What a Fully Managed AI Agent Service Actually Includes

Deloitte's survey of 3,235 business and IT leaders found that only 21% of organizations have a mature governance model for agentic AI, while agent fleets are already scaling ahead of those guardrails. A fully managed engagement is priced correctly when the statement of work carries both the build and the run with equal specificity.

What separates a chatbot pilot from a production agent is largely contractual. A done-for-you scope should name every workstream, every artifact, and every ongoing obligation, with the run phase costed on the first page rather than discovered in month four.

Feasibility Scoped Against a P&L

The first workstream is not architecture. It is a feasibility model built against a plausible profit-and-loss for the target workflow: volume, cycle time, error rate, downstream cost per failure mode, and the fully loaded cost of the humans the agent displaces or augments. Without this, later scope decisions are preferences rather than economics, and the run-phase retainer has nothing to defend itself against.

Deliverables in this lane include a workflow map, a candidate task inventory with go/no-go reasoning, a baseline ROI model, and a short list of out-of-scope adjacent workflows. Automatic.co carries this out as an AI Feasibility Modeling workstream so the build team inherits a defensible target rather than a slogan.

Reference Architecture Before the First Prompt

Lane two is the reference architecture. Before any prompts, chains, or tool wrappers are written, the SOW should produce a signed design covering model routing, the tool registry, memory and retrieval strategy, orchestration framework, approval surfaces, deployment topology, and failure handling. This is where an AI Agent Architecture advisory engagement pays for itself, because every later decision inherits from it.

Three artifacts belong in the architecture deliverable: a sequence diagram of the happy path, a state diagram of failure and retry, and a tool registry where each tool carries an idempotency key, a rate limit, and a written blast-radius assessment for invocation under wrong parameters. A proposal that cannot name these three artifacts is proposing a prototype, not production software.

Build Workstreams the SOW Should Name

The build lane is where proposals vary most in rigor. Line items should enumerate prompt engineering with an evaluation harness, tool integrations against each named target system, data-pipeline work for vector stores and ingestion sources, guardrail development, regression test suites, and operator-facing documentation. Each line needs a definition of done: a passing evaluation score, a coverage percentage, a signed acceptance test.

Without this granularity, a buyer cannot distinguish a 130-engineer-month quote from a 30-engineer-month one. That missing granularity is usually where rebranded chatbots and RPA bots hide behind an agentic label, which is the specific risk a decomposed SOW is meant to surface.

Security and Compliance as a Parallel Lane

Governance gap	Finding	Share affected
Shadow AI prevalence	More than doubled year over year	43% of breached orgs
Shadow AI breach cost	Above the $4.99M global average	$5.39M average
AI access controls	Missing at the time of incident	92% of AI-breached orgs
AI governance + security coordination	Teams actually coordinate	19% of orgs
Regulatory fine from shadow AI	Breach triggered a fine	21% of incidents

Security is not a phase; it runs in parallel with the build. The SOW should specify identity and secrets handling, least-privilege scoping per tool, audit log format and retention, data classification contracts, and a scheduled red-team exercise against the agent's authority. For regulated buyers this lane should also name the SOC 2 artifacts the vendor produces and the ones the vendor expects the buyer to produce in return.

A reasonable baseline for what to demand is captured in the agent vendor SOC 2 and audit trail requirements piece. On topology, the SOW should state whether the agent runs in shared SaaS, the buyer's VPC, on-prem, or air-gapped, and where model access logs are retained under each option.

Deployment in Three Gated Stages

Deployment is often written as a single milestone. A real managed scope separates it into three: a staging environment with synthetic traffic, a canary rollout against capped live traffic with written kill criteria, and a general-availability cutover with a rollback plan. Each gate carries its own exit criteria tied to the evaluation harness built during the architecture lane.

Approval surfaces matter here as much as any infrastructure concern. The SOW should enumerate which actions are fully autonomous, which require a tiered human check, and which are gated hard by policy. Enterprise-grade agents ship with explicit approval gates wired to the buyer's existing tools: Slack, email, or a queue in the system of record. "Fully autonomous" on a slide usually translates to "needs a reviewer on day one" on live traffic.

The Run-Phase Lines Vendors Omit

The run phase is where omissions cluster. A credible managed-service scope names each of the following with monthly pricing and an SLA attached:

• Monitoring and incident response, with an on-call rotation and a defined mean-time-to-acknowledge
• Prompt and model-version drift tracking, with the regression suite rerun on a defined cadence
• Tool integration maintenance as upstream APIs change
• Evaluation of live traffic against the baseline, with a retraining budget attached
• Agent versioning and rollback, with a semantic version on every deployed change
• Change-management review for new tools, data sources, or expanded authority
• Quarterly business review against the original ROI model from the feasibility lane

The first three months of live traffic usually exposes which of these were underpriced. The patterns are documented in our first 90 days of an agent deployment review, and nearly all of them trace back to a run-phase line that was described as "included" without a number next to it.

Pricing the Two-Year View

Two-year pricing on a serious agent engagement sits in three bands: a one-time build fee, a fixed monthly operations retainer, and usage-based inference plus infrastructure. The ratio is the tell. When 80% of the twenty-four-month total is loaded into the build fee, the run phase is being priced at zero, and the run phase is where Gartner expects most projects to be cancelled.

A healthier ratio sits near 35-45% build, 40-50% run, and 10-20% consumption across twenty-four months, with vertical specifics pulling it around. Nasdaq's 2026 Global Governance Pulse survey found that 71% of executives described their organizations as "newbies" or "explorers" in AI readiness despite directing roughly one-fifth of technology budget to AI. That mismatch shows up as an underfunded run phase in the first proposal and loudly as an escalation in month seven.

What a Good SLA Answer Sounds Like

Put one question to any managed-service vendor: who holds the pager at 3 a.m. on day 400, and what specifically breaks the SLA. A credible answer names a specific on-call team, the mean-time-to-acknowledge, the escalation path to a named human engineer, the mean-time-to-restore commitment, and the credit against the monthly retainer when the SLA is missed. A stronger answer also names the agent and model versions currently in production, the last three incidents with duration, and how long each rollback took. A proposal that cannot answer that sequence is a build contract with a maintenance clause stapled on, not a managed service.