The fantasy is one autonomous agent that runs the whole company. The useful version is narrower: an agent scoped to a single system (Salesforce, SAP, ServiceNow, Jira, Workday) that knows that system deeply and can’t touch anything else.
The narrowness is the point. A scoped agent gets the system’s real semantics: its objects, its permissions model, its validation rules. It gets a bounded action space and an audit trail a security team will actually sign off on. A do-everything agent can’t be reasoned about; its blast radius is the union of every system it touches, and nobody can say in advance what it will or won’t do. Enterprises don’t buy capability they can’t bound.
Scope also maps onto structures organisations already run. Your Salesforce admin is a scoped human agent: they know CRM deeply, they can’t touch ERP, and their access follows a role the security team already approved. Give a software agent the same shape and the same questions apply: what can it reach, what can it change, who reviews the changes? Because the action space is bounded, a reviewer can actually enumerate it. That’s the difference between an audit that means something and one that waves at a black box.
A Salesforce specialist can inspect an opportunity, explain why a missing field is blocking the next stage, update the next step, log a meeting note, and, when a change is risky, stop and ask before committing. The same shape holds for a ServiceNow or SAP specialist (the essay walks through both). In each case the agent stops being a chatbot bolted onto an app and becomes the interface to the system itself.
Scope on its own doesn’t make an agent safe; it makes an agent governable. Those are different things. Governable means you can wrap a control loop around it, and the permission-boundary is only the precondition for the rest.
The governance loop works inside one system. Real workflows don’t stay inside one system. A renewal touches CRM, billing, legal, email, calendar, and support tickets, so a wall of narrow agents that can’t coordinate is as useless as one broad agent is dangerous. The missing layer is orchestration: broad intent, narrow execution. A conversational orchestrator holds the cross-system goal and routes work to the specialists; each specialist still does every mutation inside its own boundary. And the hardest boundary to draw is memory: what a specialist is allowed to learn and carry forward.