AGENT PROCUREMENT · OCTOBER 2026
Buy a controlled workflow, not a promise of autonomy.
The right agent platform can retrieve evidence, use approved tools and recover from exceptions within a defined authority boundary. Start with the job and integration requirements, then evaluate the platform category that fits them.
Write the job before the shortlist
An agent is useful when it can choose among permitted steps, use tools and carry state toward an outcome. A deterministic workflow is often better when every step is already known. Neither a chat interface nor a large model name tells you whether the underlying system can safely complete your work.
Write a contract with the trigger, required inputs, permitted actions, prohibited actions, completion evidence and escalation owner. For a returns workflow, completion might mean an approved return label exists and the customer receives the correct instructions. Sending a plausible message is not completion. Record what the system must do when the order is missing, the policy is ambiguous or the customer disputes the outcome.
State the authority ceiling explicitly. Reading order status, drafting a response, changing an address and issuing a refund are different permissions. You can buy one platform while enabling these capabilities in stages rather than granting the entire integration scope at launch.
Compare three categories rather than one long ranking
Developer runtimes give engineering teams control over tools, persistence and execution. LangGraph’s documentation covers durable execution and human oversight. OpenAI’s SDK documentation describes guardrails around inputs, outputs and tools. These are building blocks; your application still needs identity, authorization, tests and operations. LangGraph overview; OpenAI guardrails
Automation builders connect triggers and actions with a lower implementation barrier. Their operational economics differ: n8n describes workflow executions, Make uses credits, and Zapier uses successful billable actions as tasks. Compare an actual representative workflow, including branches and retries, instead of dividing a monthly fee by incoming requests. n8n pricing; Make pricing; Zapier pricing
Business platforms supply packaged context, administration and workflows in a domain such as service or enterprise operations. Google’s agent product page and SAP’s Joule Studio announcement describe managed agent capabilities. Verify your product edition, regional availability, integrations and permissions in a demonstration and written entitlement statement. A product announcement is not proof that your particular workflow is available. Google enterprise agents; SAP Joule Studio
Ask for a pilot that can fail honestly
Build a replay set from representative requests, with sensitive fields removed. Include ordinary cases, missing information, conflicting instructions, stale policy, duplicate events and tool outages. Keep the expected business outcome and unacceptable behaviors beside every case. Do not let the vendor choose only easy examples.
Score task completion, unauthorized action attempts, escalation quality, latency and fully loaded cost independently. A high completion rate cannot compensate for changing the wrong customer’s account. Separate failure to retrieve evidence from failure to reason about it; otherwise a model upgrade may appear to fix a broken connector temporarily.
Require an exportable trace showing retrieved documents, tool arguments, approvals and final state. Ask the team to resume after a timeout without repeating a side effect. Demonstrate a human taking over an unresolved case with its context intact. Review the actual action record in the destination system rather than trusting a green platform status.
Turn the contract into a practical checklist
Request details of data retention, model subprocessors, tenancy, access controls, secret handling, audit export and incident support. Ask which elements are customer-configured and which are contractual commitments. A security logo on a website does not establish that your integration has the correct access boundary.
Treat retrieved documents and tool responses as untrusted instructions. The MCP security guidance documents authorization risks, including confused-deputy and token-handling problems; connecting a compatible server does not make its tools safe. Confirm who authorizes each action and prevent a document from expanding that authority. MCP security guidance
Agree on a change policy. Models, prompts, retrieval indexes and vendor packages can change independently. Name the changes that trigger your regression suite, the person who can approve promotion, and the fallback workflow when an incident occurs. Ensure you can export the data and logic needed to move a critical process elsewhere.
Compare the choices
| Category | Good fit | Cost or control tradeoff |
|---|---|---|
| Developer runtime | Custom multi-step work with an engineering owner | More control; you own infrastructure and operational reliability. |
| Automation builder | Well-defined integrations and moderate branching | Faster assembly; billing units and retry behavior need testing. |
| Domain platform | A packaged business workflow with mature administration | Less assembly; verify scope, lock-in and actual entitlements. |
| Simple workflow | A predictable sequence with clear rules | Less flexibility; often easier to audit and maintain. |
Worked example: make the decision concrete
Illustrative selection: an online retailer wants order-status responses and returns triage. Its first pilot allows authenticated reads and draft replies, but no refund action. A platform passes the easy cases yet loses the order identifier after a handoff. That is a workflow failure even if its answer sounds helpful.
The retailer adds an explicit case record containing the customer, order, policy version and action state. It then tests a duplicate delivery webhook and an unavailable carrier API. A suitable system suppresses repeated actions, acknowledges unavailable evidence and leaves a clear queue entry for a human. Only after this behavior works should the buyer discuss a wider permission scope or a larger traffic share.
Failure modes to plan for
A common buying mistake is counting tools instead of proven outcomes. More connectors can mean more access paths to govern. Another is accepting vendor-defined resolution without checking reopened cases or customer confirmation.
Hidden operational costs include knowledge maintenance, connector changes, escalation review and on-call recovery. Record those duties in the operating model before signing. Avoid exclusivity claims and leaderboard numbers without reproducible comparative evidence: this guide does not establish that one supplier alone can perform commerce service, or that a particular runtime has a measured market share.
Your useful next step
Choose one bounded workflow and write its action contract. Ask two or three suitable platforms to run the same exception-heavy replay set, show destination-system evidence, and provide a complete cost proposal. Keep mandatory authority controls as pass-or-fail gates.
Questions and answers
Do we need an agent rather than automation?
Use an agent when the next permitted step depends on changing context. Use deterministic automation when the sequence and rules are known; the two approaches can coexist in one workflow.
Does human approval prevent a system from being an agent?
No. Human approval is an authority boundary. The system can still retrieve information, choose permitted steps and prepare an action before requesting approval.
Is MCP a security certification?
No. MCP is an integration protocol. Secure operation still requires authentication, authorization, trustworthy tool definitions, limited credentials and monitoring.
What should decide the purchase?
A repeatable pilot on your real workflow, including exceptions and recovery, plus acceptable controls and complete operating cost. Marketing autonomy labels are insufficient.
Sources and evidence scope
Primary sources checked on 11 October 2026. Product pages establish vendor-described features; they do not establish independent comparative performance. Worked examples are explicitly illustrative. Implementation recommendations are editorial guidance.
- LangGraph overview — Documents durable execution, persistence, streaming and human oversight for agent orchestration.
- Guardrails — Documents input/output and tool guardrails; guardrails do not themselves replace authorization.
- N8N — Starter shown at €20/month billed annually for 2.5K workflow executions with unlimited steps; unlimited steps are not unlimited executions.
- Make — Current unit is credits. Most actions consume one; some AI actions consume more; routers do not consume credits.
- Zapier — Each successful billable action is a task; combining actions into Paths does not turn a multiaction workflow into one task.
- Google Agents — Google product page describes creation/deployment/governance of Google, partner and custom agents.
- Sap — May announcement supports enterprise agent lifecycle/runtime/governance; implementation still requires entitlement and workload verification.
- MCP security best practices — Documents authorization and token-handling risks including confused deputy and token passthrough.
Research Path