What are the best AI agents for operations and back-office work in 2026?

Vendors sell ops agents the way they used to sell chatbots: a window, a logo, a slide about hours saved. I run invoice matching, vendor onboarding, and ticket close. The product is whether a tool call can be refused, logged, and retried without a person in every loop.

When I pick a stack for operations, I ignore the demo. I ask three questions the NIST AI Risk Management Framework already pointed at in 2023: who is allowed to act, what record you keep, and how the system recovers. Tool governance, audit log, and retries: that is the ranking.

An ops agent finishes a desk job. It calls tools, stops on a done condition, and leaves an artifact a script can check. I ranked seven platforms on policy at the tool boundary, reconstructable logs, and retry that does not restart the whole job.

How I ranked them

I weighted tool governance first, audit second, retries third. A platform that logs beautifully but cannot forbid a refund over a limit is not an ops agent, and a platform that retries forever without a budget is a bill. Scores come from official docs, not quotes on a homepage, and I skipped listicles that grade chat quality.

Tool governance means a check that sits outside the prompt: the model proposes a call, and something else permits or forbids it, using identity and arguments, not vibes. Amazon’s 2026 AgentCore Policy docs are blunt: enforcement happens at the gateway, before the tool runs, so an agent cannot talk its way around the rule.

Audit log means I can reconstruct a run after the fact: who invoked it, which tool, which arguments, and whether policy allowed it. Latency, error, and cost help, but they are second.

A dashboard of token charts is not an audit trail. A span that names the tool and the principal is.

Retries mean the failed step runs again, not the whole job. LangGraph’s 2026 fault-tolerance docs give you a RetryPolicy per node: backoff, jitter, which exceptions retry, then an error handler after attempts are spent.

That is the shape I want on a payment call. Restarting from the greeting is how you double-charge.

• Governance first. If the model is the last check, it is a chatbot with APIs.
• Audit second. If you cannot replay who called what, you cannot defend the run.
• Retries third. Transient failure should hit the node. Business failure should stop.
• No prices here. AWS, LangChain, Microsoft, Google, Salesforce, and ServiceNow all publish their own. I will not invent a number.

What an ops agent is

An ops agent is a worker on a desk job, not a chat window. It has a finish line a script can see, a short tool list, and a runtime that can kill it. If the output is only more talk, it is still a chatbot, and this ranking is for back office, not coding agents.

The job definition is what an ops agent is. The short version here: a job, tools, a stop rule.

Anthropic’s Building effective agents (19 December 2024) draws the same line I use on client work: a workflow is a path you drew, and an agent is a model that directs its own tool use. Most back-office work still wants the workflow, with an agent only where the path will not stay still.

YouTube

Open original

Alex Albert, Brad Abrams, and Katelyn Lesse of Anthropic walked the same tools-in-the-loop argument on 2 Oct 2025.

Coding agents live in a repo. Ops agents live in mail, tickets, ERP, CRM, and the shared drive.

They touch money, PII, and other people’s records. A clever refund that posts twice is worse than a slow one that posts once.

Use one agent when the job is one path. Split only when permissions should not share a body.

Multi-agent orchestration is a shop, not a default. I start with one operator and a tight tool list.

The ranking

I ran seven products through the same three tests. AgentCore sits first because policy lives outside the model, ServiceNow and Agentforce follow because they already own the desk, and LangGraph Platform wins retries. Foundry, Google ADK, and the OpenAI Agents SDK are how you build when the work is yours to host.

These are seven ways to put a loop around tools, and I would mix them: AgentCore Runtime hosts LangGraph, LangSmith Deployment wraps Google ADK, and Foundry traces LangGraph and the OpenAI SDK. The rank is the control plane you bet the desk on.

1. Amazon Bedrock AgentCore

I ranked AgentCore first because the policy engine sits on the tool path, not in the prompt. Cedar evaluates the principal, the tool, and the arguments before the call runs. CloudWatch and CloudTrail keep the record, and sessions are isolated microVMs, not shared processes hoping the model behaves.

AWS’s AgentCore overview (2026) describes a modular platform: Harness, Runtime, Memory, Gateway, Identity, Observability, Evaluations, Policy, Registry. You can use the pieces with CrewAI, LangGraph, LlamaIndex, Google ADK, the OpenAI Agents SDK, or Strands. You do not have to rewrite the agent to get the boundary.

Policy is the reason it sits at number one. The 2026 developer guide says Policy intercepts all agent traffic through AgentCore Gateways and evaluates each request against a policy engine before allowing tool access.

