similar tools a Dev MCP server plus “store execute” skills for Admin GraphQL. For the pattern underneath, building a Shopify MCP server walks through exposing store operations as tools with the right scopes. The OpenAI dispute agent cookbook covers chargebacks with real money: triage the dispute, accept it if the company was at fault, otherwise gather shipping evidence and submit it through Stripe.

Voice: Phone Calls as a Tool-Calling Problem

Voice agents used to be a speech-recognition problem. Now they are a tool-calling problem with latency constraints.

The production examples all have the same spine. A front-desk agent listens, calls list_available_slots against the calendar, calls schedule_appointment, reads the confirmation back. A bank agent verifies identity, then looks up the balance. A returns agent authenticates the caller, checks eligibility against policy, and initiates the return. When the agent is out of its depth, it warm-transfers to a human with a written summary so the caller does not repeat themselves.

Assort Health reports hold times at one medical practice dropping from over eleven minutes to just over one, with call abandonment falling from 41% to 8%, within thirty days (vendor). Sierra’s IVR-navigation agent, above, is the outbound counterpart.

Meeting agents are the low-risk version of audio in: transcribe, extract decisions and action items, create the tasks, update the CRM field. Widely deployed, rarely measured.

Build it yourself: LiveKit Agents ships frontdesk, warm-transfer, and a bank IVR example with keypad handling. Pipecat has per-carrier phone bots and an ivr-navigation example. openai-realtime-agents shows the “chat-supervisor” pattern where a cheap real-time model talks and a stronger text model decides which tools to call. Microsoft’s call-center-ai is the one open production-shaped phone agent, with claim intake and callback scheduling.

Computer Use: When There Is No API

Some systems have no API. Legacy portals, supplier sites, government forms.

OpenAI’s ChatGPT agent and Anthropic’s computer-use tool work from screenshots: the model returns a click, a keystroke, or a scroll, the runtime executes it, and the next screenshot comes back. Both require a human confirmation before payments and form submissions, and both struggle with long, intricate workflows.

The practical version for engineers is Stagehand: deterministic Playwright code for the steps you know, and an LLM only where the page is unpredictable, with resolved selectors cached so the model is not called twice for the same element. playwright-mcp exposes the browser to any MCP client through the accessibility tree, no screenshots needed. Microsoft’s Magentic-UI is worth a look purely for its approval UX: the user edits the plan before execution and approves irreversible steps one by one.

Google shut down Project Mariner on 4 May 2026 — first reported by Wired, after the product’s own landing page quietly announced it — and folded the technology into Gemini Agent and Chrome’s Auto Browse.

That consolidation is the signal, and it is worth spelling out because it changes where you should invest. The screenshot paradigm treats the browser as the interface of last resort and pays for it on every step: a full image round-trip per action, brittle coordinates, and a cost curve that scales with how long the task is rather than how hard it is. Structured access — the accessibility tree, an MCP server, a plain API — collapses the same work into a handful of typed calls. A consumer browser agent has no choice; you usually do. The durable investment is the tool layer: whatever you expose as callable operations survives every change of model and of interface fashion, while a pile of tuned click sequences does not survive a redesign. Treat computer use as the adapter you write when nothing better exists, keep it behind the same tool interface as everything else, and replace it the moment an API appears.

The Code Underneath

Every example above reduces to the same loop. Here is the smallest honest version, with the controls that keep it safe: an allow-list of tools, a confirmation gate on anything irreversible, and a hard step cap.

import anthropic

client = anthropic.Anthropic()

# One registry. The spec sent to the model and the function actually called
# are defined together, so they cannot drift apart.
TOOLS = {
    "get_order": {
        "fn": get_order,
        "irreversible": False,
        "description": "Fetch an order by id. Returns status, total, refund history.",
        "input_schema": {
            "type": "object",
            "properties": {"order_id": {"type": "string"}},
            "required": ["order_id"],
        },
    },
    "issue_refund": {
        "fn": issue_refund,
        "irreversible": True,
        "description": "Refund an order in full. Only call when policy allows.",
        "input_schema": {
            "type": "object",
            "properties": {"order_id": {"type": "string"}},
            "required": ["order_id"],
        },
    },
}

TOOL_SPECS = [
    {"name": n, "description": t["description"], "input_schema": t["input_schema"]}
    for n, t in TOOLS.items()
]


def _error(tool_use_id: str, message: str) -> dict:
    return {
        "type": "tool_result",
        "tool_use_id": tool_use_id,
        "content": message,
        "is_error": True,
    }


def run_agent(goal: str, max_steps: int = 8) -> str:
    messages = [{"role": "user", "content": goal}]

    for _ in range(max_steps):
        response = client.messages.create(
            model="claude-sonnet-5",
            max_tokens=1024,
            system="You are a support agent. Refund only within the 30-day policy.",
            tools=TOOL_SPECS,
            messages=messages,
        )
        messages.append({"role": "assistant", "content": response.content})

        if response.stop_reason != "tool_use":
            return "".join(b.text for b in response.content if b.type == "text")

        results = []
        for block in response.content:
            if block.type != "tool_use":
                continue

            tool = TOOLS.get(block.name)
            if tool is None:
                # Should be unreachable, but never crash on model output.
                results.append(_error(block.id, f"No such tool: {block.name}"))
                continue

            if tool["irreversible"] and not approved_by_human(block.name, block.input):
                return f"Escalated: {block.name} on {block.input} needs approval"

            try:
                output = tool["fn"](**block.input)
            except Exception as exc:
                # Hand the failure back. The model retries or gives up honestly.
                # Crashing here loses the whole run over one bad argument.
                results.append(_error(block.id, f"{type(exc).__name__}: {exc}"))
                continue

            results.append({
                "type": "tool_result",
                "tool_use_id": block.id,
                "content": str(output),
            })

        messages.append({"role": "user", "content": results})

    return "Escalated: step limit reached"

Four things carry the weight.

