Implementation guideEnterprise AI AgentsVersion 1.023 October 2026
Enterprise AI agents implementation, phase by phase
To implement enterprise AI agents, start with one workflow already in production, measure it before the work starts, give every agent its own identity, a declared scope and a stop path, then raise its autonomy step by step only when the record of its actions supports it. The phases are the same whether the agent works in your ERP, your CRM or another core system: it acts under its own identity, within a declared scope, and a named person approves every step that commits the company. This guide sets out the 4 phases we run, the controls each installs and the evidence each leaves, checked against primary sources on 23 October 2026.
On this page
A written method, testable step by step.
In this guide, "we" means Hikari Blue, the firm that engineers and operates the agents with the client team. The phases, controls and autonomy levels are those of our Enterprise AI Agents offer; the external texts cited are those in force on 23 October 2026.
An agent, here, is software that pursues a task by calling tools in your systems: it reads a record, drafts a proposal, prepares a payment, routes an exception. A model that only answers a question is not an agent in this sense, and needs fewer of the controls below.
An agent writes to your systems. 3 questions decide whether it can run in production.
Who is acting, what may it touch, and how does it stop. A pilot can leave all 3 open; a workflow in production cannot, because the first incident is answered from the record, not from the design document.
Who is acting · identity
Each agent acts under its own identity, issued by your identity provider and tied to the role it serves, never a shared service account. The NIST NCCoE concept paper of February 2026 sets the same aim: link user identities to agents to keep accountability for automated actions.
What it may touch · scope
Tools, data and spend are declared per agent, and any other call is refused before it runs. Tool misuse (ASI02) and identity and privilege abuse (ASI03) sit in the OWASP Top 10 for Agentic Applications of December 2025.
How it stops · the stop path
The workflow halts on demand, at the infrastructure level, and the time to stop is measured in a drill. NIST AI RMF MANAGE 2.4 asks for mechanisms to supersede, disengage or deactivate an AI system; for high-risk systems, Article 14(4)(e) of the EU AI Act asks for a stop button or a similar procedure that brings the system to a halt in a safe state.
What it did · the record
Every action, tool call and human decision is written to an append-only record at the moment it happens. The NCCoE concept paper asks the open question in the same terms: how agents can log their actions and intent in a tamper-proof and verifiable manner.
Articles 14 and 26 of the EU AI Act bind high-risk systems and their deployers. Since Regulation (EU) 2026/1744, published on 24 July 2026, they apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. We install the same controls on every agent, whatever its risk class.
Discover. Engineer. Deploy. Operate & Scale.
Each phase ends with its deliverables and a decision before the next. The method frames the work; an organization that already knows its first workflow joins it at Engineer.
- 01
Discover · one workflow, measured
We map the workflow with the people who run it, measure the baseline and choose the first agentic workflow on value and risk. Each step of the workflow receives an autonomy level before anything is built.
Evidence: workflow map and baseline, value case with full costs, autonomy level for each step, the named owner.
- 02
Engineer · agents and their controls
We build the agents, their tools and permissions, the integration with your systems and the controls around them: one identity per agent, a declared scope, approval gates on consequential steps, the action record and the stop path.
Evidence: agent register, permission matrix, approval gates, evaluation set with its results, a first exported record.
- 03
Deploy · in stages, against the baseline
We put the workflow into production in stages, with your team, and compare each stage with the baseline. The stop procedure is drilled before the agents run at scale.
Evidence: staged rollout plan, runbooks and stop procedure, drill record with the measured time to stop, before-and-after report.
- 04
Operate & Scale · on the evidence
We run, measure and improve the agents, review the record with the named owner, then extend to the next workflow on the evidence, or hand over to your team.
Evidence: operating review minutes, cost and quality reporting, autonomy changes with their reason, next workflow or handover plan.
| Phase | Decision before the next phase | Taken by |
|---|---|---|
| Discover | Is this workflow worth agents, and at which autonomy for each step? | The accountable executive, with the named owner |
| Engineer | Do the evaluation results and the controls allow a first production stage? | The named owner and the risk owner |
| Deploy | Does each stage beat the baseline, net of the full cost of the agents? | The named owner, on the before-and-after report |
| Operate & Scale | Extend, change the autonomy of a step, hand over or retire? | The named owner, at the operating review |
Commercial path. The first exchange is free. The Operating Assessment takes 1 week on one critical workflow, from $18,000, and delivers the Time to Stop, the workflow's value, a named owner and a plan to put it into production. Engineering and operation missions are scoped from it and paid in phases, each ending with a go/no-go.
Permissions, record, stop: installed before the first action.
