An AI agent that can issue a credit note, reroute a misapplied payment or close out a billing query without a human touching it is worth real money to a services business. The task is high volume, low judgement, and it clogs up someone who should be doing something else. The models available in the second half of 2026 are more than capable of the reasoning involved. What decides whether the thing works in production is not the model. It is the layer of plumbing around it — the part that stops one confused agent turn from becoming forty-three of them.
That distinction has been made concrete this quarter by a run of documented failures at organisations with far more engineering depth than the average Australian SME. Reading them closely is the fastest way to work out what to build before an agent gets write access to anything that touches money.
What actually broke
Red Hat published a post-mortem dated 16 July 2026, last updated 2 September 2026, describing a production agent deployment that produced 43 duplicate support tickets, US$4,000 charged to the wrong billing account, and a hallucinated refund policy that led to a US$280 refund. None of those three failures is a reasoning failure in the interesting sense. The duplicate tickets are a missing idempotency key. The misapplied charge is a missing approval fence on an irreversible write. The invented refund policy is a retrieval and grounding problem compounded by the absence of any check between what the agent told the customer and what the company's actual policy said. Red Hat's argument is that popular agent frameworks ship the reasoning loop and leave state tracking, guardrails, audit trails, idempotency and rollback to you.
On 30 July 2026, Anthropic reported that three Claude models had reached live systems belonging to three external organisations during security testing, because of a sandbox misconfiguration. The detail worth sitting with is that the models were not disobeying instructions. The boundary was drawn in the wrong place, and capable software found the gap. Anthropic has separately published simulation work on agents that pursue an objective past the point where a human would have stopped, which matters for anything you point at collections, dunning or retention offers, where the objective and the customer's interests are not perfectly aligned.
Then the security side. Hugging Face disclosed on 16 July 2026 that part of its production infrastructure was breached through an autonomous agent framework that executed more than 17,000 actions across short-lived sandboxes over a single weekend. Security firms also documented JadePuffer in early July, described as the first fully autonomous agentic ransomware operation, which chained a Langflow remote-code-execution flaw into credential harvesting, encryption of AI artefacts and production databases, and ransom delivery with no human at the keyboard. A July incident roundup, last updated 6 September 2026, notes a separate case of a model escaping a test environment and an open-source agent left running unattended against a national finance ministry.
The common thread across all of it is speed and volume. An agent that goes wrong does not go wrong once. It goes wrong at machine rate until something stops it.
The controls to build before the agent touches money
Idempotency on every write
Every action that creates or changes something — a ticket, an invoice line, a refund, a payment allocation — needs a deterministic key derived from the business event, not from the agent's turn. Same customer, same invoice, same intent, same key. The downstream system rejects or returns the existing record on a repeat. This is the single control that would have turned Red Hat's forty-three tickets into one. Agents retry. Networks time out mid-write and the agent sees a failure that was actually a success. Assume both.
Hard caps on spend and actions
Two numbers, enforced outside the model: maximum dollar value of any single action, and maximum number of write actions per run and per hour. A refund agent might be allowed to approve anything under $150 and up to twenty refunds an hour. Past either line it queues for a human. These caps live in the orchestration layer, not in the prompt. A cap you can only express as an instruction is a suggestion, and the Anthropic sandbox case is a reminder that capable systems find the edges of poorly drawn boundaries without any intent to misbehave.
Approval fences on the irreversible
Classify every tool the agent can call as reversible or not. Sending a draft to an internal review queue is reversible. Issuing a refund, cancelling a subscription, deleting a record, emailing a customer a policy commitment or moving money between accounts is not. Irreversible actions get a human approval step with enough context in the approval message that the reviewer can actually judge it — the customer, the amount, the reason, the policy clause the agent relied on. If the reviewer has to open three systems to decide, they will start rubber-stamping within a fortnight and you have bought nothing.
Audit trails you can reconstruct a decision from
Log the inputs the agent saw, the tools it called with what arguments, the results, and the final action, tied to a run ID a support person can quote. When a customer rings in three weeks later disputing a credit, you need to answer what the agent did and why in minutes. This is also how you catch the hallucinated-policy class of failure early: periodically sample completed runs and check the stated policy against the real one.
Scoped, short-lived credentials
The agent gets its own identity in Xero, your CRM and your ticketing system, not a shared admin key. Scope it to the specific endpoints it needs and nothing more, rotate it, and make sure it cannot read the credential store. JadePuffer's value came from credential harvesting after initial access; the blast radius of a compromised agent is exactly the set of permissions you gave it. Keep test and production agents on separate credentials and separate network paths — the July roundup's test-environment escape is the cautionary version of treating staging as harmless.
A kill switch anyone on shift can reach
One control, documented, that halts all agent runs immediately and does not require the person who built it. Pair it with an alert on the rate of write actions, because seventeen thousand actions in a weekend is only alarming if someone is counting. Test the switch on a schedule, the way you would test a backup restore.
Where the controls actually sit
None of this belongs in the prompt. It belongs in the workflow layer between the model and your systems of record — the queue, the approval step, the idempotency store, the log. That is the argument for building agents on an orchestration platform such as n8n or a Retool front end with real approval screens rather than wiring a framework straight into your finance stack, and it is most of what we do when we design and deploy AI agents that hold write access to production systems. The model is swappable. The fences are the asset.
The economics now favour building the fences properly. A model pricing roundup dated 4 September 2026 puts Z.ai's GLM-5.3-Flash at US$0.15 per million input tokens and US$0.50 per million output tokens — roughly AU$0.23 and AU$0.78 respectively at an exchange rate near AU$1.55 to the US dollar. Running the agent is close to free relative to the value of the work. Governing it is where the engineering goes, and given the pricing, that is the right place to spend. The same roundup describes GLM-5.3-Flash as arriving on 26 August 2026 under the MIT licence with weights published on Hugging Face, which makes a self-hosted agent a genuine option where billing data cannot leave Australian infrastructure.
Start with one number
Before anything else, write down the largest irreversible action your proposed agent could take in a single call — the biggest refund, the biggest payment reallocation, the most consequential email — and then answer honestly how long it would take you to notice a hundred of them. If the answer is longer than an hour, you know which control to build first, and you know the cap to set on day one.
If you would rather not work that out alone: send us the workflow you want automated and the systems it would write to, and we will come back with a scoped build — the specific fences, where approvals sit, what the agent is allowed to do unsupervised, a fixed price and a delivery window that is usually two to four weeks. If the honest answer is that the process needs tidying before an agent should go near it, we will tell you that instead, with the reasoning.