Deploying AI Agents in Production: What Nobody Tells You
I spent six months in 2025 watching a team at a major fintech company burn $2.3 million on AI agents that never made it past staging. The CTO told me their biggest problem wasn't the model — it was everything around it.
You're here because you've built something that works on your laptop. Now you need to know how to deploy AI agents in production without learning the hard way. I'll tell you exactly what we've learned at SIVARO deploying for 40+ clients since 2022.
Let me be direct: most advice about ai agents deployment best practices is written by people who've never had to wake up at 3 AM to kill a runaway agent that just ordered $47,000 worth of cloud compute.
The Architecture Trap
Everyone starts with the wrong question. They ask "which agent framework should I use?" before asking "how do I stop this thing from destroying my infrastructure?"
Here's what we've learned after testing 14 different frameworks across production workloads: AI Agent Frameworks: Choosing the Right Foundation isn't wrong, but it's incomplete. The framework matters less than your deployment topology.
A framework handles agent orchestration — planning, tool selection, memory. But production is about limits. Time limits. Token limits. Budget limits. Error budgets.
We tested CrewAI, LangGraph, AutoGen, and Semantic Kernel head-to-head in early 2026. LangGraph won on flexibility but lost on observability. AutoGen was easier to debug but harder to scale. The How to think about agent frameworks post from LangChain gets this right: pick based on your failure modes, not your success modes.
My take: Start with the simplest framework that gives you these three things — state persistence, tool timeouts, and human-in-the-loop hooks. Everything else is noise.
The Three-Layer Deployment Model
After burning through three different architectures in 2023 alone, we settled on a pattern that's now running in production across 12 enterprise deployments.
python
# Layer 1: Agent Runtime - stateless, ephemeral
class AgentRuntime:
def __init__(self, config: AgentConfig):
self.config = config
self.max_steps = 25 # Hard limit
self.max_tokens = 40000
self.timeout_seconds = 120
async def run(self, task: Task) -> AgentResult:
# Each run is isolated. No side effects.
# If it crashes, the orchestrator retries.
async with supervise(timeout=self.timeout_seconds):
return await self._execute(task)
Layer 1 is your agent runtime. Stateless. Ephemeral. It's the part that thinks, plans, and calls tools. Each run gets a fresh context. No shared state. This is non-negotiable for production.
Layer 2 is the orchestrator. It manages the lifecycle. Queues tasks. Handles retries. Reports metrics. This is where you put your circuit breakers and rate limiters.
Layer 3 is the infrastructure layer. Observability. Logging. Cost tracking. Alerting. This is the most important layer and the one everyone skips.
The Agentic AI Frameworks: Top 10 Options in 2026 list is useful, but none of them enforce this three-layer model out of the box. You have to build it yourself.
Observability Is Your Only Safety Net
In July 2025, I sat with a team that had deployed an agent for customer support triage. Three hours after launch, the agent was apologizing to customers in French. The model had switched languages mid-conversation. No one noticed for 47 minutes.
Their monitoring stack was built for APIs — 200s and 500s. Agent monitoring is completely different.
python
# What production agent monitoring actually looks like
class AgentTelemetry:
def __init__(self):
self.traces = []
self.cost_per_step = {}
self.decision_latency = []
def capture_step(self, step: StepResult):
self.traces.append({
"step_number": step.number,
"action": step.action,
"tokens_used": step.tokens,
"latency_ms": step.elapsed_ms,
"tool_name": step.tool,
"model_output_hash": hash(step.raw_output)
})
Every step matters. Every tool call. Every decision. This isn't optional.
We instrument every agent with these metrics: step count distribution, tool failure rate by tool, token consumption per decision, decision reversal rate (agents that change their mind), and conversation drift (how far from the original task).
The A Survey of AI Agent Protocols paper covers this well — standardizing how agents report their internal state is the next frontier. Until that's adopted, build your own.
The Tool Safety Problem Nobody Talks About
Agents are only as safe as their tool access. And most frameworks give tools too much power.