Policies are Cedar. You can also author in natural language, which AWS translates and validates against the tool schema, then checks for rules that are too open, too tight, or impossible to satisfy.

A permit can name the principal, the tool, the gateway, and a condition on arguments. The refund example in AWS docs is the one I use: only an OAuth user tagged refund-agent, only process_refund, only if context.input.amount is under the cap. Forbid wins, and the model cannot override it by being confident.

Temporal policies go further: you send a policy session id on the request, and the engine can require an approval that already happened in that session, block a tool after N calls, or keep a running total under a budget. That is ops, not a system prompt that says “please do not refund twice.”

Identity is a first-class service. AgentCore Identity (2026) gives agents workload identities, inbound IAM or OAuth, and outbound credentials for third-party APIs, with audit trails on token use.

Observability emits OTEL to CloudWatch, Harness operations log to CloudTrail, and policy decisions go to CloudWatch. That is an audit log I can hand to security.

Runtime isolation matches the job: each session gets its own microVM, so CPU, memory, and filesystem do not mix. After the session ends, the microVM is terminated and memory is sanitized.

MicroVM sessions last up to 8 hours. Instances last up to 14 days. The environment survives the wait, so you do not restart research because a vendor API blinked.

I still write retries in the graph when I host LangGraph on Runtime. AgentCore does not replace RetryPolicy. It gives you the room to use one, with the same Gateway and Policy if the inner loop is LangGraph, ADK, or the OpenAI SDK.

2. ServiceNow AI Agents

ServiceNow already sits on the ticket, which is the job. Agents that update incidents, route changes, and close requests inherit ACLs, run-as identity, and a CMDB, and AI Control Tower is the inventory and kill switch. I ranked it second because governance lives in the platform operators already audit, not in a sidecar they forget to turn on.

ServiceNow’s product docs (2026) describe AI Agents as workers that act inside Now workflows, built in AI Agent Studio or taken from prebuilt packs, then governed by AI Control Tower. The Control Tower page is explicit: discover, secure, govern, observe, and measure any AI across the enterprise, including third-party agents, models, and MCP servers, tied back to the CMDB.

On 5 May 2026, at Knowledge 2026, ServiceNow published the Australia-release expansion. Control Tower gained discovery across more than 30 integrations, identity governance into hyperscaler environments, and dashboards for AI spend. Documented scope: inventory, identity, observe, govern.

Now Assist Guardian inspects inputs and outputs, with categories you can log or block per skill. The agent still runs as a user you chose.

If that user cannot write the change record, the agent cannot either. That is tool governance I trust more than a prompt that says “respect ACLs.”

Audit is native. Skill usage, session traces, and approval flows live in the instance.

Security already knows how to export that. Retries are platform retries: flows, business rules, loop-prevention properties on agentic workflows.

It is not LangGraph’s per-node backoff. For incident triage, I will take ACL-backed writes over a beautiful RetryPolicy that posts to a REST API with a shared key.

Pick ServiceNow when the desk is already ITSM, HRSD, or CSM on Now. Do not drag tickets into a greenfield agent so you can say you built one. The work is the ticket, so put the agent on the ticket.

3. Salesforce Agentforce

Agentforce is the CRM desk for quotes, cases, and orders. Actions run in the end user’s context by default, so sharing rules still mean something, and the Einstein Trust Layer plus session tracing keep the plan and the tools. I ranked it third for audit and permission inheritance, not for a coding runtime.

Salesforce Help (updated 25 August 2026) describes the Einstein Trust Layer as zero-data-retention contracts with external model providers, toxicity scoring, and an audit trail of prompts, responses, and trust signals stored in Data 360. That is the record I want when a case summary is wrong and legal asks what the model saw.

Agentforce Session Tracing, in the same Help set, records the step-by-step logic, topic selection, and tool-calling sequence for each session. Agent Analytics sits on the Session Tracing Data Model.

You query events, not vibes. Turn the collection on, because if you do not store the trail you do not have one, and Salesforce says this out loud.

Tool governance is the sharing model you already fight about. Employee-channel agents limit subagents and actions from the end user’s context.

Unauthenticated sessions run as the agent user, and org-wide defaults apply. Salesforce tells you to review that user.

Filters on actions are the extra belt. This is CRM RBAC, not Cedar. For a quote desk, that is the right shape.

Honesty where the docs are honest: data masking for LLMs is disabled for agents. Salesforce Help states it. Zero-retention contracts still apply, and in-boundary models never leave Salesforce, but you do not get the same field masking you get on Einstein Service Replies.

