Why did the hard part of AI move from writing prompts to wiring systems? If you ran an experiment with ChatGPT in 2023, you probably remember the feeling: the model was impressive, the demo was easy, and the moment you tried to connect it to anything real — your CRM, your accounts, your project tracker — progress stopped. By the end of 2025 that gap had a name and an industry around it. The models had learned to act, and acting turned out to be the difficult part.

What actually changed

Agents were not invented in 2025. Autonomous tool-using systems had existed in research and narrow production settings for years, and earlier frameworks for chaining model calls were already circulating. What changed in 2025 is that the major model providers made agentic behaviour a mainstream, supported product surface.

The clearest marker came on 11 March 2025, when OpenAI announced the Responses API and the Agents SDK. In plain terms, these tools gave developers a standard way to let a model do three things that chat interfaces could not do reliably on their own:

  • Call tools. The model can invoke a function — look up a customer record, create a ticket, run a query — rather than only describing what a human should do.
  • Take multi-step actions. It can chain calls, use the result of one tool as the input to the next, and keep working toward a goal across several turns.
  • Work across systems. Built-in support for web search, file access and hosted tools meant the model could operate on real data, not just the text in the conversation.

Competitors and open-source projects shipped equivalent capabilities in the same period. The detail that matters for a business audience is not which SDK won; it is that "give the model hands" became a solved-enough plumbing problem. Once it was solved, every hard problem that had been politely hidden behind the chat window became visible.

Open weights reached the frontier conversation

2025 was also the year the open-weights ecosystem stopped apologising. In January, DeepSeek's R1 demonstrated reasoning performance that put open weights into the frontier conversation for the first time — released with open weights and at training economics that unsettled the pricing assumptions of the entire market. Through the year, Qwen, Kimi and Mistral published models that matched or beat the previous generation's frontier on broad suites of business-relevant tasks. The practical effect for a non-lab business: the gap between "best proprietary model" and "best model we can run privately" narrowed to the point where it stopped being the default deciding factor. Model choice became a procurement and architecture decision — capability per rand or pound, data residency, rate limits, vendor dependence — rather than a capability cliff. The plumbing problems in the next section did not care which model you had chosen.

Why the hard problems moved

An assistant answers a question. An agent does something. The moment a system does something, you need everything you would need for any employee or integration doing that thing — and most organisations discovered they had not built it for software that improvises.

Tool access. Which systems should the agent be able to touch, and with which credentials? An agent that can read your CRM can also, in principle, write to it. Read-only scopes, scoped API keys and per-tool permissions became design decisions rather than afterthoughts.

Permissions and identity. When the agent books a meeting or refunds a customer, whose authority is it acting under? Answering "the person who triggered it" turns out to be subtly wrong when the agent chains five steps past what that person imagined.

Evaluation. You cannot approve a pull request you cannot review. Teams found that a prompt which works 95% of the time fails silently at volume, and that "test it and see" does not scale past the demo. Structured evaluation sets — fixed tasks with expected outcomes — moved from research practice to delivery requirement.

Monitoring. Logs that record model inputs and outputs, tool calls and failures became essential, both for debugging and for accountability when something goes wrong.

Human escalation. The uncomfortable finding of 2025 was that the best-performing operational agents were not the most autonomous. They were the ones with clearly defined points where a confident, well-prepared human takes over. Knowing where those points are is a business decision, not a technical one.

Illustrative example: a mid-sized professional-services firm wants an agent to handle inbound client enquiries. The model drafts replies well. To actually work, the firm must decide: which parts of the CRM the agent may read, whether it may send replies unsupervised, what happens when it encounters an angry or legally sensitive message, and who reviews a sample of its work each week. None of those decisions appear in the model's price list. All of them are the integration work.

The trade-offs

More autonomy means fewer hand-offs and lower running cost per task — and a larger blast radius when the model is wrong. Fewer guardrails means faster deployment and less engineering — and harder audits, harder debugging and harder questions when a customer is affected. In 2025 the teams that got value were not the ones with the most capable model; they were the ones that chose the smallest scope for which reliable monitoring, permissions and escalation were actually in place.

What we take from 2025

The lesson generalises: once a capability becomes a commodity, advantage moves to the surrounding system. Models became capable actors in 2025; competitive advantage moved to whoever could wire those actors into their operations safely. That is an engineering problem first and a procurement problem second.

Action checklist

  • Inventory the systems an AI agent would need to touch, and define read-only versus write access for each.
  • Decide who or what the agent acts as, and document the permission model before building anything.
  • Build a small evaluation set of real tasks with expected outcomes, and run it on every change.
  • Log inputs, outputs and tool calls so any action can be reconstructed and reviewed.
  • Define explicit escalation points where a human takes over — especially for money, legal exposure and angry customers.
  • Start with one narrow, low-risk workflow rather than a general-purpose assistant.
  • Assign an owner for the agent in production, not just a builder for the prototype.

If your organisation experimented with agents in 2025 and stalled at the wiring, a structured technical review is the fastest way to find out which integration problems are real and which are assumed. Book a technical review or explore our AI-assisted improvements service.