An AI plan made Monday shouldn't send on Thursday

Salesforce shipped a new runtime under Agentforce last week. The announcement says agents can now “pursue goals across days and weeks instead of completing only a task or interaction.” Hunter, the outbound sales agent, “works a sales pipeline from research to outreach, collaborating with sellers over weeks and months.” It’s in pilot, generally available in November. Durable execution, in their words, “keeps plans running over time and allows an agent to resume or course-correct as circumstances change.”

That is a real capability, and it’s where the whole field is headed. Prosus made the point bluntly in its State of AI Agents report: the interesting question stopped being which model is smartest and became “for how long can your agent work autonomously before it breaks?” Their measurement puts frontier models at close to five hours of unattended work, with that number roughly doubling every 196 days.

Length of leash is a capability. It is not trust. Those two get mixed up constantly, and on a customer service desk the difference shows up fast.

What actually breaks on a long run

A chatbot that answers badly is wrong once, to one person, in one message. You find out quickly because the customer writes back annoyed.

An agent carrying a multi-day plan fails differently. It decided on Monday using what it knew on Monday. Tuesday, the customer replies. Or cancels. Or pays the invoice. Or calls in and a human sorts the whole thing out in four minutes. Thursday, the plan fires anyway.

Now you have sent a payment nudge to somebody who already paid. A “just checking in on your issue” to somebody whose issue closed two days ago. A booking confirmation for a slot you gave to someone else.

Nothing there required the model to hallucinate. The reasoning was sound when it happened. The world moved underneath it.

The Cloud Security Alliance surveyed organizations in April and found 65% had at least one security incident caused by AI agents on their network in the past year. Buried in the breakdown: 41% of affected organizations reported “unintended actions across business processes.” That’s the category worth staring at. Not a breach, not an outage. The agent did something nobody wanted, deliberately, competently, at the wrong moment.

The same research found 60% of organizations can’t terminate a misbehaving agent once it’s running. A plan you can’t stop is a promise you keep making on the customer’s behalf whether or not it’s still true.

The popular fix costs more than it saves

The standard answer is better observability. Trace the reasoning. Watch the trajectory. Alert on drift. Fine, do all of it if you can afford to.

But look at what that actually asks for. It puts a person back on full-time supervision of a system whose selling point was not needing one. A 40-person company doesn’t have that person. Neither does a 6-person company, and the 6-person company is where support is drowning hardest.

There’s a cheaper fix, and it’s dumber than a monitor. Check the world again right before the act, and refuse if anything moved.

Not the model checking itself. Ask a model whether its own plan is still a good idea and it will usually say yes, because it wrote the plan and it is agreeable by construction. The check has to sit in plain code the model has no way to argue with.

Three questions, asked at the last possible second

Before anything leaves the building, three cheap lookups settle it.

Has the customer said anything since this was written? A newer message means the plan is working from an old picture. Stop and re-read the thread.

Does the approval on file still match what’s about to go out? If a person approved a draft and the text changed after, that approval is for a different message. It doesn’t transfer.

Is this topic still one the owner has cleared? Permission granted in June is not permission today if the owner narrowed it since.

Any single no, and the work stops and goes to a human with a note saying why. Not a retry. Not a best guess. A stop.

That is how Celeste works at IMCeleste. Celeste learns from a business’s own support history, practices privately where nobody sees it, and goes live one topic at a time as the owner decides it has earned the topic. The permission model is boring on purpose: the agent proposes, hard code decides, and the checks above run at the moment of sending rather than the moment of planning. When something is held, the owner sees the draft and the reason.

None of that makes the agent smarter. It makes the agent’s confidence expire on schedule, which is a different and more useful property. You can read the rest of how the guardrails fit together on the product page.

The industry will keep pushing the leash out. Five hours becomes ten, ten becomes a week, and somebody will demo an agent that ran a quarter unattended. Good. Just remember that a longer run is more distance between the moment the agent decided and the moment the customer feels it. That gap is where the apologies live.