Retries are Salesforce automation retries, not a graph policy. I do not pick Agentforce to be my durable executor.

I pick it when the record is a Salesforce record and the person who must not see it already cannot. If the job is “close the case and write the order,” start here. If the job is “call six SaaS APIs overnight and resume on failure,” look at LangGraph Platform or AgentCore.

4. LangGraph Platform

LangGraph Platform, renamed LangSmith Deployment in October 2025, is first on retries in this ranking. The 2026 docs still describe the same engine: assistants, threads, runs, checkpoints, and a queue that can resume from the last step. I ranked it fourth overall because you write the tool policy in code.

LangSmith Deployment (2026) is a durable execution engine. Runs live on a managed task queue with automatic checkpointing.

A run can be retried, replayed, or resumed from the interrupt, not from scratch. interrupt() parks the graph, frees the worker, and waits for a human or another system, and hours later Command(resume=...) continues, which is how I do invoice approval.

RetryPolicy is first-class. The 2026 fault-tolerance guide lets you set max_attempts, backoff, jitter, and retry_on per node, or as graph defaults via set_node_defaults.

Default retry_on skips programmer errors (ValueError, TypeError, and friends) and, for requests and httpx, retries only on 5xx. NodeTimeoutError is retryable.

After attempts are spent, an error handler can compensate and route with Command. That is the refund path I want.

Crash resilience is documented: queue workers heartbeat in Redis, a sweeper every two minutes re-queues runs whose heartbeat died, and transient Postgres errors retry up to three times. At most one run executes on a thread at a time.

Audit is LangSmith: every node, tool, and model call on a thread, with time-travel to a checkpoint. It is an engineer’s audit.

Compliance teams that want Cedar decisions in CloudTrail will not call this enough. I pair it with AgentCore Gateway when the writes need a policy engine, and I keep LangGraph for the loop.

LangSmith Deployment is also framework-agnostic. The 2026 overview lists LangGraph, Google ADK, CrewAI, and others.

Hosting is Cloud, Hybrid, self-hosted with a control plane, or a standalone Agent Server. Cloud needs a Plus plan or above.

Read LangChain’s page for cost. I use Platform when the job is a long graph with human gates, not as my only ACL.

5. Microsoft Foundry Agent Service

Foundry is the Azure desk: identity is Entra, and logs are Application Insights. Tracing is documented as capturing inputs, outputs, tool usage, retries, latencies, and costs. I ranked it fifth for that audit trail, decent tool control through the catalog, and retries you can see but still have to design.

Microsoft’s agent tracing overview (updated 28 August 2026) is the page I send to Azure shops. Tracing is generally available for prompt and hosted agents. Workflow and external agents were still preview on that date.

Server-side tracing starts when you attach Application Insights, with no code change for hosted agents, and retention follows your Insights configuration. Microsoft’s setup guide mentions out-of-the-box traces for the past 90 days once it is on.

The same overview names retries as a first-class span concern, and Foundry puts them on the trace you already opened to debug a bad tool. Tool spans record arguments and results, and Microsoft says to redact them.

Tool governance is Azure RBAC plus the tool catalog plus tool_choice. tool_choice can force, forbid, or leave the model to decide. That is invocation control, not argument control.

A Cedar rule that caps amount is tighter. For Microsoft shops I still want the catalog, managed connections, and MCP approval flows the Foundry docs describe. I do not pretend tool_choice is a policy engine.

Foundry also instruments Microsoft Agent Framework, Semantic Kernel, LangChain, LangGraph, and the OpenAI Agents SDK. If your agent already lives in Azure, start here for the audit plane. If you need Cedar, put AgentCore Gateway in front of the same tools.

6. Google Agent Development Kit

ADK is how I write agents that should look like software: LLM agents, workflow agents, plugins for policy, and callbacks before a tool runs. OpenTelemetry is built in, and you deploy to Agent Engine, Cloud Run, or GKE. I ranked it sixth because governance is code you attach, and retry is still your job unless you add a graph.

Google’s ADK docs (2026) treat an Agent as a self-contained execution unit: LlmAgent reasons and picks tools, and Sequential, Parallel, and Loop workflow agents make the path deterministic. That split matches Anthropic’s 2024 note and matches how I build ops: deterministic where I can draw the path, LLM where I cannot.

Plugins are the governance hook. The plugins guide says you use them for logging, policy enforcement, and metrics, attached at the runner so every agent under it inherits the rule.

The safety guide prefers plugins over one-off callbacks for guardrails that are not specific to a single agent. before_tool_callback can inspect the tool and arguments and block the call. I write the refund cap there when I am not on AgentCore.