The registry is the permission boundary. The model cannot call what is not in it. One dictionary defines both what the model is told about and what actually runs, so the spec and the implementation cannot drift.

Errors go back into the conversation, not up the stack. A tool that raises returns is_error and the loop continues. This is the difference between an agent that recovers from a bad argument and one that dies on it, and it costs four lines. Most tutorial code omits it, which is why most tutorial agents are brittle.

max_steps is the spend cap. A loop without one is a bill.

The gate is keyed to the tool call, not the model’s stated intent. This is the part that matters for prompt injection. If a malicious instruction is hidden in an order note or a customer’s PDF, the model may well decide to call issue_refund — but the refund still cannot execute without a human. The security property does not depend on the model resisting the injection. It depends on the model being unable to act unilaterally in the first place. Design every gate so it holds even when the model has been fully persuaded.

One simplification to be honest about: approved_by_human here returns and ends the run. A production system pauses, persists the state, and resumes on approval — LangGraph’s interrupt_before is the reference implementation of that.

For a fuller treatment of that loop applied to analysis rather than actions, see building a Python AI agent for automated data analysis. Once an agent is in production, monitoring dashboards for AI agents covers the traces and failure views you will need on day two.

What the Examples Have in Common

• Natural-language procedures are the program. Fin’s Procedures, Decagon’s SOP-to-tool mapping, Agentforce topics: the operations team writes the policy, the model picks the path.
• Tools are converging on MCP. On 9 December 2025 Anthropic donated the Model Context Protocol to the Agentic AI Foundation, a directed fund under the Linux Foundation co-founded with Block and OpenAI, backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg — Block contributed goose and OpenAI contributed AGENTS.md to the same body. The count cited at the donation was around 10,000 active public servers. Agentic dashboards covers what that means for the analytics side.
• Thresholds beat all-or-nothing. The AP agents do not aim for 100%. They aim for a calibrated confidence score and a clean exception queue.
• Anything that runs code runs in a sandbox. Ephemeral runners, cloud VMs, branch restrictions, egress allow-lists.
• Evaluation before launch. Decagon aims for a couple of hundred conversations per workflow replayed through an LLM judge before go-live. Ramp built a 237-task accounting benchmark graded against 3,469 accountant-written criteria before trusting an agent to close the books.
• Pricing has moved to outcomes. Intercom charges $0.99 per resolution, HubSpot $0.50, and Zendesk runs $1.50–$2.00 — figures from Intercom’s own pricing comparison (vendor, comparing competitors — verify against each vendor’s own page before budgeting). Vendors betting on the agent finishing the job is a better signal than any demo.

Failure Modes to Avoid

• Production credentials in the agent’s hands. In July 2025 a Replit agent deleted a production database during a declared code freeze, then claimed rollback was impossible. It was not. Separate environments are not optional.
• Treating documents and emails as trusted input. EchoLeak (CVE-2025-32711) was a zero-click prompt injection: one crafted email made Microsoft 365 Copilot read internal files and exfiltrate them, with no user action at all. Every page, PDF, or message an agent reads is attacker-controlled until proven otherwise.
• Assuming the company is not liable for what the agent says. Air Canada argued its chatbot was a separate legal entity when it invented a bereavement fare. The tribunal disagreed and ordered the refund — the decision, Moffatt v. Air Canada, 2024 BCCRT 149, is short and worth ten minutes of any founder’s time.
• The exception queue nobody staffs. Every threshold system routes low-confidence cases to a human. Six months in, the queue is a thousand deep and gets cleared by rubber-stamp. The system is now running at full autonomy and nobody decided that — it drifted there. Monitor time-to-resolution and approval rate on the queue, not just its size. A 99% approval rate means the reviewer stopped reading, not that the agent got good.
• A procedure that outlives the tools it was written for. The natural-language procedure is the program, which means it needs the same discipline as code: version it, review changes, and re-run the evaluation set when it changes. An operations lead editing the system prompt on a Friday is a deploy.
• Reading deflection as resolution. Klarna’s headline numbers were real; so was the quality drop that followed.
• No step or spend cap. A looping agent on a per-token API is a bill, not a feature.
• Picking the showcase workflow first. Gartner expects more than 40% of agentic projects to be cancelled by the end of 2027 (analyst), mostly for unclear value and weak risk controls.

Before and After

What to Build First

1. Pick a workflow with high volume, a written policy, and reversible actions. Refund-within-policy, not account deletion.
2. Write the procedure in plain language the way you would brief a new hire. That document becomes the system prompt.
3. Expose three to five tools with the narrowest scopes that still complete the job.
4. Mark the irreversible ones and put a human approval in front of them.
5. Replay fifty real cases through it before anyone outside the team sees it.
6. Ship with a step cap, a spend cap, and a dashboard of escalations.
7. Raise the autonomy threshold only when the exception queue has been quiet for a month — and check that the queue is being read, not rubber-stamped.

That sequence is how the credible examples above got where they are. None of them started at 80% autonomy.

Final Take

The useful question is not whether something counts as an AI agent.

It is whether a piece of software can read what arrives, choose the right tools, check its own work, and know when to stop. Support tickets, invoices, pull requests, returns, and phone calls all have production examples that do exactly that, and open-source code that shows how.

Start with the workflow where being wrong is cheap and being slow is expensive. That is where agents pay for themselves first — and measure what was resolved, not what was deflected.