3 controls sit on every agent, and an approval gate sits on every step that commits the company. Each row names what the control requires, the evidence an auditor asks for, and the external text it answers.
| Control | What it requires | Evidence an auditor asks for | External reference |
|---|---|---|---|
| Permissions · identity | Its own identity from the enterprise identity provider. Nothing is inherited by default. | The agent register, reconciled weekly with the identity provider. | NIST AI RMF GOVERN 1.6 · OWASP ASI03 · NCCoE, February 2026 |
| Permissions · scope and budget | Declared tools, data and spend. A call outside that scope is refused before it runs. | The permission matrix and the denial log, each denial stamped with the policy version that refused it. | OWASP ASI02 · ASI05 |
| Approval gate | A named person approves every consequential step, with the context in front of them, before the agent acts. | The human verification field of each record: identity, decision, reason. | EU AI Act Art. 14(4)(d) and 26(2), high-risk · OWASP ASI09 |
| Record | Every action, tool call and human decision written append-only as it happens, in 9 fields, chained by hash. | An export of one past decision, without manual assembly, and the chain verification. | EU AI Act Art. 12 and 26(6), high-risk · NCCoE, February 2026 |
| Stop | Any named operator halts an agent, a model or the workflow in one action; only the risk owner authorizes the restart. | The stop runbook and the drill record, with the measured time from trigger to halt. | NIST AI RMF MANAGE 2.4 · EU AI Act Art. 14(4)(e), high-risk · OWASP ASI10 |
The 9 fields of the record are those of our published reference architecture: actor identity, model and version, policy applied, residency corridor, inputs reference, action, human verification, timestamp and hash chain.
Autonomy is a setting per step, not a property of the agent.
The level follows the risk of each step: the higher the risk, the closer the human decision. It rises at an operating review, on the evidence of the record, and can be lowered at any time.
| Level | The agent | Your people | Typical steps |
|---|---|---|---|
| 1 · Assistance | Prepares. A person acts. | Decide and execute. | Drafting a proposal, summarizing a file, suggesting a match. |
| 2 · Supervised execution | Acts once a person approves. | Approve at the gate, with the context in front of them. | Sending a quote, preparing a payment, posting an entry above a threshold. |
| 3 · Bounded autonomy | Acts alone, within limits you set. | Set the limits, review the record, stop it at any time. | Updating the CRM, matching below a threshold, routing an exception. |
Nothing that moves money or commits the company leaves without a named person's decision. Payment files are prepared by an agent, never released by one.
The OWASP agentic risks, each answered by a control and a test.
The OWASP GenAI Security Project published its Top 10 for Agentic Applications in December 2025, and advises organizations to avoid unnecessary autonomy. Each risk below is answered by a control installed in the Engineer phase and tested in the Deploy phase, before the agents run at scale. The mapping is ours; OWASP has not reviewed it.
| OWASP risk | What answers it | Test before go-live |
|---|---|---|
| ASI01 · Agent Goal Hijack | Declared scope, approval gates on consequential steps, inputs recorded by reference. | Feed the agent a document carrying hidden instructions: the out-of-scope action is refused and logged. |
| ASI02 · Tool Misuse and Exploitation | Tool scope and budget per agent, enforced before the call. | Call a tool outside the declared scope: the call is denied before it runs. |
| ASI03 · Identity and Privilege Abuse | One identity per agent, no shared account, no inherited access. | Revoke the agent's identity: every tool it used is cut at once. |
| ASI04 · Agentic Supply Chain Vulnerabilities | Model, version and tools pinned in each record; changes go through change control. | Change a model version: the switch appears in the record with its author and time. |
| ASI05 · Unexpected Code Execution (RCE) | Code execution is a declared tool like any other, or it is absent. | Ask the agent to run code its scope does not declare: refused and logged. |
| ASI06 · Memory & Context Poisoning | Sources consulted recorded by reference or hash, so each output can be traced to what it read. | Trace one output back to its sources from the record alone. |
| ASI07 · Insecure Inter-Agent Communication | Calls between agents pass through the same identities, policies and record as calls to tools. | Have one agent ask another for an action outside its scope: refused and logged. |
| ASI08 · Cascading Failures | Staged rollout, and a stop per agent that leaves the rest of the workflow running. | Halt one agent: the others keep running and the halt lands in the record. |
| ASI09 · Human-Agent Trust Exploitation | Approval gates that show the context, and a recorded reason for every decision. | Sample the approvals: each names the approver, the decision and the reason. |
| ASI10 · Rogue Agents | A stop path and credential revocation, which OWASP itself recommends. | Trigger the stop: measure the time to halt and confirm the permissions are revoked. |
The gain is measured on your operations, net of the full cost of the agents.
Every engagement starts with a baseline and closes each phase with a before-and-after comparison. 11 indicators are reviewed with the named owner at each operating review.