Audit is OpenTelemetry. Google Cloud Observability docs (2026) say ADK 1.17.0 and later ship built-in instrumentation.

GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY turns on traces and logs, a second flag captures message content, and spans follow GenAI semantic conventions. You get Cloud Trace, Logging, and Monitoring, which is an audit log if you keep it and empty if you never set the flags.

Agent Identity (preview in the 2026 IAM docs) gives a SPIFFE principal per deployed agent. The auth manager vaults OAuth secrets and injects headers into ADK tool calls.

IAM binds that principal to the APIs it may touch. Preview, so I do not sell it as Cedar.

Evals are first-class. ADK’s evaluate docs score tool_trajectory_avg_score by default at 1.0, meaning the tool path must match.

Vertex adds TOOL_USE_QUALITY and SAFETY rubrics. Retry still means you wrap the tool or you put ADK on LangSmith Deployment, which the 2026 LangSmith docs support. ADK is the authoring kit, so pair it with a runtime that owns resume.

7. OpenAI Agents SDK

The OpenAI Agents SDK is the smallest loop that is still an agent: agents, tools, guardrails, handoffs, sessions, tracing. I ranked it seventh for ops because the policy language is Python in your repo, not a gateway security will sign. It is a good inner loop and a weak enterprise control plane on its own.

Official tracing docs (2026) say the SDK records LLM generations, function tools, guardrails, and handoffs by default. You can disable it. I do not, because the dashboard is how you debug a bad tool before anyone else sees it.

Guardrail spans tell you whether the tripwire fired. That is an audit of the run, not CloudTrail.

Guardrails are the governance: input guardrails run on the first agent, output guardrails run on the last, and tool guardrails run on every custom function tool, before and after execution. A tripwire raises and the runner stops. For a wire step I block, and for a classify step I run parallel.

On 15 April 2026 OpenAI published the next evolution of the SDK: native sandboxes, snapshot and rehydrate, harness split from compute. State lives outside the container, so a dead sandbox does not kill the run.

That is real durability, and max turns still cap the loop. It is not RetryPolicy with jitter and exception classes. I add that myself or I host the same agent on LangGraph or AgentCore Runtime, which AWS lists as a supported framework.

I use the SDK to prototype the specialist. I do not hand it the production ledger without a gateway in front.

Guardrails live next to the agent. A determined prompt can still aim at a tool you exposed.

How to pick for a real desk

Pick from the job, not from the slide. If the record is a ServiceNow incident, use ServiceNow, and if it is a Salesforce case, use Agentforce. If you are building a graph of tools that must pause, resume, and retry, use LangGraph Platform, and put AgentCore Gateway on the writes when security needs a policy language.

1. 01

   Write the job and the forbidden tools

   Name the artifact and the calls that must never run. Search is not send, and draft is not post. If you cannot name them, you are still shopping for a chatbot.

2. 02

   Demand policy at the tool boundary

   The model proposes. The gateway, ACL, plugin, or guardrail disposes. Put the cap on amount in Cedar, a sharing rule, or a before-tool plugin. Do not put it only in the system prompt.

3. 03

   Read one real audit record

   Open a past run. Reconstruct who acted, which tool, which arguments, and whether policy allowed it. If the page is a token chart, you do not have an audit log yet.

4. 04

   Fail a tool on purpose

   Kill the connection mid-call. The runtime should retry that node, honor backoff, and stop at a cap. If it restarts the job you will double-send, and if it never stops you will pay.

5. 05

   Point it at one desk

   One operator, one week, traces read daily. Then take the person out of the inner loop where the score holds. Expand only after that week is boring.

Mixing is normal. I have put a LangGraph graph on AgentCore Runtime with Gateway Policy on the money tools, and LangSmith on the traces. The rank is which control plane I would bet first, not a ban on the others.

Buying tests I refuse

A feature matrix that grades reasoning is not a buying test. Inbox tools and bank tools do not share a body, and a demo that closed one ticket is not an eval. I do not add a second platform until the first desk is boring.

• A chatbot with a Zap behind it, sold as an ops agent.
• Thirty tools on one worker, including deploy and refund.
• Retries with no idempotency key on a write.
• Audit that stores prompts and forgets tool arguments.
• A fleet because the slide said multi-agent. Start with one.

NIST AI RMF (2023) still maps: GOVERN the policy, MAP the tools, MEASURE the frozen jobs, MANAGE the incidents. Anthropic’s 2024 agents essay still maps: draw the path when you can. The seven products change, and the three tests do not.