The most expensive AI mistake in enterprise procurement right now is misidentifying which rung of the deployment ladder you're actually on. Model selection rarely drives the failure.
There's a spectrum of AI deployment patterns — from a single prompt to a fully autonomous agent — and each rung up that ladder adds real capability. It also adds architectural complexity, operational cost, and governance surface. Buyers who understand that tradeoff make good decisions. Buyers who don't end up six months into a project that's either far more complicated than they budgeted for, or far less capable than they promised their leadership.
The rest of this section is a guided tour up that ladder. This piece names the rungs.
The Four Rungs
Rung one: the single prompt. A user sends text. A model returns text. Nothing persists between exchanges. No retrieval, no orchestration, no memory of what was asked before. This is the simplest deployment pattern and the one most people encounter first — the chatbot interface, the summarization tool, the draft generator. It's also the easiest to govern, because the blast radius of any given interaction is bounded by the conversation itself. The model can produce bad output, but it can't take action in the world.
Useful for a narrow class of tasks. Cheap to run, cheap to replace, cheap to audit.
Rung two: retrieval-augmented generation. The model still doesn't learn or remember between sessions, but before it answers, it reaches into a document store. A retrieval system finds relevant chunks — policy documents, case files, technical manuals, whatever the organization has indexed — and passes them into the context window alongside the user's question. The model answers from that retrieved material rather than from training data alone.
The retrieval step is the new surface. What gets retrieved, from where, how it's ranked, and what gets excluded all shape the output in ways that aren't visible to the user. Governance now includes the document corpus, the retrieval logic, and the freshness of the index. Cost goes up. So does the value, when it's done well.
Rung three: predefined workflows. The model is one component in a larger system. A human-designed sequence of steps — retrieve, classify, summarize, route, escalate — runs on a schedule or in response to a trigger. The model executes its assigned step; the workflow decides what happens next. Think of it as the model doing a job inside a process rather than running the process.
More capable than RAG alone. Also more brittle at the seams, because every handoff between components is a failure point. The workflow is only as reliable as its weakest integration, and the model's output in step two becomes the input for step three whether it's good or not.
Rung four: autonomous agents. The model decides what to do next. Given a goal, it selects tools, calls external systems, spawns subagents, evaluates results, and loops until it determines the task is complete — or until something stops it. The human defines the objective; the model defines the path.
Capability ceiling rises dramatically. So does everything else: infrastructure complexity, failure mode surface, cost per task, and the difficulty of explaining what the system did and why. Autonomous agents can accomplish things no predefined workflow could anticipate. They can also take consequential actions in external systems before anyone realizes the goal was misunderstood.
Why Buyers Misidentify Their Rung
A demo of a rung-four autonomous agent and a demo of a rung-three predefined workflow can look identical to a buyer who hasn't asked the right question. Both show a system receiving a request and producing a result. The difference is invisible in the output — it lives in the architecture.
The question that separates them: Who decides what the system does next?
If the answer is a human-designed workflow, you're on rung three. If the answer is the model, you're on rung four. That distinction carries enormous implications for infrastructure, staffing, vendor contracts, and the kind of review process the organization needs to stand up before it goes live.
Misidentification usually runs in one of two directions. Buyers overestimate their rung — they think they're building autonomous agents when they actually need RAG, and they spend months on orchestration infrastructure that solves a problem they don't have. Or they underestimate it — they think they're deploying a simple chatbot when the vendor has built a workflow system, and they discover the gap when their IT team tries to integrate it with systems the vendor assumed would just be there.
Both errors are expensive. The overestimate wastes time and budget. The underestimate produces a project that stalls at deployment because the buyer's environment wasn't ready for the rung they actually bought.
IDAM Bridge — In identity, the difference between a basic authentication check and a privileged access session isn't just technical — it's a governance commitment. A basic auth check is stateless: it answers yes or no and leaves no footprint. A PAM session is stateful, audited, scoped, time-limited, and revocable. The closest AI equivalent is the difference between a single prompt (rung one) and an autonomous agent (rung four). The divergence: in PAM, you define the session scope before it starts, and revocation ends the session cleanly. An autonomous agent's scope expands as it acts, and "revocation" may arrive after consequential actions have already been taken. The session isn't just open — it's been busy.
What Comes Next
The following lessons in this section take each rung in turn. RAG first — because it's where most real deployments are landing right now, and because the retrieval architecture is where the interesting governance questions live. Then predefined workflows, with particular attention to the integration seams. Then autonomous agents, where the identity and authorization questions get genuinely hard in ways that the rest of the ladder doesn't prepare you for.
The goal is enough structural fluency that when a buyer describes their AI initiative, you can place it on the ladder and ask the question that actually matters next. You don't need to be an AI architect for that.
Almost always, that question is about the rung.