Speed and volume · 3
Average handling time, resolution lead time, volume processed by agents and by people.
Quality and control · 3
Exception rate, errors found downstream and rework, human interventions step by step.
Cost · 2
Cost per operation, and the agent operating cost: integration, maintenance, inference and supervision, counted in full.
Impact · 3
Net economic impact when it can be quantified, a before-and-after comparison that isolates the project, and the cost of inaction when relevant.
What executives ask before the first agent goes live.
Where does an enterprise AI agents implementation start?
With one workflow already in production and a baseline measured before the work starts. The Operating Assessment, 1 week, chooses that workflow with you on value and risk, sets the autonomy level of each step and names its owner.
Which controls must exist before an agent acts alone?
Its own identity, a declared scope and budget, an append-only record of every action and a stop path whose time to stop has been measured. Autonomy is granted step by step, within limits you set, and nothing that moves money leaves without a person's decision.
Does the EU AI Act regulate AI agents?
The Act does not use the word agent: it regulates AI systems by their use. An agent used in an Annex III area, such as creditworthiness assessment or recruitment, is a high-risk system: human oversight under Article 14 and the deployer duties of Article 26 then apply, from 2 December 2027 under Regulation (EU) 2026/1744.
We already run agents. Can you take them over?
Yes. We review what runs, put it under the same controls (a named owner, a full record and a way to stop), measure it, then decide with you what to industrialize, rebuild or retire.
Which models do the agents run on?
The architecture works with Anthropic, OpenAI, Mistral or Google models, and model choice is a routing decision per task, reversible at any time. You are not bound to one vendor.
What does it cost to start?
The first exchange is free. The Operating Assessment takes 1 week, from $18,000. Engineering and operation missions are scoped from it and paid in phases, each ending with a go/no-go.
Reference documents and primary sources.
Every external reference on this page comes from the sources below, read on 23 October 2026.
Reference documents
- Enterprise AI Agents The offer: agents engineered into your workflows, measured on your operations, full costs included.
- Agentic AI, governed for production The definition: what an agent is, and what makes it governable.
- AI in production for the middle market One workflow, replaceable models, a named owner, a full record and a way to stop, paid in phases.
- AI Operating Layer Reference Architecture v1.0 4 planes, 4 testable controls and the 9-field record.
- Enterprise AI Governance Framework v1.0 15 controls with owners, cadences, evidence and EU AI Act hooks. CC BY 4.0.
- NIST AI RMF implementation, control by control The 15 controls mapped to NIST AI RMF 1.0 subcategories, with their evidence.
- KILLSWITCH by Hikari Blue · Time to Stop Definition and method for timing a stop, in a tabletop Kill Switch Drill.
Primary sources, consulted on 23 October 2026
- EUR-Lex · Regulation (EU) 2024/1689, the AI Act, consolidated text (opens in a new tab) Version of 27 July 2026. Articles 12, 14 and 26.
- EUR-Lex · Regulation (EU) 2026/1744, Digital Omnibus on AI (opens in a new tab) Published on 24 July 2026. New application dates for the high-risk obligations.
- NIST AI 100-1 · AI Risk Management Framework (AI RMF 1.0) (opens in a new tab) NIST, January 2023. GOVERN 1.6 and MANAGE 2.4. PDF.
- NIST NCCoE · Accelerating the Adoption of Software and AI Agent Identity and Authorization (opens in a new tab) Draft concept paper, February 2026: identification, authorization, delegation, logging. PDF.
- NIST CAISI · AI Agent Standards Initiative (opens in a new tab) Launched on 17 February 2026: standards, open protocols, agent security and identity research.
- OWASP GenAI Security Project · Top 10 for Agentic Applications for 2026 (opens in a new tab) Published on 9 December 2025. Risks ASI01 to ASI10.
How to cite this document.
This URL is permanent and always serves the current version. Each change of substance increments the version and is listed in the changelog below, so a citation stays traceable to the text it quoted.
Preferred citation
Hikari Blue, "Enterprise AI agents implementation, phase by phase v1.0", 23 October 2026, https://hikariblue.com/solutions/enterprise-ai-agents/implementation
Section anchors are stable: #status, #difference, #phases, #controls, #autonomy, #risks, #measure, #faq, #references, #cite.
Changelog
v1.0 · 23 October 2026. First public version.
Editorial correction · 25 October 2026: license extended to this page (CC BY 4.0).
License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.
Bring one workflow. Leave with the first agentic move.
30 minutes with a named partner. We place one workflow you run today against the 4 phases and the controls, and show which step an agent could take first, at which autonomy level, and what it would have to prove. You leave with that map, whether or not we work together.
- One workflow, mapped step by step
- The autonomy each step allows
- The evidence an agent would have to produce