AI agents for professional firms: what they can and can't do today

An AI agent does one defined job from your firm’s data and rules, then, by default, hands the result to a person to approve.

Microsoft’s Copilot Studio documentation says an agent follows the instructions you give it, draws on the knowledge sources you connect, and uses tools to take action, deciding the next step from its instructions and context. We think agents add capacity to the preparation work around client service. They don’t replace professional judgment, and they should not have the final say.

This guide is for owners and COOs deciding whether and where agents belong.

An agent does a job; a chatbot answers a question

A chatbot waits for a question. An agent takes on work: it takes an input, follows your steps, produces an output, and records what it did. A useful agent has four things.

• One clear job. It is named the way your team would name it, so everyone knows what it does and what it doesn’t.
• Limited access. It reaches only the data that job needs, not everything the firm holds.
• A reviewer. NIST says processes for human oversight are defined, assessed, and documented. By default, a person approves output before it reaches a client.
• A record. You can see what it saw and what it produced, after the fact.

The OS is what makes agents yours

Generic AI knows nothing specific about how your firm works. The Agent OS (AOS) is your own knowledge (procedures, templates, standards and past decisions), kept private to your firm, that your agents work from.

That context helps drafts follow your firm’s standards. Your team still reviews results and approves any changes to the knowledge or instructions used for future work.

Where agents add value

• Capacity without hiring. The preparation that fills your team’s week, such as gathering, organizing, checking and drafting, happens before a person picks the work up.
• Consistency. Every piece of work follows the same steps, and they are your steps.
• Earlier warnings. We think agents can check the whole set instead of a sample, so problems surface while there’s time to fix them.
• Visibility. You can see where all the work stands, not just what someone remembered to update.

What agents can’t do

• Exercise judgment. Deciding what matters, what a result means, or whether an explanation holds up stays with your people.
• Own the outcome. Your professionals approve, sign, and answer to the client.
• Replace relationships. Meetings, interviews and site work need a person in the room.
• Be perfect. Generative systems can confidently present erroneous or false content. NIST calls that confabulation. Good systems are designed around review, not around trust.

Where to start

Look for work that is repeated across many clients, deadline-bound, mostly gathering and checking with judgment at the end, and reviewable against a clear right answer. Most firms have several candidates. A readiness review ranks them by value. For accounting firms, our guide to AI agents for accounting maps seven jobs to their reviewers.

What to require before client data is involved

• Database isolation. In PostgreSQL, row security policies restrict, on a per-user basis, which rows can be returned by normal queries. The table owner is typically not subject to those policies, and superusers and BYPASSRLS roles always bypass them. Ask whether the accounts that run the service can bypass the control.
• Firm-specific keys. NIST says the proper management of cryptographic keys is essential to using cryptography for security. We think the keys should be specific to your firm. NIST does not itself require a separate key per customer.
• Model terms. Microsoft says prompts, responses, and data accessed through Microsoft Graph aren’t used to train foundation models. It also says the stored data includes the user’s prompt and Copilot’s response, and admins can set retention for those chats. “Not used for training” is not zero retention, so the contract should say which one is in effect.
• Records. There should be a permanent record of every approval and every model call.
• Retention. Data can be held and deleted under the rules in your agreement, including legal hold.

By default, a person still approves every output that leaves the firm.

Build, buy or have it built

Check the AI features and connectors in the software you already use first. Microsoft 365 Copilot connectors bring external, line-of-business data into Microsoft 365 Copilot. Compare the actual sources, actions, permissions and review controls with your requirements. Our recommendation: an internal build or a partner-built, scoped workflow may fit gaps your existing tools cannot cover.

Where Precision AI OS fits

Precision builds and runs agents and a private Agent OS for businesses across industries. Each firm’s data is isolated and encrypted with keys unique to it, models run only under zero-retention routing, with data collection refused on every request, and every approval is recorded. Your people stay in charge. See how we protect your data.

For the questions to ask any vendor or internal team, see build, buy, or have it built.