Here's what happened at a mid-sized logistics company in February 2026: their inventory agent had access to a database write tool. The agent was supposed to update stock levels. It accidentally dropped a table. Not malicious — just following a poorly phrased instruction.
The fix isn't "add more human review." The fix is tool isolation.
python
# Tool sandboxing pattern we use everywhere
class SafeToolWrapper:
def __init__(self, tool: Tool, mode: str = "read_only"):
self.tool = tool
self.mode = mode
self.allowed_operations = {
"read_only": ["SELECT", "GET", "SEARCH"],
"append_only": ["INSERT", "ADD"],
"full_access": ["UPDATE", "DELETE", "DROP"]
}
async def execute(self, params: dict) -> ToolResult:
if self.mode == "read_only" and self._is_write_operation(params):
return ToolResult(
success=False,
error="Write operations not allowed in current mode"
)
return await self.tool.execute(params)
Every tool should be wrapped with mode enforcement. Read-only by default. Append-only when necessary. Full access requires explicit approval and rate limiting.
We also enforce tool budgets. An agent gets $X worth of tool calls per task. Once it's spent, it's done. This prevents the "agent keeps calling expensive APIs" problem.
Human-in-the-Loop: Not Where You Think
Most people put human review at the end — before an agent executes an action. This is wrong.
The right place for human review is at escalation points, not every decision point. If your agent needs human approval for every database update, you've built a slower version of a human processing queue.
Here's what works: define a confidence threshold for every action. If the agent's confidence in its decision is below 80%, it escalates. If it's above, it executes autonomously.
We tested this against the "always review" approach in Q4 2025 with a healthcare scheduling agent. The confidence-based approach was 4x faster and caught the same number of errors. The difference was noise reduction — humans only saw the borderline cases.
But here's the contrarian take: you need human oversight during the first 72 hours of any new agent deployment. Period. We learned this the hard way when a customer's document processing agent started "summarizing" confidential data into a public Slack channel. The framework didn't catch it. The model didn't catch it. Only a human watching the output stream caught it.
AI Agent Protocols: 10 Modern Standards is starting to address this with standardized handoff mechanisms. Watch for this space.
Memory Management Is Infrastructure
You can't just give an agent all its conversation history and expect it to work. Context windows have limits. Costs scale with tokens. And agents get confused when you feed them 50,000 tokens of irrelevant context.
We use a tiered memory system:
python
class AgentMemory:
def __init__(self):
self.short_term = [] # Last 10 interactions
self.working_set = [] # Current task context
self.long_term = VectorStore(provider="pinecone") # Persistent
def prepare_context(self, task: Task) -> str:
recent = self.short_term[-5:] # Only 5 most recent
relevant = self.long_term.similarity_search(task.query, k=3)
return format_context(working_set + recent + relevant)
Short-term memory holds the last few interactions. Working set is the current task context. Long-term is a vector store with semantic search.
The trick is compaction. We run a background process that summarizes old conversations into embeddings. This keeps the vector store manageable and the agent focused.
For production, you need to think about: memory expiration (how long before context is stale), memory isolation (don't mix contexts between users), and memory cost (vector stores aren't free).
The Cost Crisis Nobody Warned You About
I'll be blunt: AI agents are expensive to run in production. Not because of the model costs — those are actually dropping. Because of the tool costs.
Every time your agent calls an API, that costs money. Every time it writes to a database, that costs money. Every time it spins up a compute instance to run a script, that costs money.
We tracked costs across 14 production agent deployments in 2025-2026. The average agent spends 40% of its operational cost on tool calls. Model inference is only 25%. The rest is infrastructure overhead.
Here's what we do about it: cost budgets per agent instance, per task, and per session. If an agent exceeds its budget, it enters "degraded mode" — read-only tools only.
python
class CostController:
def __init__(self, budget_cents: int = 50): # Default $0.50 per task
self.budget = budget_cents
self.spent = 0
def check_tool_call(self, tool_name: str, estimated_cost: int) -> bool:
if self.spent + estimated_cost > self.budget:
self._trigger_degraded_mode()
return False
self.spent += estimated_cost
return True
Set budgets aggressively. You can always increase them. Starting with no budget is how you get $10,000 agent sessions.
Testing: The Unsolved Problem
Unit testing an agent is like unit testing a chess player. You can test individual moves, but you can't test strategy.
For production agentic workflow production rollout, we use three testing layers:
Unit tests cover tool behavior — does the tool handle edge cases, timeouts, errors? This is traditional software testing. It works fine.
Scenario tests cover agent behavior — give the agent a task, check if it completes it correctly. We use baseline datasets with known outcomes. A customer service agent should always refund orders under $50, never refund orders over $10,000 without escalation, transfer to human for account deletions, and so on.
Stress tests cover failure modes — what happens when the LLM is down? When the database is slow? When the agent gets contradictory instructions?
The Top 5 Open-Source Agentic AI Frameworks in 2026 includes testing utilities in some cases, but none are production-grade yet. Build your own test harness. It's the only way.
The Deployment Checklist
Before you deploy, run through this:
- Tool permissions: Every tool is read-only by default
- Budgets: Agent has hard limits on steps, tokens, and cost
- Timeouts: Total task timeout, plus per-step timeout
- Escalation path: What happens when the agent fails
- Human oversight: Who watches the logs for the first 72 hours
- Cost tracking: Real-time visibility into agent spending
- Rollback plan: How to revert to the previous agent version
- Observability: Every step is logged with latency and token usage
- Memory limits: Context window is managed, not unlimited
- Error recovery: Agent can handle API failures gracefully
This isn't exhaustive. But if you have these ten things, you won't wake up to a disaster.
The Future Is Boring
Here's my prediction: the best AI agents in production in 2027 will be boring. They won't be autonomous. They won't be "agentic" in the sci-fi sense. They'll be tightly scoped, heavily instrumented, cost-controlled systems that do one thing well.
The companies winning with agents right now aren't the ones with the fanciest frameworks. They're the ones who treat agent deployment like deploying any other production system — with the same rigor, the same monitoring, the same discipline.
We built SIVARO because most companies don't have this discipline in-house. If you're reading this and thinking "this is exactly what I'm struggling with," you're not alone.
Deploying AI agents in production is hard. It's expensive. It's risky. But it's also where the value is.
Just don't forget to set your budgets.
FAQ
Q: What's the minimum viable monitoring for an AI agent in production?
Log every step — action taken, tokens used, latency, tool called, success/failure. Without this data, you're flying blind.
Q: How do you handle agents that go off-topic or hallucinate?
Hard boundaries on allowed actions, plus a "relevancy check" step that verifies the agent's next action is within its scope. Escalate to human if not.
Q: Should you use closed-source or open-source frameworks for production?
We prefer open-source for control and auditability. But closed-source tools like Vertex AI Agent Builder are catching up fast. Agentic AI Frameworks compares both.
Q: What's the biggest mistake teams make on day one of deployment?
No cost controls. They let agents run unlimited tool calls and models use unlimited tokens. Always start with aggressive limits.
Q: How many agents should you deploy at once?
One. Seriously. Deploy one agent, observe it for 24 hours, then add a second. Agency is not parallelism.
Q: Can you deploy agents without human-in-the-loop?
Technically yes. Practically no, unless you're doing something extremely narrow and well-defined (like parsing invoices). Human oversight is insurance.
Q: What's the best way to test agents before production?
Scenario-based testing with known ground truth. Give the agent 100 test cases with expected outcomes. If it passes 95+, you're ready for a staged rollout.
Q: How often should you update an agent's model or tools?
Every two weeks maximum for tools. Models depend on your use case — every month is a good baseline, but only if you re-test all scenarios.
Nishaant Dixit — Founder of SIVARO. Building data infrastructure and production AI systems since 2018. Built systems processing 200K events/sec.